I came to this post late but this is a terrible idea simply because of email. Now if you said push notifications to an app, Duo does this already and it's great

I came to this post late but this is a terrible idea simply because of email. Now if you said push notifications to an app, Duo does this already and it's great. I have personally logged into people's accounts simply by opening links sent in an email. It is routine to inspect URLs and attachments in emails, email is not confidential. Period. You mentioned slack does this? Alright then, search for similar URLs in virustotal or any other public malware or spam URL repository and tell me how many slack accounts you can login to (assuming someone started the login and did not finish). It's not just man in the middle attackers but many othet han and automated processes inspect email at most larger organizations. I remember someone claiming an email security appliance vendor was "brute forcing" them,turns out they mass-emailed something with their URL in it and the appliances at different companies were detonating the URLs in different virtual environments to see if they cause anomalous behavior. You can substitute 2FA with signal,telegram,matrix,push notification and I personally would have no problem with it.