I am currently developing a website with a login system. The server will not have HTTPS available and will not handle critical data such as credit card info or addresses, the most critical data transmitted would be email, full name, personal files (Which will be uploaded and be available publicly later) and maybe password.
I have the choice of either creating the typical user/password authentication or to use a different system that will get around the security issue:
download bmml source – Wireframes created with Balsamiq Mockups
The user enters only their name, gets an email sent, clicks a link and logs in. I know for sure that every user will have the same email, the email is over a secure connection.
Is it worth it having the more complicated system but more security or should I just go with user/password?