Furthermore, when offering direct login links you are training your users to not remember their passwords. A bad side-effect, unless you have only users who will never login except when notified.
Furthermore, when offering direct login links you are training your users to not remember their passwords. A bad side-effect, unless you have only users who will never login except when notified.
Come to think of it, that sounds very convenient. How about a security model that links an account only to an email address? This implies that anyone who can read that email account can log in. For many purposes, this might be fine.
You could do without those nasty passwords entirely then. Logging in from a new computer without cookies stored means having yourself a new "log me in" email sent. Sucks if you have to open your email just for that, but then again, for some services, this might seldomly be a problem because of their email-oriented nature.
Isn't Google Authenticator supposed to have an open API so that any service can give you a secure seed and then let you use your mobile phone to login? https://code.google.com/p/google-authenticator/