While I am not too familiar with how Stellar/Ripple work, I assume they are sending an un-encrypted version of your Stellar private key, or perhaps the equivale

While I am not too familiar with how Stellar/Ripple work, I assume they are sending an un-encrypted version of your Stellar private key, or perhaps the equivalent of a bitcoin master private key [1]. I say un-encrypted based on their claim that the code + username can be used to gain access; typically sites will encrypt the recovery code with your password. Based on this, I conjecture that they decided in favor of usability in the usability-security tradeoff. [1] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...