[blondin]

hahaha, let's go back to 1998 and use cookies and sessions for authentication.

seriously, use time-based and hmac-based one time passwords. combine them with the user's email, which is a strong guarantee for identity and uniqueness. if the user chooses to use a disposable email, it becomes their problem, not yours.

[jay-barronville]

Huh? Sessions and TOTP aren’t mutually exclusive. In fact, they work quite well together.

And since when were cookies and sessions 1998-level technology? That’s ridiculous.

[eddsh1994]

Should they have said 1994-level? :P

[arcanemachiner]

I don't recall setting HttpOnly cookies in 1994...