* the tech industry hates SMS
* there are some common social engineering and a few network level attacks that SMS allows
* it's widely deployed and supported
* it's a heck of a lot better than nothing
I think the title of the original article is a bit absurd. That's like saying "It's time to stop using passwords for security." Sure, you can say that, but your grandma will still have a sticky note of passwords next to her computer.
Defense in depth without relying entirely on the user to secure their systems makes a lot of sense to me.
Ban SMS if you aren't worried about adoption of MFA (for example, because you are a corporation and can mandate TOTP). Otherwise find ways to work with it.
In looking around, a few things became clear:
I think the title of the original article is a bit absurd. That's like saying "It's time to stop using passwords for security." Sure, you can say that, but your grandma will still have a sticky note of passwords next to her computer.Defense in depth without relying entirely on the user to secure their systems makes a lot of sense to me.
Ban SMS if you aren't worried about adoption of MFA (for example, because you are a corporation and can mandate TOTP). Otherwise find ways to work with it.