All non-PK cryptography eventually boils down to a 'password' if you call it that. But this isn't a password, it's a shared secret. Which IS a good solution (n

All non-PK cryptography eventually boils down to a 'password' if you call it that. But this isn't a password, it's a shared secret. Which IS a good solution (not GREAT, but better), it just shifts the problem into communicating the shared secret. This is where TOTP comes in for most 2FA implementations. This particular scheme just uses email.