Shared links are one of the most common ways Box customers share content, making it easy to collaborate on content both internally and with external 3rd party organizations. But that system still depends on the recipient of the link being who their credentials say they are, and bad actors can leverage that to steal sensitive content. To combat this risk, Box has introduced the ability for users to add a one-time passcode (OTP) to their shared links, including an additional layer of identity verification alongside the content.
With OTP for Shared Links, any Box user who can create a shared link can add identity verification directly to it when they generate the shared link, toggling it from within the link settings menu. OTP for Shared Links offers two modes:
- Open verification, where any recipient confirms their email address before accessing,
- Access List only, where access is restricted to a specific set of approved email addresses and domains.
For authenticated Box users, including those on mobile and Box Drive, there's no added friction. They're recognized automatically and access is granted or denied based on their verified identity. The OTP challenge is only presented to anonymous recipients.
OTP for Shared Links is available on Business plans and above at no additional cost. The Shield-based access policy integration, enabling admins auto-enforce OTP via classification rules, will be coming soon to Shield customers. To learn more about shared links at Box, look here.