Removing 2FA from existing accounts is never an improvement in security. As other replies on this post have noted, having SMS as 2FA is always better than not h

Removing 2FA from existing accounts is never an improvement in security. As other replies on this post have noted, having SMS as 2FA is always better than not having 2FA. Heroku is actively harming their user's security by removing 2FA from user's accounts. Some users will not set up a new 2FA method on their account, leaving their account vulnerable to password attacks.