Why is using SMS bad for 2FA?

I have read in a few places that using SMS is really insecure for 2FA. A few people on this thread (https://news.ycombinator.com/item?id=29004930) also said that SMS should be avoided as the 2nd factor.

What are the security vulnerabilities with SMS? How common are these vulnerabilities? Have there been any security breaches due to these vulnerabilities?

PS - I am ideating on creating a 2FA method using public-key cryptography. To login, you just scan the QR code from my authenticator and enter your phone's pin or use Face/Touch ID. This uses two factors so, first it ensures that the users posses the phone and second it ensures that the user knows the passcode or has Touch/Face ID. Please let me know if you have any feedback on this idea and if this solves the problems with SMS.

Thespian2 in that thread commented at https://news.ycombinator.com/item?id=29005345 :

> SMS - it's just too easy for SIM swap attacks, and good social engineering to phish SMS codes. "Hi, this is $BANKNAME - we saw some suspicious activity on your account, so we are going to send a one-time code to you now. Please enter it back to us here to verify your identity" (scammer then uses your stolen password, tries to log in, real bank sends you real code, which you now are tricked into sending to scammer to complete their login as you).

First three DDG hits for "SIM swap attack" are https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how... and https://us.norton.com/internetsecurity-mobile-sim-swap-fraud... and https://privacypros.io/u2f/sim-swapping/ .

Here's a recent news piece on the topic: https://www.lightreading.com/security/heres-how-atandt-veriz... ("The FCC has received numerous complaints from consumers who have suffered significant distress, inconvenience and financial harm as a result of SIM swapping and port-out fraud".)

SIM swap is not a problem in other developed nations where everyone is using a government ID. Still SMS based 2fa has many other problems.

SMS is not a great form of MFA but in many cases it is the only option and better than nothing assuming it was implemented correctly, being one of multiple factors and is not a stand-alone factor. Someone will suggest U2F, but most financial institutions don't even know what that is much less have any plans to support it. This will sound negative, but sadly my login to a video game is more secure than my login to a bank and I do not see that changing in my lifetime. I would love to be proven wrong. For now I have set most of my bank accounts to read-only meaning I have to go into a branch office, show ID to do anything.

As for QR codes, those can be copied or replaced. Maybe if my bank had a QR code behind secured glass that could be used to locally on site import and pin their public certs if applications widely supported it. I will never use digital face/touch ID for anything. There are no companies or governments competent or qualified to hold that information and use it for authentication and authorization.

>As for QR codes, those can be copied The QR code are unique for every login attempt. After you scan the QR code and enter your phone's pin, my authenticator will send a request to my server. If everything is ok you will be logged in. Sorry I did not get what you mean by this? Do you mean that someone could copy and use the same QR again?

>I will never use digital face/touch ID for anything I do not save any biometrics on my server. They are stored locally on your phone, my app just uses the native system used to unlock your phone. That being said, you can just use your phone's pin if you don't like to use biomterics.