Which is why sms-based 2fa is useless if you’re being targeted by a motivated hacker. If you’re an important person (e.g. a government official, an exec on a big corp, a celebrity, etc) it’s not safe to use sms-based 2fa. Heck, even if you’re nobody, a hacker might decided to target you anyway to access the company you’re currently working at, or because you have something they want (e.g. a desirable Twitter handle). One call to your cellphone carrier to complain about losing phone, with some social engineering skill to dupe the minimum wage call center worker who doesn’t really care about being vigilant, and suddenly the hacker gain access to your cellphone number (doubly easier to with e-sim) and thus your sms-based 2fa.
Which is why sms-based 2fa is useless if you’re being targeted by a motivated hacker. If you’re an important person (e.g. a government official, an exec on a big corp, a celebrity, etc) it’s not safe to use sms-based 2fa. Heck, even if you’re nobody, a hacker might decided to target you anyway to access the company you’re currently working at, or because you have something they want (e.g. a desirable Twitter handle). One call to your cellphone carrier to complain about losing phone, with some social engineering skill to dupe the minimum wage call center worker who doesn’t really care about being vigilant, and suddenly the hacker gain access to your cellphone number (doubly easier to with e-sim) and thus your sms-based 2fa.
TOTP or hardware based tokens ftw