>This convenience is possible because this is hard to abuse. If a malicious person gets access to my computer, the worst thing they can do is order a whole bunc

>This convenience is possible because this is hard to abuse. If a malicious person gets access to my computer, the worst thing they can do is order a whole bunch of stuff to my saved address, which I could easily cancel or return. Based on the number of services who will reset logins given only the last 4 digits of a card, this person is hopelessly misinformed. Not asking for a password on registration means one needs to be emailed to the user, in plaintext. Given users' habits, a vast majority of them will then not change from that one - a security disaster, and likely to land you on plaintextoffenders.com . As for this three flows, 1 is someone who wasn't interested, fine - but he advocates spamming people who haven't double opted in, which is just about the worst thing you can do from an email perspective. Oh, and email click logins are another terrible idea, as intercepting an email then gives account access - even partial access means your security model has failed. I'd rather have regular password checks with the 3 seconds it takes to input it from KeePass than lose an account or personal details.