On review of the various methods around authentication I wondered what the security implications would be of a Passwordless login as follow.
- User enters their email address on a form on the website.
- A token is created and stored in a cookie.
- IP address, the token (hashed) and a six digit code (hashed) are stored in database with a ten minute expiry time.
- User received email with the six digit code and enters it on the site.
- Code must match that in the database, IP address must be the same and cookie must verify to the token (so same browser and same location must be used).
- If code is wrong, time has expired or another IP address / cookie tries to verify the against the database record, it is deleted and user sent back to the first screen.
It seems so simple that I’m assuming there must be a major vulnerability I haven’t thought of.