I develop a sort of social network for mobile and desktop browser with a REST API.
I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/Firefox support it natively now).
I don't want to ask a password because the majority of users uses the same password on multiples websites. So it's easy to hack a weak website, that may be store in clear text the password, or hashed but not salted and to use rainbow tables to obtain the password in clear.
I need to prove identity of the user when he lost credentials, but I don't want the classic OTP link by email/sms because this open a vector of attacks (eg: I give 5min my mobile to my wife, she's not an hacker/geek but she easily have the idea to click « I forgot my password », go on Mail/SMS application (iOS/Android don't ask password) and click on the OTP link to reset my password and be connected on my account. )
I don't want to ask on registration some personnal questions/answers, because your wife/family/friends could generaly answer, because it's a privacy leak, and because the user don't always remember the exact words/syntax used.
I search a user-friendly way to resist to theses attacks. ( So please, STOP to tell me to use a scheme exposed to theses attacks! ).
I have a scheme suggestion, most experts here doesn't like to think about new scheme, but all existing schemes I known don't solve theses attacks :(
My question is simple: is my scheme is less secure than the 99% of websites exposed to theses attacks and if the answer is yes, please tell me how you could attack my scheme ?