0

I've seen some websites (Medium, Basecamp 3, etc.) that require only an e-mail to sign up or log in to their app. Basically, you enter an e-mail, the app sends a one-off link to your e-mail, you click that link, and you can sign in.

There are a couple of significant benefits to this approach (that I can think of):

a) Often, when I forget password — especially on mobile — I have to enter my e-mail address, check e-mail, go to the click, type the new password twice, and then log in again. This approach removes the password entirely, so you cannot ever forget your password.

b) You cannot compromise customers' passwords and thus accounts since you don't have them.

What are some disadvantages to this approach?

Improve this question
2
  • Do you always need to click that same link to log back in?
    – DA01
    Nov 12, 2015 at 18:07
  • No, every time you get a new link which is valid for a single time, often for a limited period of time too.
    – swastik
    Nov 13, 2015 at 6:22

1 Answer 1

Reset to default
2

If the email account is compromised, then ALL other accounts that use the above method are also lost since they'll be a list of them in the users mailbox. It's one thing to use a password safe to store all your passwords, it's entirely another to rely on your email provider to safeguard all your accounts. Can you say "John Brennan".

Improve this answer
2
  • Thank you! If an e-mail is compromised and there's a forgot password option, the attacker can get access to the password that way, can't they?
    – swastik
    Nov 14, 2015 at 15:17
  • Correct. That's why there is growing pressure on email providers to take security seriously. Email isn't just about just chatting with friends. It's a key element in managing an identity.
    – GTM
    Nov 14, 2015 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.