4 ms·

Possibly. The current ad-hoc approach of "type this URL in" that's used in various places could be extended in this case to "click this link, or alternatively

Possibly. The current ad-hoc approach of "type this URL in" that's used in various places could be extended in this case to "click this link, or alternatively go to this short address and type this short code in". This would actually work because the short URLs would be per-recipient-account - they wouldn't need to be "globally" unique! Alas, we live in a denialist dystopia, not a self-acknowledging one, so the above will probably never happen - per-recipient short URLs rely firmly on a global social graph that can predict with a high degree of accuracy who is highly unlikely to click on who else's link. Google has one of these, but nobody's supposed to realize how much of an oracle it is. So, we've just upgraded to "for security, please click this 10000-character-long URL" emails being sent from Google itself. The phishers are laughing.

exikyut 9y ago
This comment is a bit old now, but I want to clarify some things that I completely skittered over and just didn't explain adequately. It isn't a case of "not clicking on someone else's link", it's a case of never receiving someone else's link. As it is, clueless people will forward their links in attempts to let others read their messages. Of course this won't work (I don't expect so anyway). But, if person A and person B both receive the same short code, which would (obviously/presumably, in such a scheme) unlock different messages for both, that would be a very confusing user experience. Given the "enterprise security" standpoint this (somewhat) confusing feature seems to be marketed toward, I can see this being the exact kind of situation that enterprises would never want happening (the resulting executive paranoia would undermine the perceived security of the system). And so this folds into the global social graph thing I was talking about.

exikyut 9y ago

This comment is a bit old now, but I want to clarify some things that I completely skittered over and just didn't explain adequately. It isn't a case of "not clicking on someone else's link", it's a case of never receiving someone else's link. As it is, clueless people will forward their links in attempts to let others read their messages. Of course this won't work (I don't expect so anyway). But, if person A and person B both receive the same short code, which would (obviously/presumably, in such a scheme) unlock different messages for both, that would be a very confusing user experience. Given the "enterprise security" standpoint this (somewhat) confusing feature seems to be marketed toward, I can see this being the exact kind of situation that enterprises would never want happening (the resulting executive paranoia would undermine the perceived security of the system). And so this folds into the global social graph thing I was talking about.