I wonder about a scheme using public key encryption where a scannable code (public key of the pair) is displayed on the log-in screen, where one has an app on a phone that can match it and send an authorization to the site for login.
Moves the complexity to unlocking a phone and starting an app.
Moves the complexity to unlocking a phone and starting an app.