In our PHP web application we have included Two-Factor authentication. Users have a one-time secret key generated which they then enter (or scan a QR code) into the Google Authenticator app.
The authentication is time based, so a new token is generated by the Authenticator app every 60 seconds, and this token must be entered when the user attempt to login to our app.
This is all working perfectly fine, however when a new user is added to our system, their secret token (and associated QR code) is emailed to them first time around.
Furthermore, just like we have a "forgotten password" facility to reset a user's password via email, we're thinking of having the option to re-email or reset a user's Authenticator secret key (for example, if a user's phone gets destroyed and replaced with a new one, and they need to set the app up again).
However, I haven't found any real-life examples of being able to send or reset a Two-Factor authentication secret key via email. Is it a cardinal sin to communicate this information via email and should it be done some other way?
As well as the Two-Factor authentication we have a range of other security measures (password, access to the system locked to IP address, alerts when new/unrecognised web browsers login to the system, etc) if that makes any difference.