I'd say that this is a con for graylisting, and not for passwordless access.
Re:Password-less login
by 2T1Qka0rEiPr on Friday March 10, 2017 @05:41AM
(#13837654)
Or at least, for both.
When email comes delayed (with invalid token) can you white-list that particular sender? You'd then request another sign-in email that comes promptly this time.
Re:Password-less login
by aruggirello on Friday March 10, 2017 @06:08AM
(#13837755)
Well this is certainly a problem, but it's mostly limited to the first login, as (IMHO) the mail server(s) should use DKIM so greylisting can safely assume it's receiving mail from the same (legitimate) domain (the actual IP used becomes irrelevant). The first password-less login email could allow for a longer expiration, and it wouldn't be worse than a password-ful first login with email verification anyway.
My primary email uses greylisting to combat spam. This means that if we receive a mail from an unfamiliar mail server, it's getting an error message saying the mail can not be delivered at the moment, and to come back later. Properly configured servers try again several minutes later. Spam bots seldom try again, so it works well.
I can see how greylisting and tokens that expire quickly can be a problem. Particularly if you have multiple servers for outgoing mails, so that the second mail attempt may come from another IP than the first.