[vizzah]

I just can't stand email OTP. Before we had passwords, now we have passwords + email OTP. And doesn't matter if you forgot password - you will receive password reset to the same email. You already prove email ownership by resetting or using password - why sending another useless "security token" to the same email. Pure nonsense. Whoever designs all of this clearly has little idea of what they are doing :(

[TylerE]

I’ve kind of become a fan of the sites that don’t even have passwords but just email you a “magic” link. If my account security is tied to my email why make me do extra song and dance if I’m gonna have to fish out an email for every login anyway?

[kevincox]

I despise this. With username and password my password manager just fills it in and it is one click to click "login".

With email magic link I need to enter my email (it seems to rarely auto-fill for some reason), then wait (often it takes 10s for the email to be sent for some reason), then if I was logging in on something that isn't my default browser I need to copy+paste the link (often just clicking the link authorizes the source session but not always and you don't know what this site does so you need to do it to be safe). Now you are finally logged in but probably have two tabs open. Either you need to find the first one to continue your session (if it logged that one in) or close it and lose your history for that tab (and hope that the website actually maintained your target page which more often than not it didn't).

[ddejohn]

Nothing tempts me so strongly to give up and leave a site than needing to use a magic link to get in.

Sometimes it takes minutes. I have, on more than one occasion, given up on buying a product because of this. It's actually insane to me how much effort sites put into preventing users from using them.

I get it, most people are idiots with completely non-existent security hygiene, but man does it suck being punished because of just how low the common denominator is here.

[radicality]

And on top of that, the session is probably gonna expire in less than day. I hate logging in to Anthropic because of this signin-email dance

[TylerE]

My point is that on sites that force email 2FA you have to do the email dance anyway. A username and password are basically theater.

[kevincox]

That's true. Although pasting the code into the existing browser tab is a bit smoother in my workflow. And at least the form autofills properly when they ask for email and password.

I'd much prefer if they could just trust my password. But I know the unfortunate truth is that the majory of people just reuse a password across most sites. So these measures are intended to raise the baseline difficulty, not to improve the security of those with good habits.

[frankish]

My preferred workflow as well, but now many websites are starting to do this thing where you have to enter only your username, hit next, and then the password input shows up; however, the username only input breaks my password manager from trying to autofill! Argh

[radicality]

HomeDepot’s is even crazier. You input just your email and hit Next. Then a button appears to “Send magic link” to login via that annoying method. And then there is a tiny text below: “Want to use a different login method? Wait 10s…9s…8s…”. Only after 10s are you able to select a tiny text link “Use Password” to unlock using the password field

[jesseendahl]

FYI Home Depot supports passkeys which are a significantly better* sign-in user experience than magic links.

*faster + easier (fewer steps)

[radicality]

Oh nice, thanks, just set this up! Though seems like I needed to do enable it separately for the web version and iOS app.

[tpxl]

Google has been doing this for years, if not over a decade at this point. Password managers have gotten wise about it though, so for some websites it actually works.

[paradox460]

The biggest pet peeve of mine in this area is "magic link" auth. Instead of letting you use a password and otp, which can be managed by a password manager, they send you an email so you can click a link to get into their app

That's right, you have to wait for an email to arrive, make it through the spam gauntlet, and then click the link in the email, likely covered in trackers, just to get into a website or app. And here I thought people wanted to keep you in their site as much as possible

[notfed]

I'm confused by this comment. Can you clarify exactly which poor design flow you're talking about?

[tpxl]

1. Input username/password -> get email otp code.

2. Forget password -> get email for new password -> input username/new password -> get email otp code.

The only actual security factor here is your [email, email password], everything else is just silly rigamarole.

[tzs]

Note that by doing it that way they don't have to have a special case for handling input of username/password when that password is a new password. Making security critical code simpler is generally a good idea.

Whether it is worth annoying some users in the password reset case to avoid making the login code slightly more complicated is going to depend on your specific situation.

[runeb]

I read their point as why have passwords at all when the security is you having access to your email account.

[spacebanana7]

Email OTP can be useful as a layer in risk based authentication.

If someone tries to log on to your site from a low reputation VPN, throwing an email OTP challenge can give some assurance it’s a genuine user logging in. Rather than a spammer or something like that.

[Freebytes]

Yes, it makes sense if the environment has changed, the device has changed, or if the person is logging in from a higher threat source such as a VPN IP address. However, if nothing changed, it is a waste of time in many cases.