On: SIM swap horror story: I've lost decades of data a...

[mikeash]

SMS 2FA is fine. 2FA adds another layer on top of your password. The second factor doesn’t have to be particularly secure to make you safer.

The problem is SMS account recovery, which is a really bad idea.

[Shank → mikeash]

> The problem is SMS account recovery, which is a really bad idea.

The problem is that a lot of services tie the two together. Often one implies the other. Even if it doesn't, though, it's also easier to social engineer -- "look! I have access to the 2fa phone number! I just can't access my password manager!"

[saurik → Shank]

Companies do that, but they shouldn't call it 2FA at that point as it is no longer a _second_ factor: it has become the primary factor.

[fastball → Shank]

I'm not sure I've ever seen SMS account recovery.

[tpetry → fastball]

Google has sms account recovery.