That's why everyone says "don't reuse passwords". Making something like this and calling it "secure" is misleading, at best.

This is useless as multi-factor authentication, because it turns it into single-factor authentication. Anyone sniffing a single session or seeing it once knows what it looks like, and can reuse it on any site. It's much, much weaker than TOTP/HOTP, for example.