Thread: Generating per person URL

Hi

Is it possible that when we send a link to something(say some online task) in mail, then that will work only if it is clicked from same mailbox whom it was sent?

let me elaborate it:
suppose person A hosts google.com/someApp

and now A invites B and expects to do something using EMAIL system. so he compose a mail consisting URL ---> google.com/someApp/B
but B forwards that mail to someone else, say C and via any means.
Now C is doing the actual work, and A sees that B is doing it.

So My requirement is that can we make URL(in mail) working only if it is clicked only, not even typed into address bar??

as far as I can think, I need to find out if the current window ( browser tab's address bar details when the link was clicked.

So here by I invite you; please add something...
feel free to ask as required.

Thanking you in advance

If B would have a unique IP-adress that could not change then you could simply verify whether its actual B or not, but not many workstations have a unique IP adress.
Additionally it could maybe be done with cookies but that isnt too safe since there are ways to break the system. Maybe even with a downloadable program that needs to be running and to verify the computer specs of B, but this has problems of its own.

In the end, even if it was possible to do it safely, it would not be easy, not be cheap and not be comfortable to anybody using it.

Originally Posted by KevinWorkman

This sounds like a horrible idea. It sounds like you're trying to do some security-through-obscurity type of restriction, which never works.

What is your actual end goal that you think this is a solution for?

I'm Glad you asked. my client usually give assignments online and he send access links to specific pupils only ( one which require it ) via emails, last time he caught his students cheating him, like assignment was for A but he convinced B to do it for him. B did that.

I have to avoid this from happening again in future! As link was sent to A then that link must only work iff it is clicked from A's mailbox.

Any Ideas how we can achieve this?? I'm open to Ideas...... we may end up developing something new ...

--- Update ---

If B would have a unique IP-adress that could not change then you could simply verify whether its actual B or not, but not many workstations have a unique IP adress.
Additionally it could maybe be done with cookies but that isnt too safe since there are ways to break the system. Maybe even with a downloadable program that needs to be running and to verify the computer specs of B, but this has problems of its own.

In the end, even if it was possible to do it safely, it would not be easy, not be cheap and not be comfortable to anybody using it.

as far as I know we can access emails from anywhere. like A can open mailbox from B's home, possible right so IP based tracking doesn't seems working here. Sorry to dis-agree.

I liked end of your post. Well when anything is hard to get, fun starts there only.... right!

This is impossible. If you are dealing with students you have no way of making this happen. You can not control their computers, you can not monitor their houses. These little buggers will always find a way to cheat.

I liked end of your post. Well when anything is hard to get, fun starts there only.... right!

It usually means you are doing something wrong. Doing the right thing is easy. Finding out what the right thing actually is is the hard part.

@copeg

It won't stop someone from sharing their credentials (or cheating for that matter)

I agree here, we can't stop them.

by forcing clients to login with private credentials (username/pass).

Yes, this approach is already implemented.

All I'm trying can we make it abstract??
by abstract I mean no need to provide username/password and we are still able to track who did what.

What gets me is that sometimes the effort they go to in order to cheat is greater than if they just did the work themselves

You just reminded my college days.

Originally Posted by KevinWorkman

However, that wouldn't stop somebody from sending out that link and letting people visit it.

that is what happened and I'm trying to uproot this and Yes I'm sending unique links per email.

I will keep trying new ways, and update here if I'm able to do it. meanwhile your comments or suggestion is appreciated.