Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows me to enter a new password and logs me in.

Happy days.

This got me thinking; how about we skip the whole password thing and just send a single use link in an email that I click which logs me into a month long session.

So, tell me. Why wouldn't this work?

  • 3
    Same question was already asked on security: If I include a Forgot Password service, then what's the point of using a password? – CodesInChaos Feb 10 '14 at 16:40
  • 2
    IMO your idea is like OpenID, except much more annoying to use. – CodesInChaos Feb 10 '14 at 16:41
  • Thanks @CodesInChaos, I have tried to find other mentions of this approach, that will be interesting reading! – Kevin Pluck Feb 10 '14 at 16:43
  • 1
    Instead of e-mails, they also have other systems that send auth request to a smart phone. As soon as you try to login, your phone wakes up with a login request detailing where it is coming from and whether or not you want to allow or deny. We use: duosecurity.com – DXM Feb 10 '14 at 16:53
  • Is there a problem with keeping a session open for a month? – JeffO Feb 10 '14 at 17:14

This is a reasonable idea. Almost all passwords can be reset through email, and lots of users of many websites do this frequently, often every time or almost every time they log in (if it's a site that isn't used very frequently). If an attacker has control of your email the only advantages of using passwords rather than this method are:

  • It might take a little bit longer to reset passwords than to get hold of login tokens.
  • Security through obscurity - it might be less obvious which sites to get password resets from. You might not have any old password reset emails but you probably will have several old login tokens.

For anything that isn't important enough to need two-factor authentication at password reset, this is probably a good idea. It also adds some security, compared to resetting your password each time you use the site - it eliminates password guessing or bruteforcing and the problem of choosing string passwords.

One problem is probably although there are many forums, etc. that we log in to very infrequently, many of these websites believe or hope that we are going to use them all the time - no website wants to think they are the one we don't use much.


It seems like some respondents have conceived this differently to how I have. I think the OP means that the link in the email would work only once, taking you to a page where you are considered to be logged in, and your browser can save cookies to that effect which last for one month. Therefore the old login emails saved in your client are not any use to an attacker - just as they can't use old password reset emails to re-reset your password. If you login on a different device, you have to re-request a login email, which then lets that browser instance be logged in.

  • Your edit is correct, can even put a time limit on the single use link – Kevin Pluck Feb 10 '14 at 16:52
  • Why not just keep everyone's session open forever for all their devices? – JeffO Feb 10 '14 at 16:54
  • @JeffO Entirely possible. Until you use another device - shit, what was my password again? – Kevin Pluck Feb 10 '14 at 19:38
  • I was going to mark a post as an answer that gave a solid reason as to why this idea wouldn't work. But some of the answers were opinions about it being annoying, others made good technical points I hadn't considered. Those with grey listing would be used to the nature of their email system and I've been doing this stuff for years and never heard of it! Yes, I could do the social media login thing but I only want my users to be as identifiable as they want to be. So I shall try this, I think that it would be refreshing to someone to not have a pw and link another site to their social network. – Kevin Pluck Feb 10 '14 at 22:03
  • Apologies if you got notified of my half written comment, I accidently pressed enter before I had finished and then I didn't realise it only gives 5 minutes to edit so had to delete it and post it! NGAAAAH – Kevin Pluck Feb 10 '14 at 22:06

It would work. But it would be pretty aggravating to anyone who has graylisting set up on their mail server, which would delay your email for 15+ minutes. And certainly you wouldnt want to be sending an unencrypted login link for a site that has any e-commerce purpose or stores personal information.

A better approach for you may be to use Social Login, and allow people to register and log in with their Facebook, Google, Yahoo, or other social network accounts. I would never require the use of that, but as an option it removes the issues relating to forgotten user id's and passwords.

  • Thanks, I'd not heard of greylisting. Is that only from new/unrecognised addresses? – Kevin Pluck Feb 10 '14 at 16:31
  • Oh and to answer your question about traditional login with non-expiring session; you'd still need to remember a password when using a different device. – Kevin Pluck Feb 10 '14 at 16:33
  • Yes, its generally any address that hasn't already sent you an email in X days. If you are only visiting a site every couple months, that will be affected unless the recipient whitelists the specific address. – GrandmasterB Feb 10 '14 at 16:35
  • not that anyone reads instructions but having a message to add the email to the whitelist should suffice. I'd guess if your system has greylisting you'd know that your system has grey listing especially if you regularly sign up for websites and need to receive emails for address confirmation links; which this email pretty much is. – Kevin Pluck Feb 10 '14 at 19:44
  • The process itself will work, but if you put hurdles like whitelisting in place, its just going to discourage people from signing up. And you still havent addressed the security issue relating to sending a login link in plain text. – GrandmasterB Feb 10 '14 at 19:57

I guess a downside to that approach would be that the enduser would have to login to their email account every time they want to access your application. Setting a month long session variable could also be a moot point if the user is on a public computer, or on a shared computer where two or more users of your application would be accessing the site. It could require the enduser to have to check their email frequently if multiple accounts are accessing the app on the same machine. I always feel like emails are a good idea for login credentials for two reason.

1) You can require the email to be unique to cut down on duplicate aliases, and the enduser will typically remember their email address a lot easier than a userID they created solely for your application.

2) It forces the enduser to input a valid email address as opposed to junk to access their account. If they use a disposable email address to verify their account, they will no longer have access to it if they need to make any changes to their account in the future, so they will be reluctant to put a junk address in if the application is worthwhile.

Downsides are obvious. It's annoying to have to input your email address (especially if it is on the longer side) for verification, but I've always felt that if the enduser will have an easier time recalling an email address for a login parameter as opposed to a userID established specifically for one application/site. Hope this helps. Just my two cents!

  • 1
    The requirement to log out (on a shared computer etc.) isn't any different then if you have logged in with a password. – jwg Feb 10 '14 at 16:40
  • @jwg was what I was thinking too. – Kevin Pluck Feb 10 '14 at 16:54
  • Yes, but then the enduser is required to jump through another hoop of going to the application site, requesting a password email link, logging into their email account, waiting for the email, then following the link every time they wish to visit the site. It's an unnecessary hassle. – Jack Feb 10 '14 at 18:48
  • @Jack which is pretty much what I do anyway as I'd forgotten your bloody site's password again. – Kevin Pluck Feb 10 '14 at 19:47

First, your email isn't secure. Once a thief knows a certain website is sending out access links, they'll start paying closer attention.

Regardless of the format, this is no different than saving the username and password unprotected on the server. Whether it's a username & password combination or some lengthy and complex link string sent to your email address, it's not a good idea to store any of this on the server side in plain text (i.e. not salting & hashing).

Don't you feel more confident when the provider doesn't even have access to your password or whatever type of access link?

Edit: I guess the real question is why not keep sessions for a month.

  • Are you aware that passwords can often be reset using a link sent in plaintext email? – jwg Feb 10 '14 at 16:38
  • My thoughts exactly. If you've lost control of your email account you've lost control of ALL sites that will send you a password reset link. – Kevin Pluck Feb 10 '14 at 16:39
  • @jwg - yes, but if that is some sort of timed-out temporary invitation to reset your password, that's not so bad. I would initiate it on an ad hoc basis, so the odds of it getting sniffed are a lot less. – JeffO Feb 10 '14 at 16:41
  • I assumed that the email suggested by the OP would also be a temporary invitation to become logged in without a password - see the edit to my answer. – jwg Feb 10 '14 at 16:42
  • @jwg - not sure I understand your question about once a month. Do you feel accounts are getting broken into because someone is: requesting password resets, intercepting those messages, going to the site, resetting the password and accessing it without you knowing? They still have to know which email addresses are linked to accounts. – JeffO Feb 10 '14 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.