A few websites (such as medium.com) offer a password-free login user experience: when you want to login, 1. you just enter your email, then 2. a login token link is sent via email, then 3. you click on the link, and you're logged. Password never required.
How secure is this login scheme?
Traditional scheme (login+password): is it possible to log on
example.com
?A Password ok + email access ok => [login OK] B Password ok + email access lost (e.g. mail account hacked) => [login OK] + tip: quickly change email in "Settings" C Password lost + email access ok => "Forgot my password" system => [login OK] D Password lost + email access lost => [login not OK]
No-password scheme: is it possible to log on
example.com
?E email acccess ok => [login OK] F email acccess lost (e.g. mail account hacked) => [login not OK]
It seems that the "no-password scheme" is more vulnerable to loosing one's email account.
Is this really a weakness? (or maybe there's a solution I haven't seen?)
Is there a way to make "no-password" login scheme better?
PS: Not a dupe of this question but it doesn't address the question of what happens when email account is lost, etc.