> You only need an email account and whenever you want to login you get a one-time code to your email address

And what if you lose access to your e-mail? It happened to me a few times and I couldn't log in to various services since their login flow required a 'magic link' sent to my e-mail to login.

A key technical hurdle is that companies need to adopt FIDO2 / WebAuthn standards.

There’s also a user experience hurdle where people claim to feel safer with a password or with MFA.

It’s a combination of technical & messaging.