Lightweight passwordless & MFA options
Low‑cost passwordless routes—like Supabase’s email 'Magic Link' flows—and cross‑device 2FA tools such as Proton Authenticator are practical stopgaps for small IT teams that can’t deploy hardware tokens; meanwhile broader moves toward mandatory 2‑factor for transactions are accelerating. These options reduce help‑desk load without heavy infrastructure. (supabase.com, pcworld.com, tribuneindia.com)
Supabase’s email Magic Link flow is enabled by default, issues one‑time use links or six‑digit OTPs tied to an email address, and requires configuring the Site URL and allowed redirect URLs for hosted and self‑hosted projects. (supabase.com) A community thread and product discussion show the default Magic Link confirmation link expires after 60 minutes and that extending that TTL is not exposed as a simple admin setting. (github.com) Supabase notes passwordless flows can automatically create users and reduce password‑reset support burden, while self‑hosted Magic Link guides highlight explicit SMTP setup, email templates and deliverability steps that schools must implement. (supabase.com) Proton Authenticator provides cross‑device sync when users sign in with a Proton Account, ships free mobile apps plus native desktop clients for macOS/Windows/Linux, and supports importing existing 2FA tokens. (proton.me) Proton documents end‑to‑end encryption for synced 2FA codes, encrypted backups and open‑source clients that run without ads or tracking—features positioned as alternatives to single‑device authenticators. (proton.me) Regulatory momentum is concrete: the Reserve Bank of India’s new authentication directions make two‑factor authentication mandatory for digital transactions effective April 1, 2026, with additional issuer requirements for cross‑border card‑not‑present flows due by October 1, 2026. (economictimes.indiatimes.com)
