3 ms·

> Email + magic link is a lot better for most use cases. Wouldn't systems like this put a lot of trust on their users? Say you use a magic link on an compromis

> Email + magic link is a lot better for most use cases. Wouldn't systems like this put a lot of trust on their users? Say you use a magic link on an compromised wifi network, like in a hotel, coffee shop, airport and so on without being on a VPN. Which some users will inevitable do. I completely agree with the "most use cases" though. As long as you can't change the associated e-mail without additional requirements.

vaylian 2y ago
After you have logged in, you will get a session cookie/key that you have to send on every request. An adversary can just steal that session key from the compromised connection.
mwwaters 2y ago
https end-to-end encrypts what’s in the address, except for the domain.