Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to send password reset notification email

scriptogr.am

Post reply on HN
Print view View original

31–40 of 44 posts

Re: How not to send password reset notification email

#31

Post by kybernetikos »

unclebucknasty wrote: post #25
kybernetikos wrote: post #23

Offical email should never include links (unless it's signed, but what is?), the potential for trouble is just too great. I had this exact same problem back in 2003 from a financial company. I wrote them a serious email telling them just how dangerous it is to teach your users that it's OK to click on links that don't even go to your domain in random emails. I even showed them how easily I could create a phishing sit…

I guess here Evernote figured any instructions they sent would have resulted in a link being sent anyway, so why not just send the link and ensure a higher shot off compliance. They seemed to have forgotten about phishing. Some sites have taken to including in such emails account information that presumably only the company would know (such as part of the account number) along with the name. I know of at least one ba…

Not to mention that most email has roughly the same security level as a postcard. There are a lot of personal details that I wouldn't want written on a postcard.

Not to mention the fact that lots of 'personal information' is not in fact private, e.g. date of birth (one of my financial accounts uses date of birth), mothers maiden name, social security number, etc.

Re: How not to send password reset notification email

#34

Post by bpatrianakos »

Great points and something I've been studying and trying to perfect myself for my own service. So while I couldn't agree more with the author's position, I think the unfortunate reality is that there's only a very small minority of users who would know any better anyway. It's mostly just people like us would know better. Everyone else would just click because there are no spelling or grammar errors and the email is branded properly.

This raises the question of how to educate users. I think we may be confusing them. I don't know about everyone else, but I teach non-technical people not to trust emails that ask you to reset your password when you didn't initiate the action. I always teach, as many of us do I think "don't click links in emails unless you know the sender personally or have requested the link" but then in cases like this we have to go back on that statement and say "well this time it's okay" and while we have really good and logical reasons for why, I don't think we can expect non-techies to understand it. To them it sounds like a contradiction, like "don't click links in emails except when I say it's okay". Then even if you teach people to check where the links are going (good luck) you've got to also teach them about domains, subdomains, and maybe even query strings. It's just a huge mess and I'm at a loss for how to educate people when it comes to a situation like Evernote's regardless of having link tracking or not.

Re: How not to send password reset notification email

#35

Post by bpatrianakos »

theyCallMeSwift wrote: post #33

Couldn't Evernote just use a CNAME record on a subdomain that pointed to mkt5371.com? I know that's how the SendGrid click tracking app keeps the links on your domain ( http://sendgrid.com/docs/Apps/click_tracking.html )

Not if the domain is always different. I've seen transactional email providers who will give you a different domain or subdomain for each email and it's all real random. I'm currently using Mandrill and I haven't checked if its true for them but I know its true for others.

Re: How not to send password reset notification email

#36

Post by apendleton »

bpatrianakos wrote: post #35
theyCallMeSwift wrote: post #33

Couldn't Evernote just use a CNAME record on a subdomain that pointed to mkt5371.com? I know that's how the SendGrid click tracking app keeps the links on your domain ( http://sendgrid.com/docs/Apps/click_tracking.html )

Not if the domain is always different. I've seen transactional email providers who will give you a different domain or subdomain for each email and it's all real random. I'm currently using Mandrill and I haven't checked if its true for them but I know its true for others.

That's a fairly arbitrary engineering decision, though. Using a CNAME for link tracking seems like an obvious use to accommodate, and you'd think providers would build their services with that in mind, or at least be able to tweak them once a demand presented itself.

Re: How not to send password reset notification email

#37

Post by apendleton »

unclebucknasty wrote: post #24

Should also be using SSL so querystring is encrypted.

It's in an email message, which has probably already made several hops in the clear, so that's probably a lost cause if they're looking for actual security, but a nice idea, I guess.

Re: How not to send password reset notification email

#38

Post by evilduck »

nonamegiven wrote: post #30

I got a reset message from Evernote, and I didn't even remember that I had an account. I must have tried it for my typical 30 seconds to conclude "meh" and moved on, then forgot it. I'm still not 100% sure what they do beyond ... note taking? But I initially assumed it to be ballsy phishing, a brazen attempt to capitalize on Evernote's current trouble. Why? BECAUSE IT HAS A FUCKING LINK TO THE SERVICE IN THE EMAIL! T…

Synchronized note taking. That part's nothing too special. The killer feature for me is they do OCR on your uploaded pictures, which makes saving whiteboard drawings and back-of-napkin diagrams a breeze, or for snapping pics of business cards and then having searchability over the contents.

Re: How not to send password reset notification email

#39

Post by rorrr »

PeterisP wrote: post #28
rorrr wrote: post #17

Earlier quoted context omitted.

You would have to know the URL on the third party server to redirect to. And usually, you don't, because they are generated internally by some pre-processor.

Why can't you automagically redirect from mkt5371.evernote.com/anything to links.evernote.mkt5371.com/anything ? Better yet, simply point your DNS "passwordreset.evernote.com" to the same server.

Because you don't know what that "/anything" is, only your mailing system does, and it converts links in your email template to these mkt5371-type links right before it sends out the email.

Re: How not to send password reset notification email

#40

Post by unclebucknasty »

apendleton wrote: post #37
unclebucknasty wrote: post #24

Should also be using SSL so querystring is encrypted.

It's in an email message, which has probably already made several hops in the clear, so that's probably a lost cause if they're looking for actual security, but a nice idea, I guess.

True, but getting everyone on signed/encrypted email is a much more massive undertaking than just sending an https link.

To your point, as long as straight SMTP is involved, there will always be a gaping hole. But, sending https links is a very cheap way to prevent making the hole even bigger.

Anyway, all of this underscores the fact that virtually nothing that Evernote did was secure. But, most companies probably wouldn't have done much better.

Post reply on HN