> Once your email is hacked, you will be globally owned.

This is also true for 99% of online services that have a "forgot password" function that uses your email address. If your site is in the 1% that needs stronger security, then don't use this.

> You’ll also need to logon to your email to access whatever site which means whatever keylogger is installed on whatever computer you use in some public place will also be a threat.

Valid point, but it's an edge case that's not applicable to most people. The most common use for using a public computer is probably checking email. Even that happens less these days, which people just using their phones + public WiFi instead.

That's the point that I see as well. It's like if they get your email they will be able to get your user/password account anyways. So this seems like a decent way of getting rid of the password.

Also want to add incase anyone is reading that you don't want to set your systems security based on some lowest denominator that you can't even secure / control.

Seems unreasonable and insecure.

When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.

Additional questions are bonus passwords. They are not 2FA.

Public computer is for probably checking email. You said it yourself. Hence a proper adversary has already pwned these devices.

Password recovery through email is ubiquitous. So password is in no way a second authentication method to your email. That said, email is an identity, not a secret. But for the most part I'd rather protect my identity alone than my identity AND my secret.

When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.

No reason you couldn’t use this service + MFA.

If you email is hacked, that can be used to reset the password, so it's no less secure unless another factor is required to then change your password (which most services do not). You do have a point about it potentially exposing your email password to a keylogger though.

However, you also need to consider how most people use passwords. Often they have the same password (or very similar password) for many services. Other people essentially use the password recovery flow as their login mechanism. This is more secure and usable than that.

There are other options. Well designed passwords that are the same but different using password formula that one doesn’t share.

Password managers.

Certificates. Etc.

Cierge also uses magic links, making the code invisible to keyloggers. You can configure it to use magic links exclusively.

> The point of a password AND an email is that will essentially make it “two factor”. With email only you are no longer two factor.

Please don't confuse things. This is only one factor (email or email+password doesn't matter). Two-factor is only if you have one factor on top of this, e.g. U2F, OATH, etc.

I am not a security expert, so I started looking for solution which I know from my personal experience: If we add additional complexity like MFA/2FA this problem seems to be mitigated.

It would be great if someone with more knowledge in this field could provide a better solution for this issue.

Edit: Also you could reset password on your e-mail account if was breached.

Edit 2: There are also push notifications sent on mobile apps which acts like boolean type to accept or deny logon process.

Edit 3: If MITM is also laid down in discussion about possible threats then I think end-to-end encryption may help.

Edit 4: Banks usually use "Fill 3, 4, 15, 22.. character from your [placeholder: password, auth card]" method to get rid of key-loggers on clients PCs.

1- If your email was breeches it’s simply too late.

2- Great - this is 2fa and good.

2FA is overused term in these days. I thought like Cierge+U2F with some physical device like Yubikey or Google Authenticator.

Edit: If my email was breached (and I would know it) I would probably reset password and logon to change all services to populate them with brand new credentials. Then I will try to minimize the threat (i.e. by making impossible to use my accounts - bail out emails, resting credentials or even removing accounts and e-mail) and then find out the best solution for specified scenario and recover after breach with implemented better security.

Many services now allow password reset by email (magic link), Cierge's approach just does away with the illusion of security employed by such services. Outsourcing authentication to email, as many services do with Google/Facebook/Github accounts.

The Cierge login approach would obviously be inadvisable for protecting something of importance, like your email account.

When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.

Additional questions are bonus passwords. They are not 2FA.