# Passwordless signin via email link
**URL:** https://meta.discourse.org/t/passwordless-signin-via-email-link/57569
**Category:** Feature
**Created:** [February 17, 2017, 7:25pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569 "2017-02-17T19:25:29Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [February 17, 2017, 7:25pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/1 "2017-02-17T19:25:29Z")
Continuing the discussion from [Is there a way to make the password requirements more simple?](https://meta.discourse.org/t/is-there-a-way-to-make-the-password-requirements-more-simple/48808/10):
> [@Is there a way to make the password requirements more simple?](https://meta.discourse.org/t/is-there-a-way-to-make-the-password-requirements-more-simple/48808/10):
>
> SSO seems like a good option; I wonder if the ‘Sign in via email’ pattern that slack uses might be useful as well?
>
> - Click ‘send me an email to sign in’
> - I get an email with an expiring (5 minutes?) link in it
> - If I click on that link, it logs me in and takes me to the front page.
Prior art:
- [GitHub - aaemnnosttv/wp-cli-login-command: Log in to WordPress with secure passwordless magic links. · GitHub](https://github.com/aaemnnosttv/wp-cli-login-command)
- [GitHub - ahyield/magic-link: Slack like magic-link for easier mobile login and faster password reset ⚡ · GitHub](https://github.com/ahmgeek/magic-link)
- [IdiotsInside - Berita Judi Hari Ini dan Internasional](http://www.idiotinside.com/2016/11/13/django-slack-magic-link-passwordless-login/)
- [360 million reasons to destroy all passwords](https://medium.freecodecamp.com/360-million-reasons-to-destroy-all-passwords-9a100b2b5001#.n5cscw60f)
- [https://medium.com/findworkco/password-less-login-df0354c3f3ee#.r6cv3y3q6](https://medium.com/findworkco/password-less-login-df0354c3f3ee#.r6cv3y3q6)
* * *
**Update:** Spec here:
> [@Passwordless signin via email link](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/5):
>
> That’s not the actual “forgot password” flow though. It goes: press “forgot password” button on login page press “submit” button get email create new password log in The feature here is essentially about removing the (4) create new password step. In the “Forgot password” modal, next to “Reset password” add “Log in with email” button. When “Log in with email” is used, you get an email with a short-lived link that’ll log you in directly. Optional: Enabling enable email login…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 17, 2017, 7:49pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/3 "2017-02-17T19:49:32Z")
I’ve never understood this request because this already works:
- press “forgot password” button on login page
- press “submit” button
- get email
- log in
I guess the only difference is that you’re not _changing_ the password, but if you really don’t care what your password is and want to log in via email all the time, you can just smush your hands on the keyboard when entering your “new” password every time.
---
### Author:  [@gdpelican](https://meta.discourse.org/u/gdpelican)
#### Post date: [February 20, 2017, 1:33am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/4 "2017-02-20T01:33:50Z")
Yeah it’s pretty much mostly a language change, rather than functionality change. Instead of saying ‘you should go through this probationary process because you made a mistake 👮’, you instead say ‘Hey, do you want a magical :unicorn: link that logs you in pretty much instantly?’, but the process is the same.
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [February 20, 2017, 11:14pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/5 "2017-02-20T23:14:05Z")
> [@codinghorror](#):
>
> I’ve never understood this request because this already works:
>
> press “forgot password” button on login page
> press “submit” button
> get email
> log in
That’s not the actual “forgot password” flow though. It goes:
1. press “forgot password” button on login page
2. press “submit” button
3. get email
4. **create new password**
5. log in
The feature here is essentially about removing the **(4) create new password** step.
- In the “Forgot password” modal, next to “Reset password” add “Log in with email” button.
- When “Log in with email” is used, you get an email with a short-lived link that’ll log you in directly.
- Optional: Enabling `enable email logins` adds a “Log in with email” button alongside the social logins.
* * *
> [@codinghorror](#):
>
> if you really don’t care what your password is and want to log in via email all the time, you can just smush your hands on the keyboard when entering your “new” password every time.
Here’s a scenario I quite often find myself in:
I’m on a new computer. One of the few passwords I can remember is that of my email, which is also protected with 2FA. However, on any site that doesn’t support social logins, I’m using a password manager so I can use long, secure passwords. But I’m not always on a device/browser where I’m allowed to use my password manager.
In these cases, an “email login link” would be strongly preferable to a password reset, since the problem isn’t that I’ve _forgotten_ my password; I never actually knew my password in the first place. If I change my password, that won’t match whatever my password manager has got stored.
---
### Author:  [@va6996](https://meta.discourse.org/u/va6996)
#### Post date: [February 28, 2017, 5:48pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/6 "2017-02-28T17:48:00Z")
Hi,
Is this project idea still available for GSoC? I am interested to take this up!
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [February 28, 2017, 7:58pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/7 "2017-02-28T19:58:55Z")
Yep, it’s still on the table. However I think this task would probably have to be one of several #pr-welcome tasks, since I doubt it’d take 3 months to figure this one out.
---
### Author:  [@Tushita08](https://meta.discourse.org/u/Tushita08)
#### Post date: [March 11, 2017, 1:35pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/8 "2017-03-11T13:35:27Z")
@erlend_sh
Sir, Is this topic still available and can I start working on it?
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [March 11, 2017, 4:09pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/11 "2017-03-11T16:09:57Z")
Yep, this is still available. But keep in mind that since this change has security implications, it’ll probably be a pretty slow-moving process as we need to review every code change very carefully. As already mentioned, it should be done in conjunction with a couple other tasks.
Also, this isn’t a good “warmup task”. Better look through #starter-task::tag for that. Save “Passwordless signin (+others)” for your SoC proposal.
---
### Author:  [@Tushita08](https://meta.discourse.org/u/Tushita08)
#### Post date: [March 11, 2017, 4:46pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/12 "2017-03-11T16:46:03Z")
Sir,
I am starting with some starter tasks and will have my GSoC application/proposal on this topic.
Thank You for your guidance.
---
### Author:  [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [April 13, 2017, 7:24am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/13 "2017-04-13T07:24:30Z")
Eh, I feel the rush to implement this feature. Up for grabs?
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [April 13, 2017, 12:33pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/14 "2017-04-13T12:33:10Z")
heh, sure go for it!
[ ](https://www.youtube.com/watch?v=FjspxBtxFXg)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [December 28, 2017, 12:47am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/15 "2017-12-28T00:47:10Z")
I added this to 2.0 and am assigning this to @tgxworld to look at. We have a PR for this by @fantasticfears that just needs a bit of refining
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [December 28, 2017, 2:02am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/17 "2017-12-28T02:02:31Z")
> [@erlend\_sh](#):
>
> But keep in mind that since this change has security implication
May I ask some security experts here:
Is this procedure less or more secure than the default PW way?
Just as an side aspect, I’d like to mention:
1. What if an attacker catches the plain text mail and login (maybe automatically?) - in first place to get control over the account.
2. He would try to change the mail adress to make an account recovery - at least for the moment - impossible.
3. Now he/she has time to get everything she/he wants to know.
I would say for any corporate Discorse usage, it could become pretty dangerous.
So, I would suggest:
- to disable some settings like changing the mail adress for at least x minutes.
- offer some kind of 2FA in addition (optimal)
- make sure, if someone from ouside the country (better: some location radius over x kilometers/miles, relatively to the last 1-3 locations, the admin and user itselfs will become immediately notified over the geo location, IP and time… (like Apple does)
… so there is a small chance to prevent / stop illegitimate access, in case there is something suspicious.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [December 28, 2017, 2:17am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/18 "2017-12-28T02:17:27Z")
I think as a minimum when we pull in this feature it would be default off.
In a 2fa scenario you would need magic link + 2fa which I think gives plenty of security and allows you to forget a password.
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [December 30, 2017, 10:47am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/19 "2017-12-30T10:47:01Z")
> [@terraboss](#):
>
> What if an attacker catches the plain text mail and login (maybe automatically?) - in first place to get control over the account.
This is the same threat level & attack vector as intercepting your password reset link, which is already a default feature.
---
### Author:  [@terraboss](https://meta.discourse.org/u/terraboss)
#### Post date: [December 30, 2017, 11:22am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/20 "2017-12-30T11:22:37Z")
Why do we need TLS/SSL encrypted web sites and passowrds at all, if there is no intend to fix this? Why are you hashing the PW before sending it to the server, if the mechanism to bypass it, is so easy?
I really think, it shouldn’t be that easy to hijack user accounts in seconds. Even for bank account access via ATM, you need at least the data on the card and a pin. It a petty, that mail encryption is that kind of complicated for inexperienced users nowadays.
Hmm 🤔 makes no sense for me
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [December 30, 2017, 11:52pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/21 "2017-12-30T23:52:45Z")
Which is why what you really want is 2fa, which is coming next year
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [January 1, 2018, 7:48am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/22 "2018-01-01T07:48:53Z")
Make sure to use WebAuthn (the api that supports “More than just U2F”) when implementing, it will also support things like fingerprint sensors.
(and also android safetynet which is a big scam to punish people for rooting their devices)
> [@terraboss](#):
>
> Why are you hashing the PW before sending it to the server, if the mechanism to bypass it, is so easy?
I don’t believe Discourse does this.
> [@terraboss](#):
>
> Why do we need TLS/SSL encrypted web sites and passowrds at all, if there is no intend to fix this?
There’s plenty of reasons why content integrity and authenticity are important, aside from the confidentiality of login, but I’m sure you already knew that.
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [February 13, 2018, 8:17am UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/23 "2018-02-13T08:17:52Z")
Thank you @fantasticfears for lying the ground work here! I made some changes as to how error messages are displayed and made the rate limits more aggressive for the new routes.
As per @sam’s request, the feature is also off by default and can be enabled via `enable_local_logins_via_email` site setting.
[https://github.com/discourse/discourse/commit/03b3e57a44da228bca7296bd752e26447956e1d6](https://github.com/discourse/discourse/commit/03b3e57a44da228bca7296bd752e26447956e1d6)
---
### Author:  [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [February 14, 2018, 12:45pm UTC](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569/26 "2018-02-14T12:45:54Z")
Maybe this feature could be integrated in a more visible place as it’s very useful:
I suggest if there could be a button here saying Login with email
Something like this one:
[Next page](https://meta.discourse.org/t/passwordless-signin-via-email-link/57569.md?page=2)