How is it that Reddit’s security team is continually learning security lessons that have been common knowledge among non-technical people for 5+ years? They seem to treat their production systems more carelessly than the average person treats their Nintendo switch account.
Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA?
Rather than putting them down I'm happy they're willing to share and bring knowledge, that some communities already know, to even more people.
Anyone who reads pretty much any mainstream newspaper? At this point it would be easier to name mainstream media publications that haven’t covered this issue extensively. E.g. just google:
site:nytimes.com sms hijacking
site:wsj.com sms hijacking
site:latimes.com sms hijacking
Not to mention the fact that it’s been discussed on Reddit itself hundreds of times. And on the front page of HN dozens of times as well. E.g.:
Additionally, it can take some time to change security standards in a large company. Most companies that are not in high compliance environments focus their engineering efforts on features.
You should talk to non-technical people when you get some time.