We did something unconventional: we removed SMS TFA at Buffer Sounds risky? Here's why it actually made us more secure: 🔐 The SMS reality check: SIM swapping attacks are increasingly sophisticated International regulations created compliance nightmares across 100+ countries Costs were scaling unsustainably 📧 Why email won: Email accounts typically have stronger security than phone numbers (their own 2FA, recovery options, activity monitoring). Plus, we already had robust email infrastructure in place. The results after 3 months? ✓ Fewer authentication support tickets ✓ Better security posture ✓ Significant cost savings Sometimes "industry standard" doesn't mean "best for your context." We had to challenge conventional wisdom to find what actually worked for Buffer and our users. Have you ever questioned a security practice that everyone just accepts? I'd love to hear what made you rethink the status quo. Read the full story with my debut post in Buffer's Blog. Link is in the comment 👇
Out of curiosity, did you considered the adoption of passkey’s?
Good decisions, its correct that using phone number for 2fa can bring security issue problems. When phone number is not active, sometimes SIM provider sell that number again to another customer. Also SMS doesn't use end to end encryptions that makes it no more secure.
I really appreciate the transparency. Curious: what metrics moved most post-switch support ticket volume, successful login rate, or fraud attempts?
Software Engineer @ alx_africa | Mechanical Engineering, Project Engineering
1dNaturally (or rather virtually😅) Email authentication is way better, bcs fundamentally authentication is based on trusted third party system. Send a verification to a trusted system claimed by the client; email, Facebook, whatsapp. Maybe SMS should serve as a fallback system, phone numbers are very volatile.