[markdown]

> stop using a broken protocol and enforcing the use of phone numbers as an identification for critical information or banking, there are better

There are no better ways for the average human (who doesn't have a clue what 2FA means but can understand being sent an SMS and using the code in it to access an account).

[paulmd]

Authenticator tokens are absolutely passe right now, there probably is single-digit percentages of people who don’t have at least one Authenticator code on their phone.

And for the handful of people who just don’t have a phone… RSA/Duo tokens exist for a reason.

SMS allows a whole class of additional attacks, it’s a terrible system and should be removed.