prash_murali21

4 ms·

1. 1.▲
   by prash_murali21 4y ago

   "you really have no hope of knowing whether or not your account has been compromised/used for some nefarious purpose already" this is an interesting point. Although the same would be true if your password to site in question
2. 2.▲
   by prash_murali21 4y ago

   Agree with this. I don't see why you cannot add 2FA to email based login flows.
3. 3.▲
   by prash_murali21 4y ago

   I believe we have to view from the context of how most sites do auth, which is email + password with an 'email recovery' for the password. This is effectively the same thing with worse UX and an added attack vector of the password
4. 4.▲
   by prash_murali21 4y ago

   Yes exactly. If the email itself doesn't require MFA, you can always add MFA on top of email magic links.
5. 5.▲
   by prash_murali21 4y ago

   Yeah the big providers will not be encrypting at rest for sure. Even if so, the encryption keys would lie with the provider and not the end user, which kind of defeats the purpose.
6. 6.▲
   by prash_murali21 4y ago

   Perhaps a better title would be "trade-offs between security and UX for Magic Links"? Actually agree with most of what you said (bar the first sentence ;)) 2 key things highlighted in the post though: 1. The trade-offs you take ar