18 min read
SMS for 2FA: what it's still good for, and what it isn't
SIM-swap risk is real; so is the customer who will never install an authenticator app. An honest matrix of SMS OTP against TOTP and passkeys — plus the attack that shows up on your invoice instead of your incident channel, the network APIs that turn a phone number back into a useful signal, and why the recovery path decides your real security level, not the login screen.
securitysmsarchitecture