Hacker News Reader

I always understood it as, the email with link notification thing started as soon as email providers began regularly scanning users' emails. Before then, an email included all the information you needed without having to login to another site.

You usually keep old mails around that malware can then silently forward, this is a problem for unencrypted data. To authenticate through email, even if possible, there are hoops the attacker would need to go through and you'd likely be notified of e.g. a password reset mail

We could integrate expiry dates for emails after which they get deleted. That's feasible.

I don't think that's true for my bank or Czech government services. Plenty others do practice "security by email", though.