Oh, I didn't even think of it from a breach perspective. I haven't come across that anywhere, but since wf is using it, that must mean it's getting or going to become a common method. Ugh
Discussion
i refuse to use any system i know is vulnerable... that's why i have zero SMS based 2fa anymore and i avoid google authenticator... IT USES SHA1!!! fffs i'm not kidding you go read up on it, what a fucking shitshow