Where would you send a link to log into your email?

I was thinking it would be super cool if you could use something like https://krypt.co/ and use public key private key.

Sure, you would need that ssh daemon running on the computer, but I bet it could it could be retrofitted to use qr codes or something.

... so a link sent over a protocol that is considered "insecure" by any sane security expert allows account access? Not to mention you still have to "secure" a password to your e-mail account.

I'm sorry, what in the world is Medium thinking? This is a step backwards from a user/password model.

They cover this in the article: "reset my password" emails are already the norm, so it's not any riskier than your existing online banking or social media accounts.

Resetting via link alone is yet another bad thing, because as you pointed out it leads to the exact situation you just described. Password resetting should involve some type of challenge/response, and accounts should be secured with 2FA on top of all that.

Medium still isn't winning any security points here.

> Medium still isn't winning any security points here.

Sure they are. Removing a credential—in this case, passwords—is strictly more secure. It's the same rationale as to why 2FA with just a TOTP app is more secure than TOTP app + SMS backup. And the emailed links are analogous to password reset links so there's no erosion of security there, provided they're properly secured (one time use, time bounded, etc.).

Also, realistically, if they used passwords, many of their users would probably re-use the same email,password pair at other sites. If any of those other sites use bad password hashing hygiene AND get hacked, then the users' account security is busted.