On the surface yes. In practice, it's more like email + whatever kind of security system your email provider has set up to verify its really you. I.e. try to l

On the surface yes. In practice, it's more like email + whatever kind of security system your email provider has set up to verify its really you. I.e. try to log into a gmail account from a new machine in an unfamiliar location, even if you know the password and can receive SMS codes. So right now, I'm more worried about getting locked out of a mail account than that someone else could take it over. As for unencrypted SMPT, there is SMTPS [1]. I'm not sure if this seever supports it, but I'd assume it would be a basic requirement if you want to communicate with real-world mailboxes and not instantly flagged as spam. [1] https://de.m.wikipedia.org/wiki/SMTPS https://de.m.wikipedia.org/wiki/SMTPS