Let's Ban SMS 2FA

This is news to me. I worked in the wireless industry and our phones were encrypted and this was in the 90's, albeit GSM encryption which is weak by todays standard and also routing over SS7 which is not encrypted but that is a different set of problems. Are we saying that we have gone backwards and phones are no longer encrypted or is this specific to people using LTE-over-wifi and the people at risk are in a coffee shop? That sounds like a LTE-over-wifi problem that needs to be addressed if so. A mitigating control could be a trivial update to cell phone's to prefer LTE over wifi for text messaging or to disable texting over wifi until the protocols have been fixed to properly accommodate shared wifi. LTE over wifi uses a VPN so I am not sure what is going on here. If this is a real issue then lets address that issue. Either way I do not use shared Wifi. I have more of an issue of text messages being routed through Google by default which is extremely problematic in that it brings both SS7 weaknesses and advertising company vulnerabilities.

Perhaps I am the odd one out here and my reply won't apply to anyone else on HN. I know I am not alone however as many in my community share my beliefs and methodologies. I do not use passkeys and will not as my devices are ephemeral. If anything my dependency on cell phones and data-persisting devices will be diminished sooner than later. I tried out smart phones and I hate them. I am going back to a dumb flip phone. Hardware tokens are also problematic as most companies do not want to spend the money on either the hardware or the support costs to maintain them. For desktops I iPXE or sometimes USB boot a default image and then copy down a few config files. Honestly I just don't log into things over my phone and will not. Nothing is that important and almost everyone I do business with I can either walk into their brick-and-mortor business or I can use a desktop PC with a secure password manager at my leisure. I honestly prefer to walk into a business so that all the employees know me and will know if someone is up to no good. All but one bank account is read-only from the internet and I keep very little in that one account and outgoing ACH transfers are blocked.

usually not. The problem with SMS 2fa is that once a company can do it is almost always easy to social engineer them into resetting the password based on only being able to pass the SMS 2fa... which is a big problem because SMS 2fa has no security against a moderately committed attacker.

The only way you can protect yourself is to refuse to give online services a phone number.

I dispute that position. Almost universally "SMS 2FA" can be used as single factor "recovery" and it is unambiguously less secure than a single simple well selected password.