Why do we have passwords? I mean, ok, I know why, but he mentioned he's just going to enter random gibberish and then use the recover password links when he needs to log in to sites again. Why don't any sites, as an option, cut out the middleman and just have an "email me a login link"? No need to save a password at all, just a good for a single login link and the usual session tracking.
You don't store passwords on your inbox, do you? The reason is that if someone has access to your email, then you are screwed. Same applies with what this guy is proposing: I find your email password, I change it and you are screwed.
But sites that provide an "I forgot my password" already have this vulnerability if they don't ask for any further information to recover your password. Many sites don't. If someone has access to your email, you're already just as screwed.
Sites that do ask for extra info (Mother's maiden name type of thing) are protected against this, but there are an awful lot of sites that never ask you for anything but an email address and a password when signing up.
Those are the sites who are not doing their job properly and there's no reason to adapt to their solution. Getting rid of passwords tout-court may seem convenient but it's really bad for security.
You wouldn't even need to make it only work for a single login. Let it live for a year or forever. Automate the bookmark procedure for them as well, so their bookmark for your site (https, of course) would automatically log them in, as it would contain a very large random string that identifies them. For extra points on sensitive sites, tie that random string to their IP address, so it only works from the IP address they were at when they first clicked it. If they click it from a new IP address, an email is sent, asking permission to whitelist that IP address for them as well.
I've worked with systems that used USB tokens with X509 certificates for authentication and the tokens still required a password (as with Chip-n-Pin cards).
The "something you have" only really works as an additional authentication factor to the "something you know" of the passwords.
Certainly not me. I had to tie it to my shoelace when I was going for a run, as my running shorts don't have pockets. Now, of course, as technology has caught up, I bought a lock from Home Depot that allows me to just remember a combination and not use house keys. Much nicer.
Sure, it's clearly not a good idea for every site. But for things people treat as throwaway already (like gawker logins), why not? It doesn't seem like it's any less secure than things are now, especially if, as the author proposes, you're going to purposefully not remember your passwords and always use the recovery links.
Email is not universally reliable enough for that to be practical.
If you leave browsers logged in, it might be a little more so, but still, I want to log in now. Not in a half an hour after the email works its way through my company's spam filters.
