"Companies should not let account recovery happen over SMS, they should just let the accounts be completely and irrevocably lost." The position of the post is

"Companies should not let account recovery happen over SMS, they should just let the accounts be completely and irrevocably lost." The position of the post is just rigid absolutism that has no chance of surviving the real world, and it's not at all clear that the author actually has any expertise in the subject. It should be completely obvious that password + SMS 2FA is better than just a password. And while the industry has been trying hard to get people to move away from SMS 2FA (yes, the industry would actually like that, despite the author's conspiracy theories), it is slow going. TOTP has horrible ergonomics and doesn't permit passing side-channel information about what exactly is being authorized. Emails get caught in spam filters. Push-notification style app authentication is secure, but a lot of people will refuse to install your app unless you're like their bank. Yes, SMS isn't the best form of 2FA for a bunch of reasons. Sim-swaps honestly aren't one of those reasons. But they are the form that you can actually get people to use, and succeed in using. Ah, but what about single-factor SMS, you say (unlike the author, who doesn't seem to understand the difference). Again, consider the alternatives. If you don't allow for account recovery over SMS, what is your account recovery story? Human customer service will just be socially engineered as easily as the mobile operator was. TOTP seeds, recovery codes, etc can be irrecoverably lost. Phones with authentication apps can be stolen and fail to be bootrapped again. Email accounts or IDP accounts can be lost to hijackers, and are also frequently lost when people change jobs, graduate, etc. Security questions can be stolen and brute-forced. SMS has a unique property that makes it invaluable as a recovery factor: it's a globally accessible communications channel that can be bootstrapped from just your real-world identity even if lost. That said, allowing SMS for account recovery does carry some security risks. They can be managed or mitigated by e.g. require a cooling down period, during which the account owner is notified about the recovery attempt and can cancel it. But like everything in this space, those mitigations are also tradeoffs. Which tradeoffs are the right ones depends a lot on what the account is for, there's no one-size fits all.