alt Hacker NewsEmail link is way more convenient than a 2FA text, surely? It means you don't need to remember credentials or have your phone with you.
Replies
I'd like to think I am pretty security conscious, but I still don't get the obsession with magic links (and passkeys). This is the one thing where I think I disagree with most of the industry. I thought forgetting passwords was a solved problem. I thought 2fa is much faster than searching for the last email for X provider the maybe takes 1 minute to arrive, requires retries and high tend up in spam? Some one please help me get on board.
2FA != SMS codes
TOTP works just fine and you can save it in a password manager if you like. Email links don't allow me to use a keyboard shortcut to login, instead I have to open a new tab and click around for a magic code/url.
It is terrible, slow, assumes that I receive my E-mail instantly (what if I use greylisting?), makes me check my E-mail when I don't want to.
This as opposed to my password manager filling in the password field within a second or so.
But they know it's terrible. The reason they do it is to make account sharing more difficult.
But less convenient than a TOTP generator in your password app.
On iOS and macOS 2FAs are auto-populated for you, and of course also your saved login and password. You don't need to leave the page and open other applications.
This is by far the most common sign-in UX. So is there some security benefit in the email link sign-in?