Medium adds sign-in option that emails users a one-time login link, no password required
Context & Ripple Effects
In mid-2015, Medium makes an early consumer-platform bet on killing the password at sign-in, replacing it with a one-time link sent to the user's email. The move reads less like a gimmick and more like the opening of a pattern: within months, Yahoo Mail ships its smartphone-tied Account Key for password-less mail login, and Google begins testing a login flow built on phone notifications instead of passwords.
The arc only accelerates from there — by 2021 Microsoft is offering a Temporary Access Pass and reporting that roughly 200 million users have gone passwordless on its services, while even the password-manager camp joins in with 1Password's Psst! link-based credential sharing. Medium's small feature is one of the earliest mainstream proofs that possession-of-inbox beats memorized secrets.
First-order effects
- Medium users can now sign up and return without creating or remembering a password, cutting signup friction and pushing account security onto their email provider instead.
- Medium's own attack surface shifts accordingly: a compromised or phished inbox now equals account access, making email deliverability and its abuse handling core infrastructure rather than a notification channel.
Second-order effects
- Rivals validating the same idea — Yahoo's Account Key and Google's notification-login experiment — turn passwordless from a differentiator into table stakes, forcing consumer services to justify why they still require passwords at all.
- Email providers quietly gain leverage as de facto identity gatekeepers, since whoever controls the inbox controls recovery and login for every service adopting this model.
Third-order effects
- If the pattern holds — and Microsoft's reported 200 million passwordless users suggests it did — the industry converges on possession- and link-based authentication, with passwords demoted to fallback rather than default.
- Credential management fragments across channels (email links, phone prompts, shared links), which is exactly the gap password managers like 1Password move to fill with link-based sharing tools.
The trend: Consumer authentication is steadily abandoning the memorized password in favor of possession-based and link-based flows, with each major platform's adoption normalizing it for the next.