仅使用电子邮件作为身份验证
作为一种穷人的 OpenID，仅使用电子邮件地址（无用户名、无密码）进行身份验证怎么样？
注册过程只需要用户的电子邮件，并向其发送一个带有随机随机数的链接用于登录，就像许多服务通常用于密码恢复/电子邮件验证一样。验证随机数后，服务将照常在浏览器中设置一个（永久）cookie 并将其用作标识。如果用户希望使用另一台机器/浏览器，则必须发送另一条消息。
我从来没有见过一个网站做这样的事情。您对这个方案有何看法？是否有任何我没有看到的明显的安全漏洞（考虑到通常的事情，例如保护 cookie 仅限 https，已正确完成）？如今，通过垃圾邮件过滤器获取此类电子邮件是否困难？您认为用户会很难习惯吗？您发现任何可用性问题吗？
What about using only email addresses (no usernames, no passwords) for authentication as a kind of poor man's OpenID?
The sign up process would require only the user's email and would send it a link with random nonce for logging in, just like many services usually do for password recovery/email verification. After verifying the nonce, the service would set a (permanent) cookie in the browser as usual and use that as identification. In case the user wishes to use another machine/browser, another message has to be sent.
I've never seen a site doing something like that. What do you think about this scheme? Are there any obvious security holes I'm not seeing (considering the usual stuff, like protecting the cookies to be https-only, gets done properly)? Is it difficult to get this kind of email through the spam filters nowadays? Do you think it would be hard for users to get used to that? Do you see any usability issues?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这会是不安全的。电子邮件默认以明文形式发送，您不能保证它们会被加密发送（用户的邮件服务器可能不支持 TLS）。此外，还存在一些边缘情况：电子邮件收件箱可能被多个人访问；电子邮件地址将来可能会由不同的人或多人拥有，尤其是工作电子邮件地址。是的，有时您希望帐户由您的电子邮件地址的继承人继承，但有时您不这样做。
然而，具有“重置密码”功能并且除了您能够阅读电子邮件和使用该功能之外不需要任何其他身份验证的网站同样不安全！它们只是看起来更安全。
This would be insecure. Emails are sent in plaintext by default, and you can't guarantee that they will be sent encrypted (the user's mailserver might not support TLS). Moreover, there are some edge cases: an email inbox might be accessible by more than one person; an email address might become owned by a different person or people in the future, especially in the case of work email addresses. Yes, sometimes you want accounts to be inherited by the inheritor of your email address, but sometimes you don't.
However, sites that have a "reset your password" feature and don't require any other authentication other than your ability to read an email, to use that feature, are just as insecure! They only look more secure.