I've spent some time playing around with it and it seems like this particular implementation is unsafe.

Scenario:

1. I enter my email address on the sign in screen on Fast.co in Tab A.

2. I get an email with a "Login" button in it in Tab B.

3. I click the "Login" button and it opens Tab C and tells me I'm now logged in in Tab A.

4. I go back to Tab A and I'm logged in.

Here's the problem: A hacker sitting next to me see's me type my email in to Fast.co or some site that uses Fast login. They type my email in too. I get two emails with Login buttons. How do I know which one logs me in and which one logs in the hacker? If I click the wrong one, the hacker gets a cookie on their machine that gives them access to my account for 30 days.