Did we ever seriously doubt that? 2FA is just a made-up reason to have your phone number anyway, all the services that require that don't really want anything other than that.
I keep saying phone numbers for 2FA is dumb but entire industry thinks this is a good idea for some reason. The problem here is that it's not even used as 2FA, it's just one factor and these services think it's sufficient to prove identity.
All great points and very common cases, yet services that force 2FA seem completely oblivious to this or just don't care about responsible users. In instances where it must be a phone number it is obviously for data mining.
It is a lazy way to cater to the lowest common denominator of users who will eventually fall for a phishing scam or install some keylogger and have their password end up in a dump.
Agreed, 2FA is a good idea but it was never in the users' best interest to attain it via phone numbers. But when all these organizations saw an opportunity to couple a reliable phone number with what was otherwise in most cases, an account having just an email address, they jumped on it.
I think it should be fairly obvious to most here, but it bears repeating that any service which requires a phone number for 2FA is to be avoided like the plague.
Phone number is already a 2FA for regular logins in many services. The problem is their processes also allow it to used in a 1FA reset scenario, so it's not true 2FA.
Not to me, for a bunch of reasons -- starting with the fact that it assumes that the phone # you use for 2FA (which nobody should be doing anyway) is the phone # you want people to contact you through.
2FA is hell. It was forced on people to control them, not to help them. There should be a law that would forbid banks and other companies to demand a phone number. But, unfortunately, things are upside down now. :(
You know, I'm really starting to hate how 2FA, and phone numbers in general, have been hijacked into being an ID that companies just assume you have. A lot of the people who would be extremely opposed from "give us your driver's license or you can't use this service" are perfectly fine with forced 2FA - these leak the same amount of information!
I always imagined they would probably end up doing this, and that's why I've never accepted 2FA anywhere a site has tried to push it on me. They can't spam me if they don't know my number...
2FA freaks me out. It means I'll be locked out of all my key accounts and services if ever my phone breaks or gets lost. Probably right when I need these services most.
A 2FA system that requires me to give a phone number is a 2FA system that I won't use. I'm not about to give my phone number out to most companies, and I'm too lazy to go get a burner phone just to set up 2FA.
reply