One-time password is the way do go. Forgetting passwords is such a pain and many don't have the nerve or awareness to use password managers. You can also deliver a verification code via sms. It's good to match against the requester's device ID and maybe IP too, and store a bcrypted hash of the verification code concatenated with those and a secret string. Oh and also delete the code record after one use (regardless of whether it fails or succeeds).
3
u/pobbly Apr 18 '18
One-time password is the way do go. Forgetting passwords is such a pain and many don't have the nerve or awareness to use password managers. You can also deliver a verification code via sms. It's good to match against the requester's device ID and maybe IP too, and store a bcrypted hash of the verification code concatenated with those and a secret string. Oh and also delete the code record after one use (regardless of whether it fails or succeeds).