Do you also think passwords are becoming obsolete for login?

I love the idea of magic links and have used them on more than half of my recent projects. It's fun to implement but I still don't like the friction of switching to an email app or tab, then clicking a link which then loads in a brand new tab even though I have the original service still open in the previous tab. It's not a perfect system, but I think we'll see more and more services use it.

I saw someone once say that a password-less system is impossible because this email-based approach still requires you to use a password to log into your email :) Something to think about!

A few years ago, I felt really passionate about doing my part to make passwords a historical footnote. Seeing as I was also the CEO, I was in a position to do something about it.

What happened was that it was a total disaster, and there was a panicked rush to restore normal password authentication.

The problem is that users - people who spend time in malls and are probably sad about Modern Family ending - freak TF out when there's no password. They think that they are being hacked. They have been trained that passwords are the ritual you do. If they're never asked to set a password, then they aren't confident that their account will still work later. They have no conceptual frame of reference for a magic login. That a magic login is quite literally no different a password reset doesn't seem to compute. It's like how people are super uptight about being seen in their underwear, but think nothing of putting on a bikini... humans are weird.

The problem doesn't stop with humans, sadly. This sucks, because people can be trained. People can learn new tricks, even if it takes longer than the life cycle of most new startups.

The next facet of this problem revealed itself when we had corporate clients complaining that they could not login. All of the links failed to work because they had already been used on a different computer. I didn't believe it until I demanded someone hand me their phone and manually triggered a resend. Any guesses?

That's right: they had an Enterprise Mail Gateway (capitalized to symbolize the money it costs) scanning employee mail before it was delivered. Filtering out viruses and yes, crawling every link looking for harmful content. There was literally no way for this customer's employees to login to our service during their launch of our service in their company.

Ultimately, I do believe passwords will be defeated. I suspect that it will happen in ways that are currently hard to anticipate. For example, I could make a compelling case for the insurance industry to decide passwords are a risk. However, it's nearly impossible to imagine them going away soon. Slack does it well, offering magic links as an option but not pushing it.

At the first start up I was at, we used magic links that were texted to the user. It was pretty fun and alleviated some of the security stuff we didn't want to deal with around passwords.

Thanks for all the great feedback everyone! Our dev team is definitely reading along and is thankful for all the responses.

I think the next few years everyone will have smartphones with fingerprint scanning capabilities. Then it's just a question of an app showing you a notification and asking you to approve the login by fingerprint. Friction 90% gone.

I think passwords are not only massively insecure but also a pain in the ass. I recently launched my app PhoneTag with authentication driven by an SMS driven access code. Where switching back and forth between a website and your email client can be clunky - going from a mobile app to your SMS is fairly seamless. I would love to replace the access code method however with a magic deep-link for authentication - any plans or current support for magic links directly into native mobile apps?

I have used Magic Links for authentication from the beginning with CodeScreen, as I did not want to make users have to remember another password. It also provides 2FA by default (as long as they have 2FA set up on their email), which is nice.

Most users like it, and I think it works well for B2B platforms. Some users have asked for SSO with G Suite due to the extra step of having to go back into their email and click the link.

For B2C platforms targeted at developers, I would definitely go with SSO support for G Suite and GitHub.

I used Auth0 to implement Magic Links, but if I were to do it again, I would definitely give your platform a go as it looks cool!

This is indeed a good solution, but give the user the opportunity to choose their login option is a better way because there are people like me who use a password manager.

And in the concerns of security perspective, if most websites use email login, that means a hacker can compromise one's accounts by just hacking his email, same logic as if the user uses the same password for all his accounts.

Awesome idea, must agree do think this is the future or like passport authentication (browser vs setup unique).

And really awesome website!

I tried MagicLink and one thing that I found not smooth (since you talk about friction on your landing page 😃) is once I followed the link it didn’t deep link me to where I was supposed to end up in the first place and instead suggest to find the original tab by myself.