if they are sending you random code, through email or sms, that is 1fa authentication that can be intercepted - through some malware in your computer or phone and it directly beats the purpose of having 2fa.
This feels like you haven’t seen 2fa in the past ten years or so. The codes are given to the user on the site during the 2fa setup, they aren’t sent via any of those channels that the user has lost in the first place leading to the recovery procedure.
I get it that recovery codes could be leaked just like passwords, but not sure what you mean by ‘easily intercepted’.
if they are sending you random code, through email or sms, that is 1fa authentication that can be intercepted - through some malware in your computer or phone and it directly beats the purpose of having 2fa.
This feels like you haven’t seen 2fa in the past ten years or so. The codes are given to the user on the site during the 2fa setup, they aren’t sent via any of those channels that the user has lost in the first place leading to the recovery procedure.
oh, yes, i misread that part. so it is basically password that was on post it note somewhere in your drawer for who knows how long? well that is safe.