Hacker News Reader

Or if someone loses their phone then there’s a window of time where an attacker can just pop in their sim.

You need both the password and the phone number, so compromising the phone number via social engineering still requires the password, and thus can't be less secure than just requiring the password.

That's… why it's called two factor authentication? Or are you suggesting they'd let you reset your password with just the phone number?

It also supports TOTP codes.