I want to implement a log in system:
- User simply provides his / her email to sign up / sign in.
- A random password is generated and sent to his / her email, with a valid period of, say, 30 minutes. Hash is stored in database that will be deleted 30 minutes later.
- He / she enters the password within 30 minutes; optionally, he or she can choose to be remembered for x days.
- He or she is logged in if the password is correct.
- The password is invalidated and hash deleted.
After googling, I found this: http://en.wikipedia.org/wiki/One-time_password
It seems all right, but no points concerning usability. My main concern is whether or not it would be annoying to the end users, because every time he or she needs to log in, he or she has to check their email inbox for the password. I'm not quite a mobile user but would this be painful on mobile devices?
What's your opinion on this? Any potential problems of this approach? Would it be annoying?