Comment by FireBeyond
7 days ago
> Email OTPs, notably, aren't 2FA by definition, since your Email address might be only password-protected
What? 2FA is something I have, something I know. I know my password for your web app, and I have access to a separate account. It's not a recursive 2FA, "it's only 2FA if one of the factors has its own 2FA".
The "something you have" means "something you physically possess and can't be copied". Logging in with username, password and an email OTP is 2-step authentication, not 2-factor, as multiple people can have access to the email account from different places at the same time.