Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows me to enter a new password and logs me in.Happy days.This got me thinking; how about we skip the whole password thing and just send a single use link in an email that I click which logs me into a month long session.So, tell me.  Why wouldn't this work?
Is just using an email address for login a good idea?
security;passwords;login
This is a reasonable idea. Almost all passwords can be reset through email, and lots of users of many websites do this frequently, often every time or almost every time they log in (if it's a site that isn't used very frequently). If an attacker has control of your email the only advantages of using passwords rather than this method are: It might take a little bit longer to reset passwords than to get hold of login tokens.Security through obscurity - it might be less obvious which sites to get password resets from. You might not have any old password reset emails but you probably will have several old login tokens.For anything that isn't important enough to need two-factor authentication at password reset, this is probably a good idea. It also adds some security, compared to resetting your password each time you use the site - it eliminates password guessing or bruteforcing and the problem of choosing string passwords.One problem is probably although there are many forums, etc. that we log in to very infrequently, many of these websites believe or hope that we are going to use them all the time - no website wants to think they are the one we don't use much.EDITIt seems like some respondents have conceived this differently to how I have. I think the OP means that the link in the email would work only once, taking you to a page where you are considered to be logged in, and your browser can save cookies to that effect which last for one month. Therefore the old login emails saved in your client are not any use to an attacker - just as they can't use old password reset emails to re-reset your password. If you login on a different device, you have to re-request a login email, which then lets that browser instance be logged in.