Hacker News Reader

Unfortunately the vast majority of services only support SMS or email 2FA. I've set up a real 2FA app for every site I use that supports it, and that number is four: gitlab, github, discord, and my domain name provider. My bank, my utilities, my insurance, everything only supports SMS if they support 2FA at all. Most just don't.

email is not bad option, at least you can harden your email to use normal 2FA instead of pathetic SMS

Do you mean never use your phone number as 2FA if other 2FA options are not available? Most major retail banks (BofA, Chase, Citi, etc) all offer mobile as the only, if not primary, 2FA option.

Completely agree using last-4 SSN is terrible, but some light in the tunnel exists. It is possible to change it, although it is as you would expect, quite annoying: https://faq.ssa.gov/en-us/Topic/article/KA-02220