This is why security keys, not SMS, is the proper second-factor authentication. (App authenticators are better than SMS but still prone to phishing). Some young one may well have walked into a store saying “hi, I’m Jack Dorsey” with a fake-crap ID and got away with his account. https://t.co/PR0VPT4y63

— zeynep tufekci (@zeynep) August 31, 2019