Post History

I realize that this might be a bit of a niche use case, but I'm going to put it out here anyway.

The availability of 2FA via an authenticator app is a great boost to account security.

However, there are still people who don't have smartphones, or who might not be willing to tie their smartdevice to their account here for some reason. For a not *entirely* unreasonable example, their smartphone might be a work-provided device where policy restricts what it can be used for.

I don't expect that this would be at the top of the list of priorities by any means, but since Codidact can already send e-mails (see for example the subscription feature), would it be possible to have **second-factor authentication via an e-mailed one-time code?**

I imagine that when set up, after successfully authenticating with one's password, an e-mail would be sent to the address associated with the account, containing a short code that must be entered before being signed in, and that this would happen each time the user signs in (not just when the attempt looks "suspicious" according to some metric – I suspect this would make the feature easier to implement).

Having that would mean that an attacker would need to gain access both to one's Codidact credentials, as well as one's e-mail account; *and* that such access would need to be ongoing (unless the attacker turns off the sign-in code requirement, which the legitimate account holder would notice no later than the next time they sign in and *aren't* prompted for a code).