[yreg]

> no password, ever. we email a code that works once and expires in ten minutes.

Why? What's so horrible about passwords? They work so well with password managers.

I hate this forced email sign-in bullshit that's spreading like covid.

[samuelcole]

oh, i've disliked passwords for my entire career i think:

1. everyone uses the same string

2. if they don't use the same string, they forget which password goes to which site, which is really frustrating

3. if they do use the same string, someone guesses it and the user feels 'hacked'

4. what's up with magic words proving identity anyways?

i personally feel like your computer should know who you are and then pass along that identity to the website, and passkeys get close to this (which i haven't implemented quite yet here)

[yreg]

All of those issues are obviously solved by a password manager. A lot of people use a password manager.

Passkeys are a pretty bad solution as well, because they are supposed to be per-device. What if you use multiple devices (like almost everyone) or want to log in on someone else's device?

Why not offer both passwords and magic links?

[ang_cire]

I've gone the opposite route with my recent project, using IRC-style nick + pass, with no email. I prefer this to associating everything with a unique identifier about myself.