RE: ACTION-278 Hiding metadata for security reasons

Design 3:

   1. The user is subscribed message to a mailing list.
      There is a "subscription password"; the user can pick it
      when subscribing or the system can generate one.
   2. The list processing software sends an email message to the user,
      providing advice that the user may unsubscribe from the list, and
      including a link to an unsubscribe confirmation page; the link
      also fills in the user name (but not the password).
   3. The unsubscribe page lets you enter in the password. If
       you don't remember or never had the password, there is a
       "send me my password" link, which will email the password
      to your email address.
   4. The user follows the link to the confirmation page, and finds a
      form with an input field requesting the password 
      and a button to "[Confirm] your unsubscription". The
      form is to be submitted with method="POST".
   5. The user types in the password from memory or
      copies the password from the password email message and pastes
      it into the password field, and activates the [Confirm] form
      control.
   6. The list processing software confirms the unsubscription and
      removes the user from the list.


This is the usage pattern in many email lists.

Larry

Received on Saturday, 6 February 2010 16:57:41 UTC