I am facing the following dilemma:
I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products.
Currently, the admin panel requires you to enter your username and password. On most days, he forgets his password calls us up and we have to reset his password (Even though there is a reset password option).
This got me thinking, he uses his emails and he uses his Mobile Phone quite a lot. So, if I took the password method away and did the following:
- He enters his email/phone number
- He get's an email with a special code He enters that code and he can
access the admin panel (for up to half a day e.g.)
I am thinking that this would solve a lot of problems, but what are the security implications for this? If we could get away from password, why hasn't this been done by some of the leading providers? I want to go ahead with this authentication, but if it's not secure then there is no point.
P.S. The emails will be sent over a secure network.