Post

Today, almost every online service relies on one-time passwords (OTPs) or magic links to confirm an email address. Both force users to leave the browser and open their inbox—and worse, they leave a phishing-vulnerable weak link in the account lifecycle that passkeys alone cannot close.

A new web standard in the works, the Email Verification Protocol (EVP), takes a completely different approach: it enables websites to verify email possession directly inside the browser, without ever sending an email.

While that looks like a great sign-up UX upgrade on the surface, its real significance is how it changes the security equation across the entire account lifecycle.

Recovery is also where a passkey rollout falls back to whatever the help desk accepts. When someone loses the passkey and calls support, the agent often checks details a caller can look up or fake. EVP could cover the email path; the phone path still needs a separate answer.