3 ms·
Should we embrace magic links and leave passwords alone? (2018)
- dane-pgp 6y agoIf a logged in session never expires, then the "magic link" idea basically boils down to a "proof of email" scheme, at least for the simple case of a user only using one browser. For such users, it would almost make sense for a browser add-on to offer a "temporary email" service which is dedicated to just generating a fake email address and redirecting the browser once the magic link arrives. At which point, why does the site need to ask for an email address at all? I suppose the risk is that the user loses their cookies and can't access the site under their account again, but maybe the site could offer a randomly generated recovery phrase which the user could take a screenshot/picture of with their phone, or print off.