1

I am currently developing a website with a login system. The server will not have HTTPS available and will not handle critical data such as credit card info or addresses, the most critical data transmitted would be email, full name, personal files (Which will be uploaded and be available publicly later) and maybe password.

I have the choice of either creating the typical user/password authentication or to use a different system that will get around the security issue:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

The user enters only their name, gets an email sent, clicks a link and logs in. I know for sure that every user will have the same email, the email is over a secure connection.

Is it worth it having the more complicated system but more security or should I just go with user/password?

Improve this question
3
  • 1
    I voted to close this as it stands because it's very subjective to your site. If you can edit this to be a more general question that appeals to the masses, I'll retract my vote.
    – Code Maverick
    Apr 9, 2014 at 2:17
  • I also think it's easy to make some changes to make the question fit this site, focus on the user perspective of the situation, consider, on the question, what is the gain and the reason for the user to do one or the other.
    – PatomaS
    Apr 9, 2014 at 3:01
  • 1
    You should note that your system is completely insecure without SSL; just because the "login link" is sent over secure email, access to that link still happens in the clear - an attacker observing access could very easily hijack any user session. Because of this, there is little security to be gained (and good UX to be lost) by implementing this plan.
    – Joshua Barron
    Apr 9, 2014 at 13:55

2 Answers 2

Reset to default
2

Irrespective of the securtiy requirements of the system I personally feel that instead of falling into the cycle of entering the username > awaiting email > clicking on url to access the website a simple username password would suffice. In today's era somehow the end users want simple and quick responsive systems. So making them wait for an email to get the login link would turn me away for sure. If its a one time thing like you login once in a month or so then probably it could be considered but on a frequest basis I dont think that would be a great experience.

Improve this answer
0

If you want to go with a low-friction login system like this, why not implement login with a third party service like Mozilla Persona which requires only that the user input their email?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.