> tens of millions of text messages, including password reset links, two-factor codes Many, or very nearly all?, of the places implementing this expire the tok

> tens of millions of text messages, including password reset links, two-factor codes Many, or very nearly all?, of the places implementing this expire the tokens in minutes. I'm not defending 2FA over SMS, but merely pointing out this 'feature' of the 'leaky database' is probably not all that impactful.