> what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow

This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!

▲

stetrain 2 hours ago | parent | next [-]

I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.

▲

n6242 2 hours ago | parent | next [-]

I've seen Slack and Claude doing this among others, it's turned into one of my leading red flags for untrustworthyness.

▲

stetrain an hour ago | parent [-]

I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks.

But it’s definitely annoying for a frequently used service.

▲

callc an hour ago | parent [-]

Maybe this gets us closer to some idea of email being a more protected digital service, that has some legal guarantees?

Putting the potential negatives under the rug for a second…

I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity

Is this a bad idea?

	▲	tancop 17 minutes ago \| parent \| next [-]
		Only if it's run by the state and free for every citizen. Forcing more bureaucracy on email providers will just make everything more centralized under Google and Microsoft. It should be a mailbox with E2E encryption where the keys are stored on your ID card. Backups stay on secure servers that are legally protected from anyone including the police and only given out when you're getting a new ID at a government service center, encrypted with the cards public key so a hacker in the card issuing system can't steal it. Every user gets a persistent address used as their identity, and any number of anonymous ones. Locking someone out would be both illegal and inconvenient for the government if all their official business is going through the mailbox.
	▲	nunez an hour ago \| parent \| prev [-]
		Horrible idea. This will require every email vendor to certify with every country they provide service to that wants to do something like this, which will pretty much kill any small/indie email hosting providers. I'd much rather have stricter legislation around password resets built into existing reg frameworks like PCI or HIPAA. If you store a form of payment or PII with a provider, then some form of human verification should be needed to perform a password reset.

▲

nunez an hour ago | parent | prev [-]

Correct; that's what I'm talking about. Sites that send you a link first before letting you enter a password (Spotify) are also on my bad list.

▲

nunez an hour ago | parent | prev [-]

For services that have your PII or payments details, yeah, that should be the only way to do a reset. Super inconvenient but much less so than dealing with stolen identity or credit cards.