[ceejayoz]

Good. E-mail based 2FA is bad, and they appear to support TOTP too as an option, as they should. Wish they supported U2F though.

[ipaddr]

Why is email based 2fa bad but phone good? There are classes of issues you get through phone 2fa compared to email

[ceejayoz]

Typically, you can also reset password via email, so it's really only one factor. Compromised email = compromised server.