The "email is authentication" pattern
Relying on email as the primary way to authenticate users—via magic links, one-time codes, or "forgot password" flows—has become a de facto pattern because nearly everyone has an email address and recovery is simple. Commenters weigh the usability benefits for non-technical users against security and reliability concerns, such as weak email passwords, SIM‑swap‑like takeovers of phone numbers used for 2FA, delivery delays, and lockouts when mail providers or domains fail. Alternatives like government- or bank‑issued digital IDs, passkeys, TOTP apps, social or decentralized recovery schemes, and traditional passwords are explored, but none clearly outperform email for broad, real‑world adoption.
Email as the de facto identity and “root account”
- Many note that because almost all services support “forgot password via email,” email already is the real authentication and account-recovery root, no matter how fancy the primary login looks.
- Email is seen as the “lowest common denominator”: everyone has it, and major providers’ security is usually better than that of random sites.
- Concern: if you lose email access (provider lockout, domain lapses, provider shutdown), you can lose access to many accounts at once.
Magic links / email OTP as primary login
- A growing number of sites skip passwords entirely: enter email → receive code or link → you’re in.
- Supporters:
- Great for infrequent/low-value accounts and B2B tools where users log in rarely.
- Avoids password storage, password rules, and password managers most people won’t use.
- For some funnels (ecommerce, “guest login”), this improves conversion.
- Critics:
- Very annoying for users with password managers; slower than autofill + TOTP.
- Depends on timely email delivery; greylisting, spam filters, corporate scanners, and link prefetchers often break or delay the flow.
- Painful when email is on a different device than the browser/app.
Phones, SMS, and other authentication options
- Broad agreement that phone numbers are weaker than email (SIM swap, carrier social engineering, SS7 issues).
- SMS 2FA is seen as convenient but fragile; some prefer TOTP/authenticator apps or passkeys.
- Some argue that “2FA” is hollow if password reset via email bypasses it.
Government / bank / postal digital IDs
- Several countries’ schemes (national e-ID, BankID, login.gov-like systems, postal-service IDs) are discussed.
- Pros: strong recovery channel, in-person recourse, possibly pseudonymous per-site tokens.
- Cons: privacy, central tracking, exclusion of unbanked/non-citizens, complex onboarding, and heavy regulation; concerns about putting even more power in governments and banks.
Human factors, recovery, and crypto analogies
- Strong theme: any auth scheme must handle loss and recovery for normal humans; “lose key, lose everything” (as in self-custodied crypto) is seen as incompatible with mass adoption.
- Secret-sharing / “panel of peers” recovery is debated: theoretically good, but UX, phishing, and real-world coercion risks are highlighted.
- Many see backup discipline and key management as beyond what most people will reliably do without very opinionated, guided UX.