1) Have users enter their email address and always use a newly generated e-mail link to login.
2) Give the user some data like a nursery rhyme that is unique to them and easy to memorize. Every time they want to access the site you ask them specific information about their nursery rhyme without revealing all the details of it.
Example: Seven Goats Hopped Seven Boats With Only a Spoon to Spare.
You could ask them "how many letters are in the last word of your rhyme, how many goats were there?" ... stuff to that effect.
Personally, I really like the "email me a link" approach because it requires the user not learning any new passwords, although it is not as immediate for something like an admin page. That's the method I'm using for a website I'm developing.. so it's yet to be tested in the field.
There are some promising projects using "select all the right emoji (or equivalent tiny symbols) that make up your password" and the whole grid changes colors/shapes/arrangement every time you enter a "digit"
Some sites request certain characters of your password, which I find just slightly better than asking for the full password, but extremely more annoying for the user. Can't see the advantage of the riddle, seems to be the same approach.
Also, if I have to remember a different nursery rhyme from every website out there... well, I'm sure you see the issue here. Not to mention these rhymes -or the correct answers to the related questions- would have be stored in plain text (or actually reversible encryption) at server side, instead of a hash of the user's password.
If you want to stop a passive observer, you need to turn to encryption... but then you are back where you started.
After an inital setup it should login the user automatically.
Also, the email can have pre-built email link with the text and aprropiate sender written so that one just click it and send.
Consider like a command-line app running (actual stuff you do after login) along with a separate command center (your email), so that you could do queries about your account like who are logged in, logout everyone, or are there any pending notifications, and even is the service properly running?
But yes, people today dont like to do anything other than clicking buttons, so only geeks would be impressed with this.
