I see this advertised Medium post about building a React application with passwordless authentication through Auth0.
from the link, here is the explanation of how it works:
Passwordless authentication, as the name might imply, is an authentication system where the user does not enter a password. Instead, they provide an identifier such as an email address or telephone number, and the authentication system sends out a one-time passcode or link to this identifier that the user must then provide or click to successfully authenticate. The passcode or link is active for a limited time, often around five minutes. Each login request generates a new passcode or link and invalidates any previous passcodes or links. In a sense, passwordless authentication also provides two-factor authentication out-of-the-box, since a user must have access to either the email account or phone number they provide.
They also state that passwords are obsolete and insecure because people choose weak passwords and reuse them.
But here one asks Who watches the watchmen?
Since your email account is protected by the obsolete and weak means of a password, the passcode or link is not safe at all, is it? Someone just needs to crack your email and they get access to your application with Auth0 authentication.
Am I wrong?