This exact topic came up by chance at the lunch table today (I work at Stytch, we do auth). SMS as a primary (or frankly even as a second factor) is fraught. B

This exact topic came up by chance at the lunch table today (I work at Stytch, we do auth). SMS as a primary (or frankly even as a second factor) is fraught. But as comments in this thread call out, they can be incredibly smooth UX for end users on mobile devices. And in fact, for some user bases, far and away more ubiquitous than emails. There are many populations that just don't have email to serve as a primary factor, but do have phone numbers. So it's a nuanced topic. Everyone, both users and developers, need to have eyes wide open to the danger and protect against it. And let's not forget the telecoms, they need to recognize that the phone number serves as a primary login factor and treat it more carefully. That might mean in person or stronger identification requirements on changes.