I'm making a online game where I need to preserve some things for the players so each will have an account. However, I don't want to get into the business of storing user created passwords since that's dicey these days.
So I was thinking what's the point of even asking for the user to create a password for most apps these days? With the advent phone/email verification why not just have the user enter their e-mail address and then have the server create a temp pw good for 15 mins and then send it to that email address and have the player copy/paste that into the game to login? A phone number could be used as well. This is usually step 2 in a 2-step auth these days anyway so since it's, I'd say, more secure than the user generated pw, why not just make that the only step?
I get the slight inconvenience but I think people are getting over that these days because of security. This seems like it passes the buck to the email provider and their security which will be better than what most people with an app come up with. To prevent someone who knows your email and the app from spamming the system could track last temp pw try and only allow so many in an hour.