When I implemented this, I made the following choices: 1 hour login email expire time by default, tunable. I'd make it shorter, but it has to get around greyli

When I implemented this, I made the following choices: 1 hour login email expire time by default, tunable. I'd make it shorter, but it has to get around greylisting. Sending a login mail and logging in does not affect existing browser sessions. Only allow a login email to be used one time. Only allow the last login email sent to be used, not old ones. This and the expiry keep email archives from becoming a problem. Another thing you could do is set a cookie and have the login link check for the cookie. That makes the link worthless even if the attacker intercepts it. But, it lets the attacker DOS a user and prevent them from logging in by continually requesting new login emails, so you'd probably want to allow previous login emails to be used. Of course, as a user, how do I know which of these security tradeoffs a site has chosen? It's as bad as using a password and hoping they don't store in clear text. It would be better to have a protocol for login that makes clear choices.