What are the security downsides to using this for, for example, 2FA SMS?
The cost of cloud providers in this space is neglible, but I'd still like to think about this as an exercise.
The cost of cloud providers in this space is neglible, but I'd still like to think about this as an exercise.
If you're going to do this, you need to do it as part of a system where you use many providers and monitor success.
If the rate is high, it's almost certainly going to get blocked. But then, it may work better for some destinations than any commercial provider. Or it might continue to work when the commercial providers have outages, or the carriers do maintenance on their external connectors.
Some of the SMS aggregators use regular SIMs to send some messages, or contract with others to do so, it's generally called a grey route. Usually with more specialized equipment and more SIMs, but same basic idea.
Not exactly a security issue per se but ordinary SIM cards/phone numbers are intended for personal use and are limited in how many messages you can send per minute/hour/day.
When your messages are blocked, your 2FA obviously fails.