Allowing users to disable SMS as a fallback after enabling an authenticator app would strengthen account security and reduce the risk of SIM-swapping attacks. Backup codes or security keys would be safer alternatives. Our https://websitely.io/auto-repair-website-design focuses on fast pages and clear calls to action. You bring in more bookings while your site handles the busy work.

I only discovered this today, and it’s absolutely appalling—I never would have thought that Twitch would handle such a critical security feature so incompetently, essentially nullifying the security itself.

Snaptroid for PC lets you enjoy your favorite Android apps and features on a bigger screen using an emulator like BlueStacks or Nox. It's popular for seamless app management, faster performance, and a more comfortable interface. Whether you're exploring modded apps or managing multiple APKs, Snaptroid on PC offers a smoother user experience. It’s ideal for users who want full control over Android apps without the limitations of a mobile device. https://snaptroid2.cc/snaptroid-for-pc/

Totally agree, fallback to SMS after enabling Authy kinda defeats the purpose of stronger 2FA
Security through obscurity doesn’t work, and relying on phone-based 2FA is risky
I’ve even used invisible text https://textoinvisible.co/ just to test how apps handle unexpected input. You'd be surprised how many systems still don’t validate things properly
Disabling weak fallbacks should definitely be an option

Encrypt sensitive data both during transmission and when stored to make it unreadable in case of a breach. https://btcbulltoken.com/

With 56.87M downloads worldwide, Roblox has become the giant sandbox in the world, developed by David Baszucki, CEO of Roblox Corporation. If you are one of 216 million monthly active users of this creative and engaging world and looking for some super excellent tools to upgrade your gaming experience, Welcome to the world of Roblox executors and Roblox scripts. If you are new to Bloxecutor.com, stay tuned to our website and social media platforms to get the most recent feeds to enhance your Roblox gaming experience. Visit https://bloxecutor.com/

G

Man, how can they allow such a vulnerability (SMS AUTH) open in this day and age... What a clown company

We really need to be able to remove sms 2fa after adding an authenticator. Right now I am still vulnerable to someone hijacking my sim even though I've added an authenticator because I want to remove that vulnerability..

I still want this option - nowadays you can easily get a new SIM using an ATM-like machine which only asks for ID card and fingerprint, both of which can be bypassed with even a little bit of motivation. It just adds a point of failure in security.

SMS authentication is insecure, I'd much rather have 2FA be only available on devices I trust and tied only to those devices.

Related idea https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/42722402-stop-requiring-a-phone-number-to-set-up-2fa

I think that it is really important for Twitch to allow users to disable SMS 2FA and to have fixed backup codes like every other 2FA implementation does. SMS 2FA is not secure at all as besides the SIM jacking attack, there are other, easier and cheaper, ways that attackers can receive all SMSes for a phone number, such as the one described in this article: https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber.

Given how easy it is for an attacker to receive SMS 2FA, it is imperative for Twitch to make their 2FA system better and more secure by allowing users to disable SMS 2FA and use other 2FA methods such as FIDO U2F.

This is also important for those in the affiliate and partner programs as an attacker with access to the account settings and SMS 2FA can change the payout method and thus steal a streamer's earnings.