Passwordless Email Logins

Why not get rid of passwords completely and just send a link to log in to the user's email address?

I recently joined a website the did away with passwords, the only way to login was to enter your email address and confirm by pressing a link in the email, while this adds a pain point for customers it offloads most security implications onto the email provider.

Why not ditch passwords altogether and only do magic-link logins via email a la slack?

Complex situations:- I'm logging in from a new computer. Maybe a computer I don't trust enough to log in to my email (which controls nearly everything, as you note). Not all services are that important or need the same level of care as email.- I'm a user that has greylisting enabled on my mail server, potentially delaying the email for several minutes.Confusing:- I'm a user that has never seen/used this authentication workflow. While user/pass is annoyin

Something very similar is used by Slack, Medium (also Discord and Quora, iirc), wherein they just send you an email with a link. You click on it, are logged in, cookies set and all that jazz.I hate it, however. Quoting from another HN comment of mine:It's _not_ convenient in many cases, such as if you're using an incognito/private window, or on a friend's computer, school PCs, don't have access to email, etc.I much prefer the traditional username+password system

would requiring a un/pw sent to an email address work￶?

Passwordless logins through email should be an option, not the only method.

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication.1. Type in email address2. Get sent and email with code3. Enter code to loginWhile I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

Authentication on most of the web is directly connected with an email address.If you have access to an account's email, then you can have access to the account.Since most people have their email always open, or at least a click or two away from being open, why not skip the password creation altogether?Users are presented with an email field and a button saying something like, "Send me a key to login".An email is sent that contains a direct login link with a temporary token. Login t

I run a small B2C app. Users sign up with their email address only, a password field isn't even present. This creates the account and logs in the user "indefinitely" on this device. If they ever need to login on another device, they can request a new password. This way, this removes a) signup friction und b) weak passwords, because most people never need to login on another device anyways.