Wow. All the hate about email OTP. It’s an amazing feature that I use all the time. I believe slack popularized it.
Security and comfort are sometimes at opposing ends.
1) it’s unreasonable to expect people to remember so many passwords. I forget passwords all the time. Password manager isn’t that great since it doesn’t work cross device.
2) even with OTP, email is slow. Also email can distract and adds friction
3) federated auth such as google/GitHub auth is great. I usually get in in a single click.
I’d say if you want to prioritize you prolly get the best bang for buck in following order
1) federated auth - no need to store passwords, no forgot password flows. It assumes your audience is okay with google/GitHub/Twitter etc auth and has an account in one of the services.
2) email/pwd. More complications but benefit is it depends on no 3rd party.
3) one time link in email. The benefit is user doesn’t need to remember password. It does depend on email which adds some friction.
Note: you can have all 3 options and let user choose for maximum conversation. The tradeoff is more work on your side.
Life is all about tradeoffs. No one right or wrong solution.
Security and comfort are sometimes at opposing ends.
1) it’s unreasonable to expect people to remember so many passwords. I forget passwords all the time. Password manager isn’t that great since it doesn’t work cross device. 2) even with OTP, email is slow. Also email can distract and adds friction 3) federated auth such as google/GitHub auth is great. I usually get in in a single click.
I’d say if you want to prioritize you prolly get the best bang for buck in following order
1) federated auth - no need to store passwords, no forgot password flows. It assumes your audience is okay with google/GitHub/Twitter etc auth and has an account in one of the services.
2) email/pwd. More complications but benefit is it depends on no 3rd party.
3) one time link in email. The benefit is user doesn’t need to remember password. It does depend on email which adds some friction.
Note: you can have all 3 options and let user choose for maximum conversation. The tradeoff is more work on your side.
Life is all about tradeoffs. No one right or wrong solution.