Edit: Ignore below as I skimmed the article too quickly. Shouldn’t try and read something like this with screaming children in the room. - I think this propo

Edit: Ignore below as I skimmed the article too quickly. Shouldn’t try and read something like this with screaming children in the room. - I think this proposal is a little more complicated than it needs to be, and it's adding a lot of friction to an already annoying login process. I run a site that has a registration option, people avoid it as much as possible. Personally I'm a fan of the magic login email link, super simple and reliable. Just fingerprint/cookie the device that initiated the login to ensure that the email has been clicked on the same device. Most services would be compromised my a users email becoming compromised due to "Forgotten Password" recovery systems. So a magic email login link is no less secure in my eyes.