Magic Link
A passwordless login where the user clicks a one-time link sent to their email. Simple to ship but inherits email security and deliverability limits, and is not phishing-resistant.
Magic links trade one credential for another: the account is now exactly as secure as the mailbox, and the mailbox is the single most attacked account a person has. They also break in ordinary ways, through link scanners that consume the token, corporate mail rewriting, and cross-device flows where the link opens in the wrong browser. Fine as a low-friction option, wrong as the only path for anything valuable.
See also: what is passwordless, passkey, social login, CIAM vendors
Related on Start with Identity
- GlossaryProgressive Profiling
Collecting user profile data gradually over multiple interactions rather than in one long signup form, to reduce friction and improve conversion in customer ide
- GlossaryHOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant met
- GlossaryTOTP
Time-based One-Time Password (RFC 6238). A six to eight digit code derived from a shared secret and the current time, used by authenticator apps. Phishable, so