Ask HN: Why aren't one-time sign in links more popular for authentication?
From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories:<p>1) Something you know (e.g. a password)<p>2) Something you have (e.g. a token)<p>3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...)<p>Real OTPs fall in the second category, because you have some device&#x2F;application that is able to generate the same OTP code as the server handling authentication <i>without communicating</i> with the server. Now there are some popular solutions that are still being called OTPs that instead of something you have is something that <i>is sent</i> to you, like SMS OTP. This isn&#x27;t just quibbling, because sending something each time authentication is needed, opens up the possibility for some attacks that wouldn&#x27;t be possible with proper OTPs, e.g. SIM swapping. So to answer you question:<p>- Just having to click on a link sent via email has the problems outlined in other comments<p>- having to both enter a password and having a link sent to your email address is safer than just enter a password, but<p>- having a true OTP, like the TOTP standard, is what provides the best security (in the category of OTPs, I&#x27;m not talking about protocols like FIDO2 and similar, because I don&#x27;t know them).<p>EDIT: formatting