Ask HN: Why aren't one-time sign in links more popular for authentication?

Honestly, having a password manager makes this so much easier.

I still like the OTP process, but it is more hassle than using the password manager.

Compared to saved passwords in terms of usability: it adds extra steps, potentially several, which is annoying.

Compared to passwords in terms of security: you have to consider that the client visiting the link might not be the client with the session being authenticated, at which point there might be confusion over multiple authentication requests of mixed legitimacy around the same time. I don’t know how this is typically solved.

I think better than either for security and usability is passwordless WebAuthn with a local factor (e.g. Touch ID for Apple devices, or even a master password for a simple improvement over existing password-unlockable saved passwords), if implementing something outside the status quo.

(edit: starbugs’s point about latency is also very important.)

A lot of OTPs are implemented in insecure ways - e.g. using the "recover password" functionalities you can often figure out patterns the websites are using to create these OTPs. Some websites / apps do not implement account lockout and OTP expiration mechanisms and have 3-digit codes, which allows for brute-force attacks. Others with these mechanisms can lead to DDoS. Also, some web apps log these OTPs directly in the URLs. In general, I agree with minitech in that WebAuthn with a physical factor would be better, both in terms of usability and security.

There is a service that I use that uses these. About 90% of the time what happens is I go there to use it, get the thing that says "check your email!", and then get distracted on my way to my email.

By the time I finally get to my email, the link is expired and I just give up.

Consequently, I almost never use that service.

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories:

1) Something you know (e.g. a password)

2) Something you have (e.g. a token)

3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...)

Real OTPs fall in the second category, because you have some device/application that is able to generate the same OTP code as the server handling authentication without communicating with the server. Now there are some popular solutions that are still being called OTPs that instead of something you have is something that is sent to you, like SMS OTP. This isn't just quibbling, because sending something each time authentication is needed, opens up the possibility for some attacks that wouldn't be possible with proper OTPs, e.g. SIM swapping. So to answer you question:

- Just having to click on a link sent via email has the problems outlined in other comments

- having to both enter a password and having a link sent to your email address is safer than just enter a password, but

- having a true OTP, like the TOTP standard, is what provides the best security (in the category of OTPs, I'm not talking about protocols like FIDO2 and similar, because I don't know them).

EDIT: formatting