Email is considered insecure as a 2nd factor. TOTP stands for Time-based One-Time Password. Usually you store a seed and that combined with the time generates a time based password. If someone intercepts it, it's only valid for a certain time frame (I think about a minute or so), after which it's invalid.

[–] RamenJunkie@midwest.social 5 points 1 day ago (1 children)

Just to add, SMS is also incredibly insecure as a 2FA

[–] KairuByte@lemmy.dbzer0.com 1 points 12 hours ago

Arguably less secure than email.

[–] moseschrute@lemmy.world 3 points 1 day ago

Yes but email is only a second factor when used in addition to a first factor (e.g. password). If it’s just magic link without password, then email is the only factor