Ask HN: Why not to use passwordless login?

Is there a reason why new services are not using passwordless login? (Type your email -- receive the code -- fill in the code)

Plenty, both in terms of security and UX:

1.) It's less secure (unless the email is encrypted, which in most cases it is not).

2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email.

3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about).

Not saying your are wrong in your preference, but you can similarly use a password manager to save the email address used for a password-less login. So perhaps not a good argument against passwordless logins in general, though I am sure there are many good reasons against it.

So far, the few arguments against here are individual, convenience-based reasons. Those are certainly valid reasons, because if you inconvenience a potential user, they may never become an actual user.

Not everyone has a password manager, and many people use the same username, email and password across many services. The larger danger can be that if one service is hacked, it may provide a hacker access to many services, including email. A provider of a service with a passwordless login would never have to worry about being the root cause of such a breach. And, as long as the users' email was not hacked, would not be susceptible to malicious activity through another hacked service.

One question for the OP: What kind of service are we talking about? If the information is sensitive, then perhaps it is not a good idea. If it would be safe to keep a user logged-in after a session ends, then maybe a good consideration. By limiting the number of login requests, then you reduce the inconvenience.

Email deliverabilty is not necessarily 100%. Also there can be latencies here and there that can lead to user frustration (for example greylist strategies).

One alternative for password-less is to use Google Authenticator code as the password (i.e. send the QR code once by email and from then on use the Google Authenticator code), but I'm not sure if the the low entropy (1/1000000th chance of guessing the right password) would be enough for brute force attacks.