On our site, we provide to users a simulation based on their private information (given through a form). We would like to allow them to get back on their simulation results later, but without forcing them to create a login/password account.
We have thought of sending them an email with a link, from which they could get back their results. But, naturally, we have to secure this URL, because private data is at stake.
So we're intending to pass a token (like a 40 characters combination of letters and digit, or a MD5 Hash) in the URL and to use SSL.
Finally, they would receive an email like that:
Get back your results on
What do you think about it? Is it secure enough? What would you advise me for the token generation? What about passing URL parameters in a https request?