This is not emphasized enough. Many companies enable SMS both as a second authentication factor AND a single-factor account recovery mechanism. As bad as passw

This is not emphasized enough. Many companies enable SMS both as a second authentication factor AND a single-factor account recovery mechanism. As bad as passwords, savvy users can use a password manager and generate unique high-entropy passwords, but if the web site is forcing SMS on you, you lose all that security and now have to rely on vulnerable telco infra that is out of your control and was never built to facilitate authentication.