I just had a very interesting conversation with a support rep of a software product that I love (and which shall remain anonymous here).

They use product keys for licensing, and in case the user forgets their key, they employ the following recovery mechanism on their website:

  1. The user enters the e-mail address they used to purchase the product into a form.
  2. The key is shown to them instantly, directly on the page.

While as a UX person, I definitely see how convenient this is, I'm also quite worried about the security of that system, since an attacker just needs to know a person who uses that product and their e-mail address to obtain their product key.

An easy fix would be to e-mail the matching key to the specified address, instead of showing it directly on the page, but as it turned out, they did exactly that before. The result was that many users didn't get the mail since it went directly into their spam folder. It was a friction point in the user's journey that they seeked to avoid (did I mention I love them? :-) ).

So they posed me the question if I see a middle ground between exposing the key right there on the page and having the user jump through hoops with their spam filter.

With the e-mail address potentially being the only link between the company and their customers however, I couldn't come up with a better solution.

Can you?

  • One problem I had a few years ago. The licence was brought with an email. But the company change name and after a year stop all email on the previous domain (yes no comment). Then we need to contact support of a company, our email was never updated in their system. Hopefully we finally got human to talk to and with the original papers it was solved. Since then I always have some apprehension on systems were the only way is to send you an email on stored email.
    – ColdCat
    Dec 20, 2013 at 23:33

4 Answers 4


I don't think the system you describe is adequately secure, and I'm a little surprised it hasn't caused more problems than it's solved.

Some companies, after you request the the key and input your email, respond with a message like:

Your key has emailed to address emailaddress.com. If you do not receive within 10 minutes please check your spam folder. Please add thiscompany-email.com to your address book so future emails will not be routed to the spam folder.

  • I see where you're coming from and I have seen this message as well, but my fear is that many users won't actually read it: first, on the web, the majority of users scans text rather than reading it, and entire blocks of unexpected text might end up ignored. Second, in the user's mind, the next step in the process of retrieving the key would be to check their mail, so they likely won't stay on the web page to see what comes next there.
    – Jan
    Jan 3, 2014 at 12:57

Since you say that the key is used for licensing, can we assume that the user's data or identity won't be compromised if the key is stolen -- the only drawback will be that an intruder gets free use of the service?

The key could be shown on the screen, and then in addition an email could be sent informing the user that someone recently requested to see their key. That way there is a decent, though not certain, chance that the user will catch the unwelcome intruder. The website will still lose some money from those who slip by.

  • Except that e-mail about an intruder would also end up in the spam folder... Dec 21, 2013 at 9:07
  • Yes, just the license key gets displayed, which would essentially give an attacker a free license of the software - no other user data (apart from the e-mail address the attacker has entered) is involved. I like your idea of informing the user about this, but I doubt they will be very interested to follow up, as they lose nothing.
    – Jan
    Dec 26, 2013 at 23:15

You could go for an optional security question post-purchase.

"Thanks for purchasing. Here's your license code: XXX-XXX-XXX. In order to protect your license from unwanted access you can setup a security question".

Zip code should do the trick, the email + zip code combo is harder to guess than just email.

If you already have the zipcode in the system you could just say: "If you want, we'll use the zipcode to secure your account, just check this box right here."

Also, if you really love the business: emails shouldn't go to spam. The issue seems to be deliverability. Use senderscore (.org) - check the IP, see if there are any problems with it. There are multiple solutions if you decide to dive into the problem, will gladly point you into the right direction if you're interested.

  • 1
    I like the idea of adding an additional piece of information. I wouldn't go for the ZIP though, as the format varies between countries (e.g. US vs. UK ZIPs, so it's hard to normalize) and the user's ZIP can change over time. A better option could be the date of birth or some other piece of information that is constant and tied to the buyer's person. I'd also make it mandatory to enter it, since we're protecting the business interest. I would, however, make it clear to the user that the date of birth is necessary to retrieve the key later, so that they understand they shouldn't enter fake data.
    – Jan
    Dec 31, 2013 at 1:28

We can see that e-mail address is the only meaning of customer authentication which seller has. This is a kind of user login. For ordinary secure authentication additionaly we need password as a minimum. But customer can forgot his password as well as he lost his product key. Password recovering procedure requires some activities from a customer which will cause unsatisfaction of his seller. Unsatisfied customer potentially causes negative opinion about seller which results in reduce of sales. There are no any risk to customer - he doesn't provide to seller any additional sencitive information, he doesn't spend additional money, but he solves his problem in a minute. Customer is fully satisfied. Seller has risk that he looses money for license. Possible this financial risk is not valuable for seller because he has satisfied customer and one more copy of software installed as promotion - may be they will have even more customers.

So we can see that in any case one should make decision on security system implementation taking in mind not only possible leaks but much more criterias - UX also.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.