THE “EMAIL IS AUTHENTICATION” PATTERN

Summary from the TLDR Web Dev newsletter

The common practice of using "Forgot Password" links as a primary authentication method is inefficient and risky. It relies on disposable passwords and ignores better security practices like password managers and multi-factor authentication. This behavior is not a conscious decision, but rather a learned process that people have adopted over time.