0

I've seen some websites (Medium, Basecamp 3, etc.) that require only an e-mail to sign up or log in to their app. Basically, you enter an e-mail, the app sends a one-off link to your e-mail, you click that link, and you can sign in.

There are a couple of significant benefits to this approach (that I can think of):

a) Often, when I forget password — especially on mobile — I have to enter my e-mail address, check e-mail, go to the click, type the new password twice, and then log in again. This approach removes the password entirely, so you cannot ever forget your password.

b) You cannot compromise customers' passwords and thus accounts since you don't have them.

What are some disadvantages to this approach?

  • Do you always need to click that same link to log back in? – DA01 Nov 12 '15 at 18:07
  • No, every time you get a new link which is valid for a single time, often for a limited period of time too. – usernames Nov 13 '15 at 6:22
2

If the email account is compromised, then ALL other accounts that use the above method are also lost since they'll be a list of them in the users mailbox. It's one thing to use a password safe to store all your passwords, it's entirely another to rely on your email provider to safeguard all your accounts. Can you say "John Brennan".

  • Thank you! If an e-mail is compromised and there's a forgot password option, the attacker can get access to the password that way, can't they? – usernames Nov 14 '15 at 15:17
  • Correct. That's why there is growing pressure on email providers to take security seriously. Email isn't just about just chatting with friends. It's a key element in managing an identity. – GTM Nov 14 '15 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.