I like to try and pick a mix. I've been leaning more mage lately. Sometimes magic is super op, sometimes it's just an interesting system. Sometimes it's neither tho, and just clunky. So it's really kind of a toss up on whether that's a good decision.
Warriors are probably the best pick lots of times - just because gear systems often incentivize them. Finding a cool sword or shiny armor isn't very exciting when you're just hurling fireballs all the time anyway.
This right here. I'd rather my email stay the source of truth for auth, but totally sympathize with website owners that don't want to store and protect any sensitive user data (like an email address and password).
I do wish some sites would offer the magic link option if they don't want to keep password hashes. It has problems too, but can be a simple way sometimes.
On some level I know the OAuth flow should be pretty safe. The idea that I have one identity that gets me into multiple sites makes a lot of sense. And I'm already using the same email in most places, so it's not like I'm anonymous anyway.
And yet... I can't convince my paranoia that 'sign in with Google' isn't oversharing. I always worry that authorizing with other sites will give too many permissions to see/alter Google/whatever data, or that clicking it will take me to a fake Google/whatever page where I give away my creds.