Tell HN: SMS can be used to bypass Sendgrid’s 2FA

a while back I visited one of those 'send a 2FA code to you via SMS' websites and, not noticing the SMS bit, I entered a 2FA code from my phone's authenticator app as the number I'd been sent by SMS --which worked to let me in.

When the actual SMS 2FA code arrived on my phone a few mins later [crap phone signal here] I noticed it was the same code. So it seems like at least one site is just forwarding you the same code your authenticator app would generate, as an SMS. I'm not sure of the security implications of that --if any.

I've also noticed that, quite often when I check verious bank and credit card accounts, one after the other, the 'please enter the Xth, Xth, Xth and Xth numbers from your security code' prompt is asking for the same numbers, on each bank's site. Which strongly suggests a load of separate banks are using the same centralised security prompt generation --which sounds like a bad case of 'single point of failure' to me.

The more cynical reason might revolve around getting access to your phone number, but we’ll give the benefit of the doubt and say that’s not the case.

In my opinion, websites offering 2FA should give users a choice to pick between: - Security Key (with Backup Codes you can store offline or SMS) - Authenticator App (with Backup Codes you can store offline or SMS) - SMS - No 2FA

If I want to choose a less secure method for 2FA or backup codes, that should be my choice but clearly communicated.