Disallow (or add option to disallow) SMS password reset
Now that Twitch has enabled streamers to require phone number verification to use their chat, I and many others have had to add a verified mobile number to my account. The problem, however, is I can now reset my password via SMS, which I did not ask for. This is especially problematic because Twitch's 2FA solution can also be bypassed via a phone number that's required to set up 2FA at all, even if the user has a secure authenticator app, meaning an attacker with access to the user's phone number can defeat both factors. Twitch just suffered a data leak, and presumably the names and numbers of high profile streamers are now public record, which makes a SIM swap attack highly effective. This is a major security problem and there needs to be a way to opt out.
![](https://secure.gravatar.com/avatar/d41d8cd98f00b204e9800998ecf8427e?size=40&default=https%3A%2F%2Fstatic-cdn.jtvnw.net%2Fjtv_user_pictures%2F47b172c0b799af4c-profile_image-150x150.jpeg)