I'm a little confused. First, they say: > login.gov implements the latest National Institute of Standards and Technology (NIST) standards for secure authentica

I'm a little confused. First, they say: > login.gov implements the latest National Institute of Standards and Technology (NIST) standards for secure authentication and verification. Then: > Two factor authentication requires that you login with your password and a code that we send to your phone. I assume they're referring to SMS (I see references to Twilio)... but didn't NIST just recently say that SMS wasn't acceptable for 2FA? Quite pleased to read this, though: > We welcome external review of our privacy-protection measures. All of our code is available for public inspection in an open-source repository. -- https://login.gov/security/ https://login.gov/security/