Oof. I honestly don't know which is less secure: SMS or e-mail confirmation. Probably the former, but the latter is probably easy to downgrade into plaintext, a

Oof. I honestly don't know which is less secure: SMS or e-mail confirmation. Probably the former, but the latter is probably easy to downgrade into plaintext, and can/does does go through random middle boxes. You can add mitigations all over the client but I'm not aware of any requirement for strong authn+z in the protocol. As a second factor, SMS is better, unless that 2FA e-mail is allowed to be different from your primary e-mail, and you only every sign into it from your phone.