> The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, t

> The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the entire world spam countermeasures). Friction is very much acceptable for password recovery (arguably even desirable), but not so much for conventional login. That's a general response to the question of why passwords might be nicer than email OTP. But it doesn't answer my question - namely, any security problems that might be attributed to email/SMS OTP also exist almost invariably with almost all in-the-wild password implementations, and therefore, isn't email OTP only more secure than password plus an email OTP called "password reset". This question is purely a rebuttal of the claim that passwords are more secure than email/SMS OTP. In the wild, there are a few sites where an email account, and therefore password reset, is optional. Hacker News and Reddit are examples. But these are in the extreme minority, and almost never secure anything worth securing. Bank accounts are another class of exceptions, where they secure something so valuable it is worthwhile going through a human verification process before you can do a password reset. But almost everything else - online stores, newspaper comment columns, much social media, web apps used for work, phone apps that let you monitor your robot vacuum cleaner, email accounts - almost all of them expect you to have an email address and use it for a password reset