5 ms·

As has already been mentioned in the comments on the post earlier today, emailing a direct login link or merely a password reset link actually do have different

As has already been mentioned in the comments on the post earlier today, emailing a direct login link or merely a password reset link actually do have different security implications: when an attacker gains access to the account by resetting your password, you will know about this as soon as you try to login yourself. With a direct login link you won't. Furthermore, when offering direct login links you are training your users to not remember their passwords. A bad side-effect, unless you have only users who will never login except when notified.

skrebbel 15y ago
> Furthermore, when offering direct login links you are training your users to not remember their passwords. Come to think of it, that sounds very convenient. How about a security model that links an account only to an email address? This implies that anyone who can read that email account can log in. For many purposes, this might be fine. You could do without those nasty passwords entirely then. Logging in from a new computer without cookies stored means having yourself a new "log me in" email sent. Sucks if you have to open your email just for that, but then again, for some services, this might seldomly be a problem because of their email-oriented nature.
- eli 15y ago
  I dunno about that. User's email server is slow and maybe they can't log in for 20 minutes? Aggressive spam filtering effectively locks you out?
- jokull 15y ago
  I've run an application that used Facebook for this purpose (over 95% of my audience were Facebook users). Just login with Facebook and you gain instant access.
- lurker17 15y ago
  This is basically two-factor authentication, without the first factor. Isn't Google Authenticator supposed to have an open API so that any service can give you a secure seed and then let you use your mobile phone to login? https://code.google.com/p/google-authenticator/ https://code.google.com/p/google-authenticator/
- cpeterso 15y ago
  Or login using an SMS challenge/response code.

skrebbel 15y ago

> Furthermore, when offering direct login links you are training your users to not remember their passwords. Come to think of it, that sounds very convenient. How about a security model that links an account only to an email address? This implies that anyone who can read that email account can log in. For many purposes, this might be fine. You could do without those nasty passwords entirely then. Logging in from a new computer without cookies stored means having yourself a new "log me in" email sent. Sucks if you have to open your email just for that, but then again, for some services, this might seldomly be a problem because of their email-oriented nature.

eli 15y ago
I dunno about that. User's email server is slow and maybe they can't log in for 20 minutes? Aggressive spam filtering effectively locks you out?
jokull 15y ago
I've run an application that used Facebook for this purpose (over 95% of my audience were Facebook users). Just login with Facebook and you gain instant access.
lurker17 15y ago
This is basically two-factor authentication, without the first factor. Isn't Google Authenticator supposed to have an open API so that any service can give you a secure seed and then let you use your mobile phone to login? https://code.google.com/p/google-authenticator/ https://code.google.com/p/google-authenticator/
cpeterso 15y ago
Or login using an SMS challenge/response code.