I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this:
- User enters their email address. "If that email belongs to a user, a code will be sent" message to prevent disclosure of valid emails.
- User is emailed an alpha numeric code (lets say 8 digits long and valid for 1 hour).
- User enters that code as their "password".
- No passwords are stored in the database.
- No need for password resets.
- Much of the security burden is shifted to the email provider.
- An email address is required. If you lose access to it you lose access to your account.
- If you forget your email address you lose access to your account.
- It's inconvenient to check your email each time you log in. This would not be an issue on mobile, where an API token can be stored after the first login.
Are there any other issues, especially security related? As far as I can tell, this should be as secure as a password reset. In both situations you're emailed something that allows full access to the account.
Here are similar questions but with more focus on cookies, or without solid answers. I'm more interested in the positives and negatives, especially any security issues.
- How to implement non-password authentication in a web site
- Password-less authentication in web apps - How safe it is?
Clarity/Goals edit: The goals are to limit the amount of sensitive data stored in the database (even if that data is hashed), be accessible to average users (remotely with an internet connection), and not depend on a different device for authentication. Additionally, be as simple (UX) and secure as possible given those constraints.