Why not drop the email requirements? Unique username and password has worked since forever. If you need a 3rd gate, "something you have" is good enough - hardw

Why not drop the email requirements? Unique username and password has worked since forever. If you need a 3rd gate, "something you have" is good enough - hardware based 2FA (not TOTP).