Magic Link
A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not phishing-resistant.
Magic links trade one credential for another: the account is now exactly as secure as the mailbox, and the mailbox is the single most attacked account a person has. They also break in ordinary ways, through link scanners that consume the token, corporate mail rewriting, and cross-device flows where the link opens in the wrong browser. Fine as a low-friction option, wrong as the only path for anything valuable.
See also: what is passwordless, passkey, social login, CIAM vendors
Related on Start with Identity
- GlossaryProgressive Profiling
Collecting user profile data gradually over multiple interactions rather than in one long signup form, to reduce friction and improve conversion in customer ide
- GlossaryAccount Recovery
The process by which a user regains access after losing their authenticator: a lost device, a forgotten password, or a revoked credential. It is a parallel auth
- GlossaryBrowser-in-the-Browser (BitB)
Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, o