varunramesh
Joined 12 years ago
Joined 12 years ago
[0] https://github.com/rameshvarun/marble-mouse/blob/8b25684a815...
Email magic links are more phishing resistant - the email contains a link that authenticates the device where the link was clicked. To replicate the same attack, the user would have to send the entire link to the attacker, which is hopefully harder to socially engineer.
But magic links are annoying when I want to sign in from my desktop computer that doesn't have access to my email. In that case OTP is more convenient, since I can just read the code from my phone.
I think passkeys are a great option. I use a password manager for passkeys, but most people will use platform-provided keys that are stuck in one ecosystem (Google/Apple/MS). You probably need a way to register a new device, which brings you back again to email OTP or magic link (even if only as an account recovery option).
Right now I'm working on posts with interactive code snippets that you can edit / re-run directly in the page (like a Jupyter notebook). It's based off this: https://github.com/rameshvarun/blog-cells