Logging in with email only

Question

I'm working on a blog and there will be an option to post a comment.

I could implement registration with username, password and email — the standard way. I could implement 3rd-party authorization with Twitter, Facebook or whatever. Instead, my idea is to put together registration and logging-in steps into one and ask for email only!

I imagine like this:

1. The user enter a comment and clicks "Submit",

2. An email is asked and user, hopefully, enters it,

3. New message is sent to the specified email; it contains a link,

4. Link redirects back to the blog,

5. If no display name is set for corresponding email, it's asked,

6. New comment is posted!

I like this system because I thing that it may be an overhead to implement something more complex for my needs. Would this actually work? What do you think?

Answer 1

As a one-off authentication scheme it's okay, but the problem arises when you need to post more than one comment. You'd have to send the confirmation email each and every time. There's no client-side authentication, so there's no way to set up things like an avatar (unless you use Gravatars), display names, edit comments or post new comments without going through yet another email. Since you have nothing to go on but email, each and every authentication must be run via email, and worse, there's little opportunity to set a cookie or validate a user except by these nonce-URL emails.

One-off comments might be what you want, but they're only alright for extremely simple, uncommonly submitted forms. Imagine having to check your email and click a link to post 30 comments in a day on Reddit or something; you'd quickly be begging for a good old fashioned password & cookie based authentication.

Answer 2

Although I applaud your lateral thinking, there are some possible issues to consider.

The first is that if you have any delay with your mail sending, many posts simply won't go through. Also, if someone is browsing your site without access to their email (yes there are still people without webmail), they will not be able to post.

Besides those considerations, I think it is a great approach to a problem that verifies posts in a very simple way. It should be fairly easy to test how effective this is by checking how many of the links aren't followed. That will give you a solid indication of whether people have a problem with it or not.

Go for it, and remember to come back and let us know how it has worked out for you.

Answer 3

Probably for simple and once in a while interactions it could work but it could lead to some problems, here are some that come to my mind:

• What happens if he users forget to check their email to confirm the post?
• What happens if your email finishes in the spam folder?
• What about more advanced, but useful, features like editing or deleting a comment?

Just to give you an idea of the problems, Craigslist uses a similar approach to allow users to post using only their email address. Look at all the red warnings, the most important conclusion, I think, is that the users are not familiar at all with this type of authentication:

---

On the other hand, there are several companies working full time on commenting solutions, two of the most renowned are Disqus and Livefyre.

Answer 4

This might be a reasonable idea for someone just passing through who wants to comment without needing to create an account, but you'll have to make sure you're really careful and monitor the server / site closely.

If you go down the route of e-mail authentication every time and your domain gets black listed, people won't be able to comment as the authentication e-mails just wont get to them.

It's the feature which is nice and secure in theory, but has a lot which can go wrong and make for a terrible experience for people.