重置密码链接是一个坏主意吗？
我们有一个密码重置网络应用程序。该应用程序会向备用电子邮件发送确认码。我的经理认为，如果您必须输入代码，那么包含页面链接并不是一个好主意。
我看到他的论点。然而，帮助台已经挤满了对该过程感到困惑的用户。我假设这是因为我们的许多用户仅使用一个选项卡/窗口进行浏览，并导航出我们的网络应用程序以检查他们的电子邮件中的确认码。
我的问题：我们应该如何处理这个问题？我希望减轻帮助台的负担，从而使我们的用户在整个过程中不会感到痛苦。有什么建议吗？
澄清
他认为，我们训练用户点击来自无法验证的发件人的链接（在本例中，这是一条带有“无回复”地址的自动消息），这对用户造成了伤害。这反过来又会使用户更容易受到网络钓鱼的影响，而我们的组织中已经遇到了很多问题。
We have a password reset web application. The application sends out an confirmation code to an alternative e-mail. My manager believes it is not a good idea to include a link to the page were you have to enter the code.
I see his argument. However, the helpdesk has been overwhelmed with users who are confused about the process. I'm assuming this is because many our users browse using only one tab/window and navigate out of our web application to check their e-mail for the confirmation code.
My question: How should we approach this issue? I would like to alleviate helpdesk and, in turn, make the process pain free for our users. Any suggestions?
Clarification
He believes that we are doing the user a disservice by training them to click links from a sender that cannot be verified (in this case, it's an automatic message with a "no-reply" address). This, would in turn, make users more susceptible to phishing attempts which we've had a lot of issues with in our organization.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为发送链接是标准的做法。如果客户确实担心此电子邮件帐户的完整性，他最好先解决这个问题。
本质上，您不会因为不发送链接而获得额外的安全性，但您会获得很多安慰。就像其他人一样做 - 把它放在那里（时间有限）。
I think sending links is the standard way of doing it. If a customer is really worried about the integrity of this email account, he better gets that sorted out first.
Essentially you don't gain extra security by not sending the link, but you gain a lot of comfort. Just do it like everyone else - put it in there (time limited).
唯一最重要的事情是选择在电子邮件主题中使用唯一标识符，并让客户回复该邮件。
然后，自动脚本会检查“[电子邮件受保护]”电子邮件与主题'回复：忘记密码了？ [唯一]'。然后该脚本会将新密码邮寄给他们。
由于大多数用户在点击“回复”时不会修改主题，也不会“撰写新邮件”并手动输入收件人地址，因此很有可能，“忘记密码”的传入邮件将在其中包含该 UNIQUEID主题。
另外，帮助台只会帮助那些实际修改电子邮件“主题”的人。 ;-)
不过，还是有安全考虑。也许您的经理可能会争辩说，任何人都可能发送伪造的“忘记密码”邮件并将“回复”标头设置为攻击者的地址。处理脚本必须拦截这些伪造尝试......
The only thing on the top of mind would be the option to have a unique identifier in the e-mail's subject an have the customers reply to that mail.
Then an automated script checks '[email protected]' for emails with the subject 'Re: Forgot your password? [UNIQUEID]'. The script would then mail them their new password.
Since most users won't modify the subject when hitting "Reply To" and won't do a "Compose new mail" and enter the recipient address manually, chances are big, incoming mails to "password-forgotten" will have that UNIQUEID in the subject.
Plus helpdesk would only have help those that actually modify the email's "Subject". ;-)
There are security considerations, though. Maybe your manager might argue, that anyone might send a forged "Forgor your password" mail and set the "Reply-To" header to the attacker's address. The processing script has to intercept these attempts of forgery...
我认为没有理由不应该包含该链接，特别是如果代码类似于散列，因为有人破解的可能性微乎其微。
但是，您可以向插入代码的页面添加额外的保护，并将尝试次数限制为 3 次。要获得更多保护，请将电子邮件地址也发送到该页面，并允许每个电子邮件地址尝试 3 次而不是3次尝试/IP，很容易被绕过。
I see no reason why the link shouldn't be included, especially if the code is something like a hash because the chances of somebody cracking that are slim to none.
You could however, add an extra protection to the page where the code is being inserted and limit the number of tries to something like 3. For even more protection, send the email address to that page as well, and allow 3 tries per email address instead of 3 tries / IP, which can be easily bypassed.