I am facing the following dilemma:

I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products.

Currently, the admin panel requires you to enter your username and password. On most days, he forgets his password calls us up and we have to reset his password (Even though there is a reset password option).

This got me thinking, he uses his emails and he uses his Mobile Phone quite a lot. So, if I took the password method away and did the following:

  • He enters his email/phone number
  • He get's an email with a special code He enters that code and he can
    access the admin panel (for up to half a day e.g.)

I am thinking that this would solve a lot of problems, but what are the security implications for this? If we could get away from password, why hasn't this been done by some of the leading providers? I want to go ahead with this authentication, but if it's not secure then there is no point.

P.S. The emails will be sent over a secure network.

  • Maybe use something like Auth0? That way your client can use Google/Facebook for logging in – Crecket Apr 18 '16 at 8:22
  • Email is never a secure service, even if over a supposedly secure network - even if you consider your local network secure, there is still the connection on the client's side, and the general internet in the middle. Only exception would be if it never left your own network. – SomeoneSomewhereSupportsMonica Apr 18 '16 at 8:25
  • @SomeoneSomewhere So in essence, what I am proposing is actually a bad idea? – Phorce Apr 18 '16 at 8:31
  • @Phorce Not necessarily, but do not assume that just because your network is secure, emails sent via it are secure. The biggest problem I can see with this scheme is that the chance of the person losing (or having stolen) the cellphone/ laptop are quite high. – SomeoneSomewhereSupportsMonica Apr 18 '16 at 8:40
  • @SomeoneSomewhere No offence to the person, if he loses his phone / laptop then it's kinda their own fault. Also, the code does not last for a long period. Surely I can secure it by logging the IP address that they requested the token? For example, if they request it at their office then they can log in using that token.. If they go home, they have to request a new token? Because there's a different IP.. Make sense? – Phorce Apr 18 '16 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.