Hacker News Reader

Password plus email is one factor. So that would be 3/2 factor auth.

Email reset isn't any different than a magic link. Adding an additional password option for login only lowers the security.