> Because email is insecure, and there is zero guarantee that your login email will arrive before the token expires. Your token does expire, right? That's a bi

> Because email is insecure, and there is zero guarantee that your login email will arrive before the token expires. Your token does expire, right? That's a bit like saying laptops aren't secure. Well okay, laptops are not inherently secure, but my instance of laptop is secure (enough). Same with e-mail; there's nothing inherent in e-mail that would make it secure, but the way my e-mails have been set is secure (again, "enough" for practical reasons). >> My own browser erases all cookies from an origin immediately after the last tab from that origin is closed >So you are intentionally breaking the web and complaining that things are cumbersome? Gee, I wonder why. Clearing cookies isn't breaking the web. Some of your websites functionality may require things to happen again if I clear cookies, but a) that seems like a you problem, and b) doesn't seem broken to me. > Yes, because that API key is often used to sign the request, contains enough entropy to make guessing impossible, and because the URL is hardcoded in the app phishing is impossible. Not sure where you're seeing this "often", but most services I have API keys for work _exactly_ like passwords. I have to jump through a few hoops to get a working key, true, but once I have it, it's essentially a password, and used in the same way. > Authentication is pretty much a solved problem. Use a password locker encrypted using a single remembered key for the "something you know" part, and use a physical Webauthn token for the "something you have" part. Stop trying to reinvent the wheel, it'll only end up annoying your users. I don't feel like it's a solved problem if normal people refuse to do that. That's a solution in the same way that the advice "Everybody be nice to each other" is going to make the world a better place.