Post

Passkeys made signing in phishing-resistant, but we cannot make user accounts truly secure until we rethink how we recover the account. Email Verification Protocol (EVP) may be an answer.

Today, almost every online service relies on one-time passwords (OTPs) or magic links to confirm an email address. Both force users to leave the browser and open their inbox—and worse, they leave a phishing-vulnerable weak link in the account lifecycle that passkeys alone cannot close.

A new web standard in the works, the Email Verification Protocol (EVP), takes a completely different approach: it enables websites to verify email possession directly inside the browser, without ever sending an email.

While that looks like a great sign-up UX upgrade on the surface, its real significance is how it changes the security equation across the entire account lifecycle.