Would a user authentication flow like this be a bad UX?
- User enters email address and clicks
- User checks his email inbox and clicks on the link
- User is logged in
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.Sign up to join this community
Aside from the security issues, usability will be poor. Users do not like checking email to log into websites, as demonstrated by low two-factor authentication adoption rates.
While I have not rigorously collected data, there is a clear trend. Two factor is not good UX. The reason for its use is security. When there is no security benefit, two-factor becomes a pointless hurdle.
The described "authentication" protocal is susceptible to man in the middle attacks. If you don't immediately understand why, you should not be trying to design your own authentication protocol. Any homebrew algorithm or protocol, even by those who understand what they're doing, is likely to be insecure. Even experts carefully vet their work via extensive testing and peer review.
Emails are passed from server to server in plain text. Even if the protocols have been updated to use encrypted links, emails are still inherently plain text. Anyone with access to the email, such as the email service provider and every server that the email passes through, can access the account. That is why you shouldn't send passwords by email.
What about two factor authentication? These require logging into the account with the appropriate credentials (login/password) before a verification code is sent by phone or email. Then the verification code is typed into the already logged in account. In some cases, the password is required again, along with the verification code.
What about password resets? These usually require some non-password identity verification. Lists of personal questions that only the original account holder is supposed to know the answer to. In practice, these aren't very secure because information, such as mother maiden name, are often public record. However, they are better than the design in the question, which requires only the email address, which every spam bot has access to.
What about logging in via a third-party account, like Google or Facebook? I haven't looked into the protocols, but at the very least, you are opening up your account to access by the third party. For something like PayPal or Banking, I'd recommend against third-party login. For something like social media, it may not matter as long as you don't further connect them to anything critical.
What about cookies and persistent logins? As long as the protocols are appropriately secure, cookies should be resistant to man-in-the-middle attacks. However, if someone is able to copy the cookies, accounts would be compromised. That is why banking sites tend to have annoyingly short timeouts.
This answer has nothing to do with UX. You're free to do whatever you want. But what good is an authentication protocol that doesn't authenticate? What good is a self-flying plane that flies itself into the ground? Sometimes, UX extends beyond the immediate task. For instance, I'd rather put up with annoying banking interfaces than have my accounts stolen and drained.
Yeah I knew all that. I'm not here to argue about the security trade-offs.
It's concerning that you would intentionally design an insecure system.
Yes, this will be bad UX. One option might be to use authentication via Google or similar account.