> But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. Sure, but tha

> But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. Sure, but that is not 2FA. It's 1FA. They could have used e-mail as the recovery mechanism to send a password reset link, then it still would have been SMS 2FA if they then required the SMS factor upon authentication and it would have been secure. This wasn't a problem of SMS 2FA, it was a problem of SMS based account recovery.