That's the point that I see as well. It's like if they get your email they will be able to get your user/password account anyways. So this seems like a decent way of getting rid of the password.
Also want to add incase anyone is reading that you don't want to set your systems security based on some lowest denominator that you can't even secure / control.
Seems unreasonable and insecure.
When user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.
Re:Cierge – passwordless authentication
by WorldMaker on Friday January 12, 2018 @12:09PM
(#16134379)
Additional questions are bonus passwords. They are not 2FA.
This is also true for 99% of online services that have a "forgot password" function that uses your email address. If your site is in the 1% that needs stronger security, then don't use this.
> You’ll also need to logon to your email to access whatever site which means whatever keylogger is installed on whatever computer you use in some public place will also be a threat.
Valid point, but it's an edge case that's not applicable to most people. The most common use for using a public computer is probably checking email. Even that happens less these days, which people just using their phones + public WiFi instead.