Dating sites is an interesting example because OK Cupid does exactly this. They send occasional emails with a "Login Instantly" button which contain an authenti

Dating sites is an interesting example because OK Cupid does exactly this. They send occasional emails with a "Login Instantly" button which contain an authentication token. In general, if someone can read your email, they can steal almost any of your accounts. Are email accounts generally that insecure? I trust any major Webmail provider to not steal my bank account, but is trust the only thing really keeping our bank accounts secure? If we really are that insecure, then people are probably going to attack your bank account long before they attack your random web-app account. If your site isn't guarding valuables, it's probably perfectly "safe" to send authentication tokens in mail messages. No?