Facebook's two-factor authentication system auto-posts all 2FA SMS replies from a user to their profile; it is unclear if the behavior is intentional or a bug
Nick Statt / The Verge :
Context & Ripple Effects
This lands seven months after The Verge's broader indictment that two-factor authentication is a mess, with SMS implementations among the weakest links — Facebook just supplied the most vivid proof yet: its own 2FA system republishing users' security replies as public profile posts.
The follow-up coverage shows Facebook apologizing within days and shipping a fix, but the episode foreshadows a longer arc: by 2019 the company was urging users onto phone-number 2FA while those same numbers fed user lookup and ad targeting without an opt-out.
First-order effects
- Users replying to Facebook's 2FA texts had those replies — potentially containing security codes — published to their own profiles, an immediate privacy exposure on the platform they were trying to protect.
- Facebook faces a trust hit at exactly the moment it wants more users enrolled in SMS 2FA, forcing the rapid apology-and-fix cycle documented in the follow-up coverage.
Second-order effects
- Every botched SMS 2FA rollout makes users warier of handing platforms their phone numbers, tightening the squeeze on Facebook's later push to enroll users in phone-based 2FA while reusing those numbers for lookup and ads.
Third-order effects
- If the pattern holds, SMS-based authentication keeps losing credibility against app and hardware methods — a trajectory the related coverage extends all the way to a $16 text-rerouting attack that broke SMS 2FA outright and fueled calls to regulate bulk SMS tools.
The trend: SMS-based two-factor authentication is steadily being discredited on both security and privacy grounds, pushing platforms and users toward stronger second factors.