I haven't been following what these are or why they're flawed. It looks to me like they're taking Two Factor Auth, and removing one of the factors (the password). Now all you need is a device? If the device is lost or itself compromised, isn't that still a single point of failure?