This implementation is just skipping the charade that passwords are where the security happens.

With almost all current systems the place security really needs to happen is at the email provider. If you can hijack/intercept a users email or hack their account then it's game over with a password anyway, thanks to password resets being (almost) universally done over that channel.

There's an argument that this is no bad thing as security focused email providers could potentially provide very secure access as part of their core business (unlike a startup just trying to get going).

But there's still something bugging me about this implementation I can't put my finger on.