Heroku: Starting December 2021, #SMS will no longer be available as an MFA verification method.
The #security risks associated with use of SMS:
> If not (and the user happens to protect her or his VoIP account with a password), the user might now be protecting sensitive personal information with two passwords—that's two of one factor type (two of ‘something you know’) rather than actual two factor authentication (‘something you know’ and ‘something you have’).
>
> Following on our approach to limit scalability and remote attacks, security researchers have demonstrated the increasing success (read: lower cost in time and effort and higher success rates) of redirecting or intercepting SMS messages en masse.
The #security risks associated with use of SMS:
> If not (and the user happens to protect her or his VoIP account with a password), the user might now be protecting sensitive personal information with two passwords—that's two of one factor type (two of ‘something you know’) rather than actual two factor authentication (‘something you know’ and ‘something you have’).
>
> Following on our approach to limit scalability and remote attacks, security researchers have demonstrated the increasing success (read: lower cost in time and effort and higher success rates) of redirecting or intercepting SMS messages en masse.
Heroku
SMS as an MFA Verification Method (DEPRECATED) | Heroku Dev Center
SMS for MFA Verification (DEPRECATED)