The Question
I was reading a forum last night discussing the idea of emailing a user a login link, much like a password reset link, so they don't require a password. Their email address is already verified on sign up using a similar such link and I see them as being fairly similar in principle to a reset password link.
The Process
The user would visit the site, enter their username and be emailed a login link valid for 5 minutes. They click the link in the email and they are logged in.
Drawbacks
- My initial concern was if an attacker had access to their email, but, they could simply use the password reset process on most sites to access the account in this situation.
- The inconvenience to the user of having to login to their email to retrieve the link.
- Email is not necessarily a secure medium to exchange the login link.
Advantages
- As the host you don't need to store the user's password and worry about a breach disclosing it.
- SSO presents a single high value target for an attacker and requires implementation on your site. Does this method draw a parallel but without the dependence on the SSO service?
- The user doesn't have to remember another password which would likely be a duplicate of a password elsewhere or very weak.
Thoughts
The login token would have to be both strong and random to prevent brute force attempts on it and could also contain some form of user ID to reduce the scope of an attack. Are there any other major advantages or disadvantages you could point out in the above from a security standpoint?