Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into th

Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into this category. One could argue that strong password requirements do the same, but in reality they compel many users to reuse the same "strong" password, weakening security overall. Magic links prevent this entirely. Secondly, they protect users from weak auth implementations, leaked password hashes, passwords stolen through brute force attacks, etc. Because there are no passwords. I don't have much of a security argument against magic links. I suppose an attacker that gets access to your email now automatically has access to the application. But frankly that is true for passworded apps as well, given the "forgot my password" workflows out there.