One of the big problems with things like this is in combination with phishing and "password less" magic link logins: 1) Send spoofed email to person for some a

One of the big problems with things like this is in combination with phishing and "password less" magic link logins: 1) Send spoofed email to person for some activity (security, or just a notification) 2) User opens phishing link 3) User needs to 'login' using a temporary login code. 4) Phishing site underwater logs in as the user 5) User receives number 6) User does not click login, but copies the temporary login token to the other site 7) pwnage