No you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed).

Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.

If an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process.

So while you are logged in, the attacker can do anything they want.

The signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.

That’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device

Yeah, agreed.

Google does that without needing a QR code if you have a recent Android and haven't enabled 2FA

How does the communication from the computer to the phone work?

No idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login.

They initially rolled it out as a 2FA option, then as an optional for 1FA.

OK so you have to actually type your email into the computer.

Exactly. Google already asked for email alone and then password on the next page so that they could support sending enterprise emails to custom login systems.

You’ve just described SQRL