Okay, this is a real problem. That said, I think there's some tendency here to view security as binary: secure or not secure. In fact, SMS 2FA is far more secu

Okay, this is a real problem. That said, I think there's some tendency here to view security as binary: secure or not secure. In fact, SMS 2FA is far more secure than single-factor authentication with only a password for most users. I generate strong, unique passwords[1] for every site and store them in a password manager[2], so I have fairly strong guarantees that my passwords aren't likely to be broken. But how many users do this? I'd guess that the average user still makes at least one of the following mistakes: 1. Using the same password for their social media account, their bank, and Joe's totally-not-a-password-collection-scheme website. 2. A password containing a combination of names, birthdays, favorite quotes, or something similar which is easily broken through social engineering. 3. Short passwords with low entropy that are easy to brute force. 4. Back up authentication methods such as security questions or personal information which are basically passwords, but unchangeable and used by many sites (best friend in high school, mother's maiden name, SSN). Passwords, as they are used by average people, are extremely, extremely insecure, and the fact that SMS 2FA is insecure for completely different reasons means that the combination of the two provides a real improvement in security over simply continuing to use single factor auth methods. I'm not saying that we should keep rolling out SMS 2FA as if it's the best solution. But if a company rolls out SMS as a second authentication factor in addition to passwords, we should at least thank them for improving security before asking for better secondary factors. If all we do when we see SMS 2FA is complain to the company without recognizing that SMS 2FA is better than what was there previously, it sends the wrong message: that security-conscious consumers will never be happy and it's not worth catering to them. [1] http://world.std.com/%7Ereinhold/diceware.html http://world.std.com/%7Ereinhold/diceware.html [2] https://keepass.info/ https://keepass.info/