I feel this tradeoff is worth it to me; certainly it is no worse than email or SMS as the second factor.
This is by far the most common sign-in UX. So is there some security benefit in the email link sign-in?
And there's also no password stash if the server were to be hacked, which means no sending out "please update your password" emails and the like.
Auto population of login credentials including 2FA is currently an attack vector.
"A critical security flaw has been uncovered in the autofill functionality of nearly every major password manager. This vulnerability allows threat actors to stealthily harvest user credentials and sensitive financial data from deceptive web forms without user interaction, turning a core convenience feature into a potent weapon for cybercrime."
https://undercodetesting.com/the-autofill-trap-how-your-pass...
TOTP works just fine and you can save it in a password manager if you like. Email links don't allow me to use a keyboard shortcut to login, instead I have to open a new tab and click around for a magic code/url.
This as opposed to my password manager filling in the password field within a second or so.
But they know it's terrible. The reason they do it is to make account sharing more difficult.
Example: I had two orgs with similar names, one I set up myself and another my employer set up. Logged in via SSO. Once I deleted the one I created myself, I could not log in anymore with the notice that the org was scheduled for deletion. Could also not contact support as that required a login. Only when the org was deleted after a week and my employer deleted me and reinvited me I could access it again.
Quite the shitshow for a company worth a couple hundred billion.
> Between 14:17 and 17:11 UTC, our primary application database experienced severely degraded I/O performance following a routine maintenance operation, causing slow or failed requests on Claude.ai and preventing new or refreshed sign-ins for Claude Code and the Console. API traffic via Claude Developer Platform was unaffected.
https://status.claude.com/incidents/jm3b4jjy2jrt
Sorry again, thanks for bearing with us as we're dealing with the influx of new users and scaling up all of our systems.
Not too surprising that stuff is often broken. I just wish it was more often broken in my favor!
(This wish is not abstract - my account had been bugged for 8 months+ to not experience any weekly usage metering. It only fixed itself a few days ago when my annual bill came through).
Rare self-confession so openly?
"Elevated errors" -> translation: our stuff is totally broken
Everybody started saying "elevated errors" instead of "outage", because it sounds better. It's the same thing as every aircraft problem being an "electrical issue".
Then I saw that Codex worked better for me and cancelled my Claude Code subscription. And now for my moderate use (4-5 hours a day with no parallel agents) I have enough with Codex $20 and AMP free if I want to save some weekly quota.
But honestly I usually have enough usage to last the full week without using AMP.
Having to wait for a Distinguished Engineer named "Claude" to come back from their 2 hour break to fix their issue.
There's a confusing disconnect between "we have this magic box that can write all the software we'd ever want" and their lack of basic account management functionality.
(Not really. That disconnect is because of something mature software engineers have known for decades - the bottleneck has never been the code)
I tried using the Github VSCode Copilot because I have some credits. It will be better to wait for Claude Code to be fixed. In other words, Claude Code broken is still orders of magnitude better than Github VSCode Copilot.
Codex was taking a nap for 8 hours [0] recently with many of the interns here complaining that it is "down".
[0] https://status.openai.com/incidents/01KK9JA8JKQKDW1W24T09NHB...
Think about it, they're being forced to read and update code, on the spot, that someone else wrote! It takes time to get up to speed.