&gt; If you don&#x27;t require privileged elevation<p>What do you mean by privileged elevation (I&#x27;m talking in the context of a web app)?<p>&gt; just using an email address and send &quot;magic links&quot; + persistent (but expiring) sessions<p>Do you mean something similar to what Medium does?<p><a href="https:&#x2F;&#x2F;medium.com&#x2F;the-story&#x2F;signing-in-to-medium-by-email-aacc21134fcd" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;the-story&#x2F;signing-in-to-medium-by-email-a...</a><p>I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)?<p>&gt; You can also use a delegated auth system<p>Yes, outsourcing the authentication is another solution, but some (most?) users are not comfortable with giving so much power to Google&#x2F;Twitter&#x2F;GitHub&#x2F;etc. (as you wrote in your comment).