Hi Kyle.

I’m very curious about this requirement. What do you mean by signed URL? Please provide more details and we will review what options we have in IFS Cloud to achieve that requirement.

Thank you much.
Best regards.
Gonzalo.

 

Hi @Gonzalo,

We are looking to have a secure way for customer to click on a link within an email body and sign the URL to ensure that the URL has not been tampered with during transit. The signed URL contains a signature that when used it uses that signature to validate that the original url has not be tampered with.

We do not want to include a banking information or a regular URL because those can be intercepted during email transit potentially and then manipulated to direct payment elsewhere.

I’ve asked IFS Support about Encrypted emails as well, but they directed me here to the Community.

Ultimately, we are looking for a secure way to share bank account information with Customers while preventing any man-in-the-middle attacks/manipulations during transit of emails.

There may be other options that are more straight forward and I’m more than willing to here what other options are available.

Thanks,

Kyle

Hi @kmonto 

As far as I know, for encrypted emails require S/MIME encryption, and IFS mail Sender does not have that capability.

Regards,

Damith

Hi Kyle.

OK, I think I kind of understand the requirement. You want to ensure the links and the content of the email message has not been altered.

As far as I know SMTP protocol doesn’t have security built-in but most SMTP servers that you work with will enforce the use of a security layer. In fact, this is how you configure the SMTP server connection in IFS Cloud:

So with this we ensure that information is sent to the SMTP server in a secure way. Then, the SMTP will forward the email to the recipient destination SMTP server in a secure way too.

IMHO, there is little chance that content can be intercepted and altered but I’m not an expect on this matter and cannot provide much help.

Ultimately you could have a look at this link from Twilio/SendGrid about email and encryption:

https://sendgrid.com/en-us/blog/what-is-email-encryption#:~:text=By%20default%2C%20SendGrid%20uses%20opportunistic,1%20or%20higher%20connection.

More specifically, it seems you want to include a URL payment link. I think this other source could provide more info:

https://www.totalprocessing.com/are-payment-links-secure/

Maybe after reading this you don’t really need to implement anything on the email itself. In my experience when using payment links, URLs are all secured by SSL/TLS and relay on PKI infrastructures and well know CA and certificate chains.

If you provide you customers with URLs that are secured by SSL/TLS and your customers are well trained about accessing the proper domain, no problem should happen.  

But please, let me know what you think and if you have some more specific details about the interaction with your customers that could help define the proper solution share it. We might be able to provide some extra help.

Best regards.
Gonzalo.