Ask HN: Security of Passwordless Login?

If those hold, then the security should be equivalent to the email account's own security.

It doesn't really matter if an advanced technique like you described is used, or if the email account itself is compromised, the security considerations are the same.

The one advantage that password reset emails have over magic link logins is they can provide users a clue that their account has been compromised when the old password doesn't work. (Though in practice, how many users will just reset their password and move on with no further investigation?)

In additional to single-use time-limited tokens, there are two additional measures that address this type of attack:

Providing details on the previous magic link that was used (date, time, IP address and maybe user-agent details) in the email with the magic link provides the ability to detect people who have gained access by requesting a link then deleting/blocking the email so that you don't see it.

Limiting the token to being used by the same IP address that requested the token prevents people from watching for a legitimate magic-link request and then hijacking that link for their own access.

With those two measures in place, I don't think there is any security downside to switching to passwordless logins.

I would note that if you employ both password and passwordless logins, this increases your attack surface and decreases the chances that intrusion will be noticed. (I.e. if the target uses a password to login, the can request magic links and then delete them and the target may never see this activity since they don't request their own emails. Conversely, if the target uses magic-links to login, the attacker can reset the password and the user may not ever notice). As such, it may make sense to limit users to a single login method (or always display a page showing last magic-link login and last password reset when logging in)

Almost every website in the world currently allows you to reset your password via email, and there's rarely ever a way to opt out and disable that.

You can't lose something if you've never had it in the first place.

The risk factors associated with how humans use passwords vastly outweigh the risk of data being captured in transit.

First of all, if an attacker has access to your email account, then you're doomed. The attacker can reset your password, lock you out, and acquire all privileges. Access to the email account is a fundamental assumption that every service does, and in fact that's how they let you even change your password.

For you as a user, it means not having to remember an extra password. The drawback is that email connectivity may slow down your login, and clicking the link could not work perfectly on mobile device.

For the service as a whole, it means not storing passwords, and thus not risking to leak passwords, and not being at risk of ATO due to reused and leaked credentials.

However this turns authentication from something the user knows (password) to something the user has (access to, their email account). Strictly speaking, this reduces the scope & security of 2FA solutions.

In fact, for most services it is possible to use password resets for just this purpose. Sign up with your email and an incredibly strong password that you never retain, reuse or remember. Next time you need to log in, just reset your password. Same thing. By offering passwordless login from the outset, you make doing so easier.

The one pain point is the need for the user to have access to their email, which these days is pretty easy.