The argument for passwordless authentication reminds me of crash-only programs. Basically, if you have two modes of operation, a normal mode and a recovery mode, then why not just use the recovery mode for everything?<p>The next step, which a lot of skeptics don't take the time to think about, is that you can easily combine multiple channels when doing passwordless authentication.<p>So, one-factor is to send a magic link to your inbox. A second factor would be to also send a link to your phone. a third factor would be to also send a link to a friend's phone. That would prove that it's your inbox, your phone, and that you trust that friend. You're adding entropy by adding channels instead of characters.<p>Even if someone managed to use technology to stand in for your inbox and your phone, and took over your account. You could still recover it by having your friend vouch for you, because that's a whole 'nother layer of complexity the attacker would have to overcome to convince your friend not to trust you.