Hacker News Reader

vanguard_u2fon Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U2F Security Key [pdf]

That's my point. Adding an SMS number to your account reduces the security of your account to one-factor SMS authentication.

vanguard_u2fon Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U2F Security Key [pdf]

I compromise your SMS. I initiate password recovery, and tell Vanguard "I forgot my password -- but look! It's still me! I can receive SMS challenges!"

vanguard_u2fon Why Johnny Doesn’t Use Two Factor – A Study of the FIDO U2F Security Key [pdf]

Vanguard requires you to enable fallback SMS 2FA before you can enable U2F, which results in a net decrease, rather than increase, in account security.