An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place. Password managers (a usual defense against phishing) can't help you either.

I don't understand. Is the email already compromised? Gmail requires 2 factor authentication via android to log into your email on new devices so there's that.

ha, yeah lets replace passwords with codes sent via fuckin email. a service with security as a patchwork of bolt-on crap that barely works and is itself dependent on other services where security was an afterthought... like DNS.

awesome!

That’s how password recovery works on most services. So if it’s any consolation, it’s not a new security vulnerability. We are just skipping the charade where I pretend to remember a password.