>Passkeys would make it impossible This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey. Passkeys wo

>Passkeys would make it impossible This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey. Passkeys would eliminate all the text message codes, email codes, and passwords. The flow is literally just: Face ID or Touch ID (or equivalent on Android/Windows), and you're done. It's both a faster/easier user experience than what you're describing and it's way more secure than any of the things you described, because the resulting credential is domain-bound and therefore can't be phished.