3 ms·
If a logged in session never expires, then the "magic link" idea basically boils down to a "proof of email" scheme, at least for the simple case of a user only
by dane-pgp 6y ago
If a logged in session never expires, then the "magic link" idea basically boils down to a "proof of email" scheme, at least for the simple case of a user only using one browser.
For such users, it would almost make sense for a browser add-on to offer a "temporary email" service which is dedicated to just generating a fake email address and redirecting the browser once the magic link arrives.
At which point, why does the site need to ask for an email address at all? I suppose the risk is that the user loses their cookies and can't access the site under their account again, but maybe the site could offer a randomly generated recovery phrase which the user could take a screenshot/picture of with their phone, or print off.