@ryo @thanius @charliebrownau Keep in mind that 2FA literally just means "you use two different things to prove your identity". This is meant to be "if you cannot do both, you are not approved", but in practice tends to mean "whatever is considered the 'secondary' can be used to reset the 'primary' in an insecure way, also it is fundamentally insecure" - but this is not an inherent aspect!