An issue with passwordless is its vulnerability to passive attack. From perusing the source code, it looks like they authenticate users based on a token and uid embedded in a link sent to the user&#x27;s email address. If that link is intercepted, an attacker can impersonate the user.<p>A system that addresses this drawback is SAW [1, 2]; it splits a token in half (via XOR) and sends part of it to the user as a cookie, and part to the user&#x27;s email address. Clicking the link combines the two and submits them both to the server for validation.<p>[1] <a href="http:&#x2F;&#x2F;isrl.byu.edu&#x2F;pubs&#x2F;pp1001.pdf" rel="nofollow">http:&#x2F;&#x2F;isrl.byu.edu&#x2F;pubs&#x2F;pp1001.pdf</a> (short)
[2] <a href="http:&#x2F;&#x2F;isrl.byu.edu&#x2F;pubs&#x2F;saw.pdf" rel="nofollow">http:&#x2F;&#x2F;isrl.byu.edu&#x2F;pubs&#x2F;saw.pdf</a> (long)