Email Only Login

This module will allow your users to log in with only their email. No account yet? No problem, we'll create one on the fly.

We live in an age of restrictions and private areas. Web 2.0 caused almost every site to evolve and have some sort of account system. The problem with this is that most of these systems require the users to remember a password to authenticate themselves.

In most cases, while necessary, a password or login in general breaks UX. Users loose their password, they need to wait for password reset emails or they just don't bother in the first place and will never create an account.

That is where 'Email Only Login' (EOL) comes in.

But BEWARE! Only some use cases allow for such a low level of security. Obviously in such a system it's easy to log in as someone else. Only use this module in those cases where this doesn't really matter or where there is enough trust between the users, in a closed ecosystem for example, to allow for such openness. As a rule of thumb this module should only be used for non sensitive data websites where knowing who is currently using the website is more important than make their customized content private. You should also make sure your site makes this clear to the users.

In future versions of this login system I will also be adding more transparent security that improves the downsides of such a liberal login system. Some of the things I have in mind are listed below. Some might be silly though.. :)

- IP or IP range checking. If a users stays on the same IP, we can be more sure he is still him. Once the IP changes, we aren't sure anymore and send him an email with a login link that updates the ip for that account and allows password-less login again.
- A similar thing can be done via cookings, do you have the cookie? Great, you are prolly the user that logged in last time, if not send and email with a login link.
- Add an extra layer of security by limiting what users can do until they sort of 'sudo' to extra permissions by requesting an email with a link that assigns an extra permission role.
- Thirdly a digital secret handshake system might also work. I log in and go to this page, after that I click on the following link, this makes the system more sure I am the correct users because I got the secret handshake right.

The sending of these emails makes the system more secure, but they break UX, so we must try to limit the amount of times this happens.