It’s time to stop using SMS for security
So, I work in telecom and dabble a bit in software.I don’t understand the hatred for SMS 2FA on HN. Can someone explain to me why SMS is such a bad method comparative to other solutions where the practical user adoption is near impossible at scale?At some point, software is going to need to bend to the way people work. When does that happen instead of obsessing over ubiquitous “zero trust”.I’d love a parable of how using SMS as part of a layered security verification is somehow unacceptably vulnerable.