Couldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel.
- I can own my email address; I cannot meaningfully own a phone number.
- Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.)
- Email works with or without a cell signal/via mobile data.
- Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.
- I can own my email address; I cannot meaningfully own a phone number.
- Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.)
- Email works with or without a cell signal/via mobile data.
- Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.