absolutely this. for most services i WANT to be able to recover access with only my email address. if i forget the password for a service, then most likely i al

absolutely this. for most services i WANT to be able to recover access with only my email address. if i forget the password for a service, then most likely i also lost whatever additional security codes i have been told to save somewhere. i have half a dozen backups of all the ssh keys i use because i am scared to loose them. the chance that someone gets access to one of those backups is probably more likely than them breaking into my email. ok, they would still have to find the password for the ssh keys. my point is that the risk to loose something that i can't keep in my head is greater than such a breakin. when i set up 2FA for github or gitlab i am going to plaster that 2FA app on as many devices as i possibly can to mitigate the risk that i would loose one of those devices which could permanently lock me out. how likely is it that an attacker can take over my email? they would have to break into my laptop, and take over my browser and break into my mail server. or they would have to spoof the DNS for my email domain. are there any threats i am missing?