Consider the following common security scenario:
- I need to log in with an email and password.
- I can't remember my password so I click "forgot password"
- Website emails me a password reset link.
- I can gain access to my account using only my email.
This is common on many websites. Commonly it is suggested to not use the same password on every website, but this has the obvious issue of making it hard to remember passwords. Now, consider a parallel scenario whose security I believe to be equivalent:
- I need to log in with an email
- Website emails me one-time password (randomly generated string with sufficient entropy)
- OTP is valid for short amount of time (< 5 minutes)
- I can gain access to my account using only my email.
This scenario has two major advantages. One, there is no longer a need to remember a password for the website. Two, the website is no longer storing password-related info (of course hashing and salting is recommended but we all know that some websites will not do this.
Why use passwords at all?
