Security Analysis of SMS as a Second Factor of Authentication
SMS 2FA is weak, but it does two things: it shifts the attack from a passive opportunistic one to a targeted one, and, 2. in unionized environments you can add a second compliance factor without distributing new devices, &quot;training&quot; people to use TOTP apps, or &quot;forcing&quot; people to install an app on their personal devices.<p>That is the big cultural reason why SMS 2FA is going to be with us for a while. Sure, use TOTP and FIDO tokens for systems people, but for institutions with thousands or tens of thousands of employees, SMS 2FA is still economical and will still be with us 5-10 years from now. It&#x27;s the new passwords.<p>The smart thing would be for MSFT&#x2F;o365 to give you the option to switch to a TOTP token and other authenticators with a better experience so people can switch organically.   Most security people still don&#x27;t distinguish between  authenticators and identities, as federation concepts like identity providers are still in the rarefied space of enterprise. Identity isn&#x27;t well thought out either because it&#x27;s a legal concept, and like most tech risk and liability, if anyone read the fine print they&#x27;d never use it.<p>SMS 2FA is basically a ritual that allows people to agree to ignore risk.