WE REPLACED PASSWORDS WITH SOMETHING WORSE

Summary from the TLDR Web Dev newsletter

The increasingly common login method of using a 6-digit code sent to an email or phone number isn't a good thing. It's bad for account security because it makes users vulnerable to attacks where they unknowingly enter codes prompted by attackers. Password managers cannot protect against this type of phishing, leaving users exposed.