How secure is the "no-password" login scheme?

Question

A few websites (such as medium.com) offer a password-free login user experience: when you want to login, 1. you just enter your email, then 2. a login token link is sent via email, then 3. you click on the link, and you're logged. Password never required.

How secure is this login scheme?

1. Traditional scheme (login+password): is it possible to log on example.com?

   A Password ok + email access ok => [login OK]
   B Password ok + email access lost (e.g. mail account hacked) => [login OK] 
                                                + tip: quickly change email in "Settings"
   C Password lost + email access ok => "Forgot my password" system => [login OK]
   D Password lost + email access lost => [login not OK]
   

2. No-password scheme: is it possible to log on example.com?

   E email acccess ok => [login OK]
   F email acccess lost (e.g. mail account hacked) => [login not OK]
   

It seems that the "no-password scheme" is more vulnerable to loosing one's email account.

Is this really a weakness? (or maybe there's a solution I haven't seen?)

Is there a way to make "no-password" login scheme better?

PS: Not a dupe of this question but it doesn't address the question of what happens when email account is lost, etc.

Answer 1

The protection mechanism in using a password when talking username+password is to provide authentication. Whether it is sufficient is dependent on the threat model.

When using a "no-password scheme" as you describe, you move the initial authentication to the mail account, with which the account was created. Sending a link to the mail account provides possible attack vectors, but if we ignore these and focus solely on the mechanism of using a link with a session token, it can be a valid way to provide authentication. In principle you are using the mail account for federation of identity, which is to say that you as a user put trust in your mail provider and your own awareness on mail usage when using a "no-password scheme".

You pose the question whether the "no-password scheme" is more vulnerable to hijack of the mail account. As the mail account is your sole mean of providing identity and authentication, it is more vulnerable to account hijack through your mail provider than a scheme where you can provide a username+password. However the username+password is not a vulnerable point in the model for the website account.

Your question to whether it is a weakness, is dependent on whether the user supplies a secure means of mail account usage. The focus of the login is removed from the website and the user puts trust in the mail provider and the session establishment via a link with a session token sent in (dependent on threat model and possibilities) an encrypted or secured mail.

Making a scheme like the "no-password scheme" better could be to introduce a two-factor component. If you consider that your link with a session token is one factor, you could introduce an out-of-band validation mechanism, such as Google Authenticator, FIDO U2F, or a similar concept such as printed keys from the website. This could strengthen the security, but would not make the experience more seamless.

Answer 2

Most websites that use a standard username+password combo allow resetting the password via an email link*, so practically speaking protecting a user's email account is vital to their security across the web.

Medium's scheme is very similar to using Google (or another email provider) in an OAuth scheme - you shove the responsibility for protecting the account off onto the other party. This introduces a single point of failure, but also lets the user rely on Google (or whoever) instead of a multitude of small businesses, who don't have the same technical expertise or active security monitoring resources.

One twist from the email-based systems I've seen is that they tend to use either permanent or long-lived sessions. A website that uses OAuth can log you out every 30 days, and it's easy to log back in (you just click the button, since you're probably already authed with your provider), but navigating to email and finding the right message and clicking it is enough of a barrier, especially on mobile, that they don't seem to automatically log out users semi-frequently. This in turn makes it much easier for someone who once gained access to retain that access.

---

* Resetting the password gives the user notice of the attack, though, the next time they try to log in.