I have a few sites where this is effectively what happens. They have really bad security to where triggering a password change has them send me a new -password-

I have a few sites where this is effectively what happens. They have really bad security to where triggering a password change has them send me a new -password-, not just a link to reset my password. And then it doesn't force me to change the password when logging in. Well, that actually works out (except that the password is too short to survive brute forcing), because I then log in with that, do my business, and move on. Next time, same thing happens, "forgot password". Which presents a much better authentication flow to my mind. Nevermind passwords at all; just focus on whether they own a particular email account. If the email account gets pwned, the attacker can likely log in with them anyway (and if that's an issue you need 2-factor). So rather than force a password at all, send them a verification email, and have that immediately give them a token. If/when the token expires, have the login window require their email address, and send them another link that, when clicked (in the next X amount of time) will log them in with another token. I know for me that would mean -every- account I have is suddenly 2-factor (since my email account is), they all have strong security (since my email has a long, complicated, hard to brute force password that I keep only in my head; it's the only one like that), and I'd stop having to rely on a password manager. Curious if there's any obvious flaws that I'm missing.