Not so much to add to the thread title.
Passwordless authentication systems (take [Medium.com](https://Medium.com)’s: OTP “magic link” send to the user’s email to login; so I guess effectively email-based OTP) are more convenient to users compared to software-based 2FA:
* No need to set up the second factor in a software authenticator
* If all websites were protected with email OTP, users could simply ensure that their email login were secured with a second factor and all other login requests route here. Conversely, this would create a single point of failure in the system: if a hacker were to gain access to email, they could authenticate everywhere, because email OTP was protecting all other systems.
Those are my (unqualified) impressions anyway. But I’m seeing more and more websites using these email OTP / “magic” links. So I was wondering what you guys think of the various pros and cons vis-a-vis 2FA?