I thought about something like this years ago. Registration requires only an email address. You get a link by mail that you can use to log in. If the link is u

I thought about something like this years ago. Registration requires only an email address. You get a link by mail that you can use to log in. If the link is used within 5 minutes you are fully logged in but this expires after 1 hour. After it expires, or if you use the link again you get very limited access. Sensitive things and things you don't need frequently are hidden and disabled. With limited access you can request a new full access link. If you lose the link you can request a new one that will only work after 24 hours. Very sensitive things trigger a confirmation email. If you do not log in in 90 days your limited log in link is further limited to requesting the 24 hour delayed link.