SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks.
2-factor as an idea is great, and this author seems very confused.
2-factor as an idea is great, and this author seems very confused.
It’s a one time thing at account creation and should be immediately deleted afterwards.
Real 2FA should be set up afterwards to actually protect the account. A yubikey or even a simple TOTP app is a lot of protection against account takeover. The only big weakness left at that point is the help desk.
This is only very marginally more effective than SMS. Phishing is way more common and can be automated much more easily than SIM-swapping. With TOTP you close a small window but leave the big door open.
Yubikeys prevent phishing, which is enormously valuable.