I just had a very interesting conversation with a support rep of a software product that I love (and which shall remain anonymous here).
They use product keys for licensing, and in case the user forgets their key, they employ the following recovery mechanism on their website:
- The user enters the e-mail address they used to purchase the product into a form.
- The key is shown to them instantly, directly on the page.
While as a UX person, I definitely see how convenient this is, I'm also quite worried about the security of that system, since an attacker just needs to know a person who uses that product and their e-mail address to obtain their product key.
An easy fix would be to e-mail the matching key to the specified address, instead of showing it directly on the page, but as it turned out, they did exactly that before. The result was that many users didn't get the mail since it went directly into their spam folder. It was a friction point in the user's journey that they seeked to avoid (did I mention I love them? :-) ).
So they posed me the question if I see a middle ground between exposing the key right there on the page and having the user jump through hoops with their spam filter.
With the e-mail address potentially being the only link between the company and their customers however, I couldn't come up with a better solution.