There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of benefits, such as not having to remember any arcane passwords and potentially increasing the security of the site, so in general I like the idea.
I can think of one issue, the unfamiliarity of the interface, but what other obstacles could a password-less login system pose to users?
The potential issue that comes immediately to mind is delay.
Yes, as Evil Closet Monkey says in the comment here, and many others have said across many questions, forgetting a password is very common, and thus people are familiar with password reset functionality.
But if I have to do that every time I login, I have to wait for the email to arrive before I can sign in to the site, and email can get delayed. I am being punished if I do remember my password, or my browser does, or if I use a password manager, and that is a poor user experience.
I'd say it depends on your application. If you can assume that the user isn't coming to your site often enough to remember their password, this is probably a good idea. So for a website that manages my life insurance, I might log in once a year to check to make sure it's still working. I'm going to forget that password anyway, so doing a secure link to login seems great.
On the other hand, if you wanted me to use this login strategy for my email, (assume a different email than you send the link to), I'd probably go on a rampage after a day or so.
There is an update to the blog post now with suggestions.
I use a hotmail account for all my random logins that I don't log into very often - so I would have to switch to another tab, login to my email, wait for the email - it can be 10-30s, switch tabs back to login to their website.
Users with password managers, who can normally login with one click would have to go through the same route of logging into their email and getting the link. One suggestion in the post update was:
simply reverse the order of the password reset tool and the password field on the form.
So then password manager users aren't impacted and other users can see the reset link a bit easier.
One very good use case for this which is the initial login which is critical for many sites.
To sign up, you only enter your email and get logged in directly. Similar to signing up for a newsletter. Then a password reset email is sent to you. You might start with slightly restricted permissions but it does give you a chance to see if you like the site.
Also you can do it that you sign up with email and password and are directly logged in, which avoids the step of having to reset your password separately. Then you just have to confirm your email address. Buffer do this quite nicely.
Assuming that people will reset their password is a good thing. So putting time into improving that process is worthwhile.
The obvious is Oauth, but I think putting more reliance on Facebook and Google to handle our logins is bad for the web. Certainly where privacy is concerned as then Facebook and Google know all the sites that you have accounts for. I certainly regard caring about user privacy as UX.
One of the mentions in the blog update is Mozilla's Personas - which they gave up on. There's acutally a very good open letter arguing that Mozilla can help the web better by bringing back Personas instead of pushing Firefox OS, with this rather nice quote:
Put all your eggs in one basket and stick the basket in Fort Knox.
Personally, I think getting users to use password managers is the best way. LastPass is the main one, there's also more recenctly 1Password and I personally use Keepass + KeepassHTTP browser plugin.
Users who activate the login link from a mobile mail app may find themselves trapped within a webview. It poses a design challenge to figure out how to allow users to break out into their proper browser, while remaining logged in.
If password-less login is the only option you offer users, you may have to figure out a solution to this.
I have posed this as a challenge looking for answers here: Password-less log in with webviews.
It's interesting thinking - but users forgetting which email address they used is a big part of the login problem in the first place. As a user of password managers, I agree I would feel penalised with the reset every time approach.
The other issue is that emails get lost/spammed filtered and low-tech users have enough trouble with email as it is - including logging into that half the time as well!
Also - email is on the way out for non-business users - millennials at least!
Logging in with Facebook for everything is probably the easiest and most universal strategy LOL!
