3 ms·
A password/passkey reset flow is semantically equivalent to an alternative login method and if done via email is semantically equivalent to a magic link. Which
by lolinder 2y ago
A password/passkey reset flow is semantically equivalent to an alternative login method and if done via email is semantically equivalent to a magic link.
Which means that any service that claims to be passkey-only but supports email resets should just acknowledge that they support both magic links and passkeys as options—they're kidding themselves and their users if they pretend otherwise.
- Gigachad 2y agoPasskeys are at least more convenient than magic links as they do not require opening an email or pulling your phone out for an SMS code. You're right though that they Passkeys + email reset is no more secure than email magic links, but I'd say email magic links are perfectly secure for most use cases. There really is no reason to continue using passwords these days and every website should switch to either magic links, Email OTP, or passkeys. For more sensitive accounts like bank accounts and government services. You'd probably have to go through some other reset process involving real ID and possibly an in person visit to a support location.