Can we just be done with passwords?
I am tired of having to write authentication models where you take in UN + PW, then send them a TXT with a 6-digit code, to issue a session. And every password needs to be salted and encrypted. And every time someone logs in, I have to do this expensive hash to matching check.
Why can't we just take out the password?
Want to login... Great! Step 1) Put in your Email/Username Step 2) Click continue Step 3) We just sent you a 6-digit alphanumeric code (that expires in 1 min), enter it.
As a user, why should I have to remember (or in my case use 1Password for) every password? I know people that write it in TXT docs or on pieces of paper because it's too much for them. And as a developer, why should I worry about handing this VERY sensitive information about my client.
There are some security concerns here, in form of brute forcing. Here is quick solution, allow each code to be entered twice, then force a re-send of the code. Exponentially throttle after 1st resend.
And here is some quick, back of the napkin math (so correct me if I'm wrong), but given [a-Z] and [0-9], we have 26 + 10 possible choices (I'm making this case insensitive). Probability that someone can brute force it will be:
1/36^6 + 1/(36^6-1) = 1/2176782336 + 1/2176782335 = 9.1878732e-10
Am I crazy for thinking this? Is there a reason why devs don't do this? Is there something I'm missing about this model's security?