4 ms·
> If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps. What?
by reyml 2y ago
> If you have username/password combined with a “forgot password” feature, it’s the same as magic links with far more steps.
What?
- TheNewsIsHere 2y agoThey’re noting that at the end of the day you are relying on access to email as an authenticator. If you can use just an email address to recover access to an account, the security properties are effectively the same as just sending a magic link email. Of course for anything important, you shouldn’t allow users to recover access with only a link in an email. Personally, I like it when a service requires that you pass an MFA challenge to reset your password.