[Johngibb]

wouldn't oauth (by gmail perhaps?) be a better solution to this?

[Cushman]

It is oauth for all intents and purposes— a third party (your email server) authenticates you as the owner of the email address and passes you a secure token.

It's worse in some ways (control, usability, security) and better in others (simpler technologically, everyone has it).