The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the ri

The problem is scope. TFA is nice. Maybe mandatory when you're providing a service that passes a certain threshold? But that permission obviously isn't the right answer. FB should ask for permissions to read _all_ SMS to make TFA via SMS a tiny bit more comfortable? No. TFA solutions exist. Google Authenticator (I wouldn't trust Google with anything, but that's "open" as far as I know) or the Yubico aequivalent are perfectly fine choices for T/HOTP. If you want to send SMS instead (why??), let the user enjoy their platform's copy/paste support to give you the code. There is not a single reasonable argument, why Facebook (or.. any. Seriously: I cannot think of ONE reason) should be able to read your text messages. Bringing up TFA is probably (hey, not my native language, I certainly never joined a debating group or whatnot) a failure to argue the point and has a nice latin name or something. Maybe about a true of false Scotsman or what do I know.. If I say "FB shouldn't read texts" that has no relation to "FB should not implement TFA". Nor is it reasonable to imply that they cannot, without that permission.