Passwordless/QR code login

Just because the capture isn’t exact, biometrics are always a secondary form of authentication. Even if you don’t know the associated passphrase the biometric input has to be matched against a recorded entry and a token/key/password sent across to the target system.

You can already use FaceID or TouchID today for authentication by using a password manager such as 1password. That has to be the strategy too, nobody wants their biometric data to leave their device, this is precisely why Apple has their “secure enclave”. In iOS12 password managers can already expose their data directly to safari, no need to open another app each time you want to sign in.

The notification step isn’t really necessary if you’re on a device with a camera, or are willing to enter a displayed passphrase onto your mobile device. By entering your username (something you are) and then scanning a code or entering the displayed code onto your device (something you have) you close the loop. Notifications are a good integration for 2FA, but beyond that there are all kinds of places where they can break down.

It doesn’t really answer the question as to why this is necessary though. Whatsapp can be used without an email address, so can’t send a sign-in link via email - that’s the problem they needed to solve. You could equally solve this problem by sending an email to the mobile device with a clickable link which confirms the session on the desktop PC.