When speaking of E-Mail as a user authentication method, it's just as unsecure as SMS.
I'd heavily disrecommend the author's method of sending 2FA codes unencrypted through the internet.
While it is an unlikely attack surface for private hackers, it is a very likely attack scenario of state level actors.
Also: gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer.
Technique described here - http://sriku.org/blog/2017/04/29/forget-password/
... basically when use provides email to signin, a cookie stores a part of the token while the server send the other part via email. Both parts need to be put together and validated for a login to get through. So the link sent in the email will work only in the browser session where the cookie stored at login time is accessible ... which is how it is configured for most of the users of my small site.
Another side effect of this technique is that bad login attempts do not need a database hit to be rejected.
That said, if an attacker had persistent access to your email, you’d still be compromised through this method.
Hu, yes they are. I don't think there's still non ssl mail transport nowadays.
> gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer.
Interesting how a grammatically correct English sentence can have 0 meaning.
You might be off by 10%, unfortunately, but let's hope that 10% is just spam or other non-sensitive data.
I think you need to read more about how asymmetric cryptography works.