Hacker News Reader

Still doesn't answer my question. It won't let me turn on 2FA without giving them a phone # that can be used (SMS or voice) to authenticate, which means anyone that can redirect my phone or capture my SMS messages (both fairly trivial in a targeted attack) can bypass 2FA.

View on HN

You have to just do that once to activate 2FA. Once activated, switch to mobile app. No one can turn it off without having code and password later. (apart from finding some flaw in system)

Even if they could duplicate the SMS at that moment, you would still be protected if you use the app.

Reply on news.ycombinator.com