3 ms·
Without a time machine, there is no way OP could have predicted their recovery email would eventually be used as MFA.
by pid-1 4y ago
Without a time machine, there is no way OP could have predicted their recovery email would eventually be used as MFA.
- olliej 4y agoYes, as I said it's not reasonable from the end users perspective, but having done so, allowing username+password to bypass the 2fa isn't possible. It is dumb, what they should have done is notified the user that they needed to set up some form of 2/MFA, not choose random value from profile to become one.