I've looked at implementing an email auth system. My hold back is concern about delivery guarantees, particularly around speed.
For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, they're going to give up / get annoyed.
If I can guarantee instant email delivery, essentially, I'd probably jump to this auth method.
Good point. My thoughts:
- Email is not the only option to deliver tokens. You could also go for SMS, or both
- For most registrations such emails are anyway commonplace. Combined with long sessions (where possible), I think the risks of delayed emails are low (compared to guys getting frustrated with the password)
- I'm so far happy with Mandrill. But as you say: random b.s. can happen
Yes, stuff happens. But as said: Most services use long-lived sessions. It's a choice: Trouble people with either insecure passwords and password resets, or take the risk that sometimes when a session was closed people might in rare cases not receive their tokens. Looking at my daily browsing I would be more than happy to get rid of most of the passwords.
For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, they're going to give up / get annoyed.
If I can guarantee instant email delivery, essentially, I'd probably jump to this auth method.