This is specifically bad if that 2FA was via SMS and as the attackers are supposedly notorious for such SIM-swap attacks[1]. I'm not telling TOTP or hardware t

This is specifically bad if that 2FA was via SMS and as the attackers are supposedly notorious for such SIM-swap attacks[1]. I'm not telling TOTP or hardware tokens are invulnerable, even SecurID was compromised[2]. But having SMS as only means of 2FA is not even trying to be secure IMO, especially in India where everything from our Unique ID to Bank Accounts are dependent upon SMS OTP. I've been asking the Banks to implement TOTP in vain. [1]https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e... [2]https://arstechnica.com/information-technology/2011/06/rsa-finally-comes-clean-securid-is-compromised/ https://arstechnica.com/information-technology/2011/06/rsa-f...