I'd still prefer password+2fa+backup codes for email.