It’s time to ditch SMS-based 2 Factor Auth
Approaching this a different way, this is the same problem as with passwords. If you use the same password for every site or the same phone number for every 2FA SMS, then only one password&#x2F;phone number has to be compromised for a massive escalation in privilege.<p>This problem is much easier to solve with passwords: you simply generate different passwords for everything and store them in a password manager. However, you can&#x27;t (easily) generate a new phone number for every service that requires SMS 2FA, and if you could, all the phone numbers available would be used up quickly.