[felipeccastro]

I was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well).

By the title, I thought the article would explore some of the downsides of this approach that I might be missing.

[Macha]

Magic links are not the default as it gives your login process the speed and reliability of email delivery and most login processes are aiming for better than a p95 of about 5 minutes.