7

A few websites (such as medium.com) offer a password-free login user experience: when you want to login, 1. you just enter your email, then 2. a login token link is sent via email, then 3. you click on the link, and you're logged. Password never required.

How secure is this login scheme?

  1. Traditional scheme (login+password): is it possible to log on example.com?

    A Password ok + email access ok => [login OK]
    B Password ok + email access lost (e.g. mail account hacked) => [login OK] 
                                                 + tip: quickly change email in "Settings"
    C Password lost + email access ok => "Forgot my password" system => [login OK]
    D Password lost + email access lost => [login not OK]
    
  2. No-password scheme: is it possible to log on example.com?

    E email acccess ok => [login OK]
    F email acccess lost (e.g. mail account hacked) => [login not OK]
    

It seems that the "no-password scheme" is more vulnerable to loosing one's email account.

Is this really a weakness? (or maybe there's a solution I haven't seen?)

Is there a way to make "no-password" login scheme better?

PS: Not a dupe of this question but it doesn't address the question of what happens when email account is lost, etc.

  • 3
  • @SmokeDispenser See edited question, not really a duplicate. PS: the wording of this question is not very clear: is it for authentification ("chose some options and post their selection"), etc. – Basj Nov 14 '17 at 9:42
  • 1
    IMO not a duplicate since the other question is primarily concerned with something akin to a single-use token, rather than a long-lived session. – Xiong Chiamiov Nov 14 '17 at 17:37
4

The protection mechanism in using a password when talking username+password is to provide authentication. Whether it is sufficient is dependent on the threat model.

When using a "no-password scheme" as you describe, you move the initial authentication to the mail account, with which the account was created. Sending a link to the mail account provides possible attack vectors, but if we ignore these and focus solely on the mechanism of using a link with a session token, it can be a valid way to provide authentication. In principle you are using the mail account for federation of identity, which is to say that you as a user put trust in your mail provider and your own awareness on mail usage when using a "no-password scheme".

You pose the question whether the "no-password scheme" is more vulnerable to hijack of the mail account. As the mail account is your sole mean of providing identity and authentication, it is more vulnerable to account hijack through your mail provider than a scheme where you can provide a username+password. However the username+password is not a vulnerable point in the model for the website account.

Your question to whether it is a weakness, is dependent on whether the user supplies a secure means of mail account usage. The focus of the login is removed from the website and the user puts trust in the mail provider and the session establishment via a link with a session token sent in (dependent on threat model and possibilities) an encrypted or secured mail.

Making a scheme like the "no-password scheme" better could be to introduce a two-factor component. If you consider that your link with a session token is one factor, you could introduce an out-of-band validation mechanism, such as Google Authenticator, FIDO U2F, or a similar concept such as printed keys from the website. This could strengthen the security, but would not make the experience more seamless.

  • 1
    don't most passwords allow reset from an email address? that says to me that passwords have the same vuln, plus guessing... – dandavis Nov 14 '17 at 16:12
  • Yes most password reset schemes are set such that you can recover access through an email address. But security questions are also widely used and allow a password reset. I am not in favour of these, but they do exist. Password guessing is in the username+password scenario valid, given that your username is not also a secret. However username+password has this weakness by design, temporary blocking can make high speed guessing very difficult (If you want a mitigation option). – RLFP Nov 15 '17 at 6:43
2

Most websites that use a standard username+password combo allow resetting the password via an email link*, so practically speaking protecting a user's email account is vital to their security across the web.

Medium's scheme is very similar to using Google (or another email provider) in an OAuth scheme - you shove the responsibility for protecting the account off onto the other party. This introduces a single point of failure, but also lets the user rely on Google (or whoever) instead of a multitude of small businesses, who don't have the same technical expertise or active security monitoring resources.

One twist from the email-based systems I've seen is that they tend to use either permanent or long-lived sessions. A website that uses OAuth can log you out every 30 days, and it's easy to log back in (you just click the button, since you're probably already authed with your provider), but navigating to email and finding the right message and clicking it is enough of a barrier, especially on mobile, that they don't seem to automatically log out users semi-frequently. This in turn makes it much easier for someone who once gained access to retain that access.


* Resetting the password gives the user notice of the attack, though, the next time they try to log in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.