How not to send password reset notification email
1–10 of 44 posts
Re: How not to send password reset notification email
#2[deleted]
Re: How not to send password reset notification email
#3This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag.
Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a domain that isn't a descendant of the sender's domain.
Re: How not to send password reset notification email
#4I didn't even get the email from evernote regarding the password reset.
Luckily, I had the evernote app sign me out and asking me to login again (which didn't work with my old password). I had to login through the website and it prompted me to change my password (no link on why) and then it worked with the new password.
I searched through my email trying to see if any email got eaten by the spam folder, but none, "No emails".
Re: How not to send password reset notification email
#5I didn't even get the email from evernote regarding the password reset. Luckily, I had the evernote app sign me out and asking me to login again (which didn't work with my old password). I had to login through the website and it prompted me to change my password (no link on why) and then it worked with the new password. I searched through my email trying to see if any email got eaten by the spam folder, but none, "No…
[deleted]
Re: How not to send password reset notification email
#6In their Security Notice they write "Never click on 'reset password' requests in emails — instead go directly to the service".
And after I changed my password I received confirmation email saying
"This email confirms your recent Evernote password change.
If your Evernote password was changed without your knowledge, then please click the link below to change it again:" And big "Reset Password" button.
A bit funny as they just told me to never click on something like that.
Re: How not to send password reset notification email
#7This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag. Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a do…
Trusting whois data isn't a good idea. With most registrars you can write into those fields whatever you want. Just because a domain tells you it belongs to someone, doesn't actually mean that it belongs to this person.
Re: How not to send password reset notification email
#8This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag. Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a do…
Trusting whois data isn't a good idea. With most registrars you can write into those fields whatever you want. Just because a domain tells you it belongs to someone, doesn't actually mean that it belongs to this person.
Well, yeah, it's generally a first step — last few cases were Kickstarter-related campaign stuff, so I could look for evidence that they actually sent it, and then hope it's actually that thing. But this just goes further to illustrate that this is a really bad idea — there is good way to validate such an email.
Re: How not to send password reset notification email
#9I didn't even get the email from evernote regarding the password reset. Luckily, I had the evernote app sign me out and asking me to login again (which didn't work with my old password). I had to login through the website and it prompted me to change my password (no link on why) and then it worked with the new password. I searched through my email trying to see if any email got eaten by the spam folder, but none, "No…
I have a feeling they're sending them in batch emails. I just got mine this evening after a lot of other people.
Re: How not to send password reset notification email
#10This is more generic: if you do link tracking in your email, do it through your own domain, it's really not that hard, and urls that go through some other business are a huge red flag. Personally, I probably cut people a bit of slack by going through whois to check if the domain belongs to some well-recognized mass mailer, but I wouldn't blame the MUA for just spamming anything that mentions a "login" along with a do…
It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).