Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to send password reset notification email

scriptogr.am

Post reply on HN
Print view View original

11–20 of 44 posts

Re: How not to send password reset notification email

#11

Post by LaGrange »

rorrr wrote: post #10
LaGrange wrote: post #3

This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag. Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a do…

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

I would have believed you if I weren't working for a website with large emails campaigns. And this comment wasn't even aimed at "the developer", not really — but at anyone involved in decisions like this.

Re: How not to send password reset notification email

#12

Post by signed0 »

rorrr wrote: post #10
LaGrange wrote: post #3

This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag. Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a do…

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain:

1. User clicks http://links.example.com/?redirect=example.com/reset_passwor...

2. The server running on links.example.com makes a request to the third party web server

3. The server redirects the user to http://example.com/reset_password

Re: How not to send password reset notification email

#13

Post by melvinmt »

Avestan wrote: post #6

In their Security Notice they write "Never click on 'reset password' requests in emails — instead go directly to the service". And after I changed my password I received confirmation email saying "This email confirms your recent Evernote password change. If your Evernote password was changed without your knowledge, then please click the link below to change it again:" And big "Reset Password" button. A bit funny as t…

It's a test.

Re: How not to send password reset notification email

#14

Post by akaBruce »

signed0 wrote: post #12
rorrr wrote: post #10

Earlier quoted context omitted.

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

If the server running on links.example.com, wouldn't the 3rd party web server lose out on doing things like setting cookies in the client's browser or determining their rough location via IP address?

Not that I'm particularly a fan of either practice, but there's probably some use cases there that would have to be accounted for in some way that the 3rd party service could accommodate.

Re: How not to send password reset notification email

#15

Post by cynwoody »

Quite moronic of Evernote.

HTH is J. Random User supposed to figure out that mkt5371.com is a service hired by evernote.com? A minimally alert user would click the Report Phishing button upon mousing over.

By including a link that happens to do the right thing, Evernote is conditioning its users to succumb to phishing in the future.

Re: How not to send password reset notification email

#16

Post by signed0 »

akaBruce wrote: post #14
signed0 wrote: post #12

Earlier quoted context omitted.

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

If the server running on links.example.com, wouldn't the 3rd party web server lose out on doing things like setting cookies in the client's browser or determining their rough location via IP address? Not that I'm particularly a fan of either practice, but there's probably some use cases there that would have to be accounted for in some way that the 3rd party service could accommodate.

If that were needed perhaps links.example.com could display an iframe containing the third party site.

I agree that neither approach is ideal, but it would prevent users from receiving third party links in their emails.

Re: How not to send password reset notification email

#17

Post by rorrr »

signed0 wrote: post #12
rorrr wrote: post #10

Earlier quoted context omitted.

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

You would have to know the URL on the third party server to redirect to. And usually, you don't, because they are generated internally by some pre-processor.

Re: How not to send password reset notification email

#19

Post by pooriaazimi »

logn wrote: post #18

I also hate when unsubscribe from spam is on a different domain than the business, using a 3rd party email/marketing company. And I hate how "enter your email to confirm unsubscribing" is pretty common.

If I can't opt-out of a mailing campaign by just clicking a link, I'll invariably mark it as spam.

Re: How not to send password reset notification email

#20

Post by lobotryas »

signed0 wrote: post #12
rorrr wrote: post #10

Earlier quoted context omitted.

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

Going to mkt5371.com (the domain in the tracked link) gives you a static landing page with a abuse@silverpop.com contact. This tells me one of two things:

1) Silverpop doesn't have an option to disable tracking for specific links included in emails sent from their system or

2) The person creating the email failed to take advantage of this feature.

If Evernote wanted to take advantage of this feature on purpose in order to determine what percentage of their userbase has reset their password, then I'm baffled why they decided to trust a 3rd party lead management system instead of the updated_at fields in their database.

Either way, the whole point of purchasing Silverpop is that you can avoid having to code your own solution.

Post reply on HN