These URLs are exposed in all sorts of places; browser history, proxy servers, web server logs and ISP gateways to name just a few. Never put secrets in URLs and expect it to remain secret.
Here's an objective suggestion - put the proposal over on stackoverflow.com and see what response you get.
First, it's ssl only. Second, the alternative (which I'm trying to avoid and where this idea came from) is a user being prompted for a password and responding something like "er, um... Password123" or just using the same password they use for everything else
The idea was that this may give users a bit more time to think about passwords, and possibly be more secure than the usual passwords. Stating the idea here is giving me some good things to consider
Not that I'm advocating this as a good authentication solution, but the worst sorts of exposures you list (i.e. the ones that aren't restricted to the authicatee's device or the authenticator's server) don't apply if you use SSL. Which of course you do.
These URLs are exposed in all sorts of places; browser history, proxy servers, web server logs and ISP gateways to name just a few. Never put secrets in URLs and expect it to remain secret.
Here's an objective suggestion - put the proposal over on stackoverflow.com and see what response you get.