To quote the article, this is how it works:
Here’s how passwordless authentication works in more detail:
Instead of asking users for a password when they try to log in to your app or website, just ask them for their username (or email or mobile phone number).
Create a temporary authorization code on the backend server and store it in your database.
Send the user an email or SMS with a link that contains the code.
The user clicks the link which opens your app or website and sends the authorization code to your server.
On your backend server, verify that the code is valid and exchange it for a long-lived token, which is stored in your database and sent back to be stored on the client device as well.
The user is now logged in, and doesn’t have to repeat this process again until their token expires or they want to authenticate on a new device.
So what do you guys think? Is this really a realistic alternative to password-based authentication?
As it has been stated, getting your phone stolen, gives potential access to your emails and SMS, which would compromise this system. But that would also be the case with password-based systems, where you can click the "Forgotten password" link to receive the email to change the password, and could also have installed Google Authenticator. So, in my opinion, having the phone stolen is a weakness for BOTH password and password-less systems.
Maybe the question should have been:
Do password-less authentication add risk scenarios that aren't present in password-based authentication systems?