Hmm, it "feels" insecure to me, but thinking on it, I'm not sure why, especially since most email is web-based these days, and pretty much all the rest goes over encrypted IMAP/POP/Exchange.
What concerns do you have?
What concerns do you have?
Plus, having someone access your email account means you're pwned anyway - they can see your sensitive documents that were received / sent as attachments, they can read recent conversations and phish information, maybe even ask for a downpayment, etc.
So the basic rule should be: don't lose access to your email.
That doesn't mean that email-based login is good, just that IMO this point is kind of moot.
Also, do email-based login flows allow 2FA?
Of course, combining email-based login with another factor makes it more secure again, I was just talking about one factor.
As, what about web-based email systems that enforce 2FA? Isn't that a good mitigation?
Any other issues you see? (genuinely just curious, I don't mean to needle you :)
I use Sendgrid to send the email and have had no issues with the service so far.