But they are also leaking your phone number next to your keystrokes, so 2FA based on text messages is also broken. (To attack/reroute SS7, the subscriber number

But they are also leaking your phone number next to your keystrokes, so 2FA based on text messages is also broken. (To attack/reroute SS7, the subscriber number is all you need – which isn't much of a secret, but mostly public data, anyway.)