Post

Passkeys made signing in phishing-resistant, but we cannot make user accounts truly secure until we rethink how we recover the account. Email Verification Protocol (EVP) may be an answer.

blog.agektmr.comWhat is EVP? Bridging the remaining gap in the passkey eraHow the Email Verification Protocol (EVP) solves passkey fallback and account recovery challenges by bringing phishing resistance to email verification without...

Eiji Kitamura / えーじ

@agektmr.com

Today, almost every online service relies on one-time passwords (OTPs) or magic links to confirm an email address. Both force users to leave the browser and open their inbox—and worse, they leave a phishing-vulnerable weak link in the account lifecycle that passkeys alone cannot close.

6/10/26, 8:22 am0 reposts0 likes

Eiji Kitamura / えーじ

@agektmr.com

A new web standard in the works, the Email Verification Protocol (EVP), takes a completely different approach: it enables websites to verify email possession directly inside the browser, without ever sending an email.

Eiji Kitamura / えーじ

@agektmr.com

While that looks like a great sign-up UX upgrade on the surface, its real significance is how it changes the security equation across the entire account lifecycle.

Eiji Kitamura / えーじ

@agektmr.com

In my latest blog post, I introduce EVP from the ground up: how it verifies an email address without an inbox trip, and why it is the missing piece in the passkey era. Please give it a read: blog.agektmr.com/en/2026/10/e...