I've implemented a Forgot Password service in the following way:
- User goes to login page, clicks on "Forgot password?"
- User is presented with a form that asks for their email address.
- Email is sent to given address if in the database, with a link that contains a (supposedly) unique, long, randomly generated string, which is also stored in the database along with the time requested, allowing for a time limit to be set on the link (which it is)
- User clicks on link, it is validated, they are then asked to provide a new password.
That's fairly standard, (though I could change small aspects of it), but it made me wonder - since good passwords are so infrequently provided/remembered, why not dispense with the password altogether and use the Forgot Password system instead?
- User goes to login page, fills out email address (or maybe a username to be more secure?)
- Email is sent with link. Link has very short time limit (< 5 mins) validity.
- User clicks link, they're in.
In both scenarios, the user's email security - whether sniffed or broken in to - is the common threat, but in the second scenario:
- The link is valid for a much shorter time.
- It is also likely to be used up more quickly (any sort of validation email can be left alone, but if you definitely want to log in now you're going to use up that link when you get it).
- The user doesn't get to provide a shoddy password.
- The user only has to remember one password.
- A single account can't be shared among several people (unless they share an email address).
- An automated attack needs to break in to the email system and wait for an email, which is likely to be longer than the wait for a password to be unhashed i.e. better than bcrypt.
I'm just wondering what are the downsides? I can see:
- User irritation, perhaps at having to wait for an email or log in to their email too
- It would likely open a new browser window, which can be irritating if you want to organise tabs
- A user might realise they have to protect their email account with a better password, change it, and then lock themselves out :-)
It's just a thought.
Thanks to everyone who put forth an answer, there are some really interesting (and definitely valid) points made that have really made me think and given me more areas to investigate. D.W. gets the tick because of the link provided that gives further insight into this particular type of situation, but I really appreciate all the answers given.