OTP-only authentication

Question

I'm considering building a website user authentication system using only one-time-passwords: users would get one in the email each time a normal password is normally used e.g. for signup, sign-in, risky actions and account deletion.

Some problems that I see with it that don't seem critical:

• Can't change password to invalidate all existing sessions - can work around by storing sessions server-side and having a way to invalidate them for the user
• Anyone can check if a certain email is registered in the system - doesn't seem like a critical problem for a generic website
• Anyone can request an OTP for any email - will be dealt with using API limits per remote connection and a limit of 1 unused OTP per hour

I'm not seeing this method mentioned or used in the wild though. Does it have any major drawbacks? Many thanks!

Answer 1

OTP-by-email only is safer than password-only (it's basically like forcing the user to change their password every X hours).

I want to both address some of your non-critical points, and highlight some drawbacks.

Non-critical

Invalidating sessions

You don't have to store all sessions, only the invalidated ones, and only for the max duration of a session.

Checking that a user (email) is registered

That actually is a problem - it tells you that the email owner uses this website, which is a privacy issue, however minor.

But moreover, it's an attack vector. An attacker can scrape your user list, or just go attack that user on other sites, presuming that this email exists and links to a real human. Moreover, they can issue excessive OTP requests on their behalf, which I'll address in a bit.

All that said, there's no reason which this problem would manifest just because of OTP. A user can request OTP, and you can always reply with "If the email address hello@world.com is registered, a one-time password has been sent to it". This only has a slight usability implication.

Anyone can request OTP for any email

If an attacker can flood your site (from different IP addresses) with requests for OTP for hello@world.com, either you block this user (namely, that user has been DoS'ed), or you the site will flood the user's mailbox, which can get that mail server to flag the site as a spammer.

This could also be done in normal sites with password-reset emails, but that's why you typically want your user list to be secret.

Bigger drawbacks

Usability

OTP-only login assumes that the device from which you're logging in is also logged into the mail account linked to this site. Otherwise, the user has to log into the mail account in order to log into your site.

Single-factor authentication

The security community is pushing towards multi-factor authentication, where password is usually the first factor. A good practice would be to at least allow 2FA to users who choose to.

Account lockout

If a user's email account is no longer accessible for whatever reason (e.g. they used their work or university email), they can't log in, or even change their email address to their new one.

Email activity

If the site is heavily used, then it will be sending a lot of emails, to various public email services, continuously, all the time.

This alone may cause the site to be flagged it as a spammer, or even ratelimited.

If it does get ratelimited, some users will not be able to log in.