3 ms·
What’s the problem with magic links? If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps.
by darajava 2y ago
What’s the problem with magic links? If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps.
Also, usernames are generally a bad idea. Just use email. If they need a handle let them set it separately on their account and keep it away from auth.
- solardev 2y agoThey take forever and require a separate tab or device to check the email. It's a pain in the ass for something I didn't want to do anyway (login yet again). I'd consider them an anti-pattern that makes life easier for developers but harder for users. Passkeys are a single click, or passwords can be instantly auto filled. Much quicker and zero friction.
- xboxnolifes 2y ago> If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps It's only the same for the people who forget their password. For those who know their password it's a strictly less convenient flow.
- reyml 2y ago> If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps. What?
- TheNewsIsHere 2y agoThey’re noting that at the end of the day you are relying on access to email as an authenticator. If you can use just an email address to recover access to an account, the security properties are effectively the same as just sending a magic link email. Of course for anything important, you shouldn’t allow users to recover access with only a link in an email. Personally, I like it when a service requires that you pass an MFA challenge to reset your password.