The Job
You have the task of providing large files with sensitive data to people outside your company.
Limitations and mandates
- Recipients of the data must be notified by email
- The size of the files prohibit sending the data via email
- There could be tens or hundreds of thousands of users, so making accounts for them is not an option.
- A recipient could be anyone who has an email address.
- You need the capability for a recipient to be able to programatically consume the link and download the file so they could import into their software without human interaction.
- You need to keep this as secure as possible.
Proposed Solution
I would provide the recipients with a link via an email (TLS secured) and they would simply click the link to download the file. The link would contain a 25 character code that would let them access their file. If an IP (or MAC address?) provided a bad code 10 times, it would be blacklisted for 14 days to prevent a brute-force attack to get access to more files. The file would be a zip that is password protected with the recipient's email address as the password. The files themselves would only be available for a fixed length of time; the expiration of that time would cause the files to get deleted by a back-end process and the code to become available for another download (although it may never be re-used).
So, with my solution, a possible scenario would be: I am given an email address and I need to provide them a file customized for them. I create a file, zip it with the recipient's email address as the password, save it to my application, my application says the URL for the file will be www.test.com/GetFile.aspx?UID=12....99, and then I email them a link.
Obviously, if the email we send them with the link is compromised, the files linked in the email could be compromised as well.
Is there a better approach?