Passwordless SaaS users can't log in without email access
10 posts across 5 communities in the last 60 days; 40% from r/sysadmin.
“yeah the defaulting back to magic link thing is the most annoying part, like why even offer a password option then”
“So you will need your external passkey every time you want to login to anything. That's a tradeoff in convenience which often works well with IT-minded young male people but the farther you move away from that line the more of a nightmare it becomes to manage. You won't see that…”
“It looks like the website `app.notion.com` does not permit me to log in with my password anymore. It just sent a temporary code to my email. I didn't find anything in settings which lets me disable this. If this isn't possible to disable are there other services which do not…”
Users report frustration with passwordless login systems that require email access, as they cannot log in if their email is unavailable. Some prefer one-time codes for security.
SOURCES (20)
“It looks like the website `app.notion.com` does not permit me to log in with my password anymore. It just sent a temporary code to my email. I didn't find anything in settings which lets me disable this. If this isn't possible to disable are there…”
Whatever genius thought making the login flow more cumbersome by making Login Using Email default needs to take a long wall off a short pier… luckily this was pretty easily ignored, just…
“Also for B2B software - it's done so you can funnel people to the right SSO login based on their email address. Agree though that the password less approach is way nicer to use.”
“yeah the defaulting back to magic link thing is the most annoying part, like why even offer a password option then”
“Has anyone use this now? What to expect? What impact does this have with passkeys? submitted by /u/Dull_Estate678 [link] [comments]”
“I see, and I understand what you mean now thanks for sharing your thoughts and for the advice 🙏”
“"Smoother user experience"? Like this? ... Switch to an email app, possibly on another device. Wait for an email to appear (maybe for a short time; maybe for a long time; maybe until they realize the email got lost and they have to start over). Check alternative inbox folders if the email doesn’t show up. Perhaps read instructions to approve the sender domain, which they might not know how to do. Find the link in the email and select it, which opens a new browser window, leaving the fi”
“all to be lazy and avoid storing hashed passwords. you are paid for your work on the system developer, your users are not. I've cancelled subscri tons before when they force magic link on you becuase they are not worth the hassle.”
“Magic links generally offer a smoother user experience, as there's one less step for the user, but they can be more susceptible to email interception if the link isn't quickly invalidated after first use. Email OTP adds a slight friction but provides a fresh, single-use code each time, which can feel more secure to some users. From an implementation perspective, both require robust email delivery and rate limiting, but magic links also need careful token management to prevent replay atta”
“So you will need your external passkey every time you want to login to anything. That's a tradeoff in convenience which often works well with IT-minded young male people but the farther you move away from that line the more of a nightmare it becomes to manage. You won't see that backlash as a professional because they will just save the passwords in Edge, notepad or Onenote. As an IT professional I also have a passkey and a password manager for personal stuff that barely ever needs to be”
“You can even use passwordless sign in with DUO. Sure it costs money but it’s better than the baked in Microsoft system. How exactly is it better?”
“Am I missing a tenant setting that would allow true password-only fallback? No, you're not missing anything. Nor do you want a password only fallback. That just defeats the entire purpose of MFA If you can just click skip, what would be the point?”
“Yeah the most I’ve seen, and been a part of building myself, is adding an email as backup login if signed up with phone or vice versa and we used OTP so it was maybe a little simpler than potentially risking bleeding passwords across methods but those details were outside of my role on the products scope so didn’t get too in the weeds to know for sure”
“My favorite thing to see when a website or app asks me to register is email/confirm email/password/confirm password. I have a password manager, that is the program I want to be responsible for managing my passwords. I really do not want it simultaneously outsourced to a dozen third parties at once. If you're making a website or app with user accounts, for fuck sake do the like 10 minutes of research required to figure out industry standard best practices for storing passwords. Only connectin”
“It doesn't protect you from that or session hijacking. Something like FIDO can protect that. The MFA is just another way to say this is you logging in.”
“thanks for the reply some comments say that magic link will make it easier to switch devices so I guess each has its own merits”
“Why should I open my email app just to log in to your app? Doesn’t make sense. What if I do, then lose access to my email? What if my email app is on another device? What if the device is in another location? You can avoid all these user inconveniences with passwords/passkeys.”
“yea, I understand the pain having to switch to your email each time you log in but personally, I like not having to remember any password and type it in, and I happen to not use any password manager also, using a one time code feels safer to me cuz it makes my account harder to hack (maybe?)”