Interesting !
A few questions (and sorry for maybe the silly questions) :
* In the gist, it's mentioned that the secret is stored in the Session Local, a secret is supposed to be reused, right ? But with session Local, the secret will be deleted after each session, did you maybe mean Local Storage ? Or does the secret is passed at each new session (which feels strange...) ?
* If the secret is stored on the browser and can an user login on this webapp when using another device (has to register again) ?
* The secret is passed over the network the first time, isn't that dangerous ;) ?
* Option 4, with behind the scene flow, avoid the users to switch between an OTP and a login screen, right ? That seems a nice option
Sebi