If they can make SIMs more secure in the meantime, that's a win, and a very important one.
Improve the things you have control over rather than just bemoaning the things you don't.
I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.
True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap.
Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.
Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key.
But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.
I've seen this on Twitter, which doesn't require a phone number to set up, but it's possible for your account to be flagged as suspicious, and get locked down until you add a phone number.
Lots of banks reject VoIP too.
Say something bad about insert monarchy... They'll trace you down with that.(Turkcell does that just for wifi at IST)
I have an AT&T number ProRes to Google Voice which works perfectly. But another native Google Voice number does not.
For your experience did you sign up for those services before or after transferring to VoIP?
And there are always also many services where you can rent non VoIP numbers for a single SMS for pennies.
If paying $0.05 is a form of security we could just charge for registrations as well.
The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all.
The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.
Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer).
Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http
It's more about employees visiting phishing sites on their phone. Or their phone getting hacked exposing mail correspondence, or 2FA getting hacked etc.
In the way it's presented it's still the wrong solution IMHO.
If security matters and the work requires a phone do not allow BYOD. Provide a phone. For such a phone this might be an okay solution, not for a private phone. If a phone isn't strictly required remove phones completely and strictly out of the loop. This is beneficial both for security in more ways then this sim service provides and for the mental health of your employee. Make it clear that even if they are called because of an work emergency they are contractual bound not to process it on the phone but instead switch to a employer provided device no mater who calls and which situation it is. PS: Also fire any manager or even the CTO who tries to pressure employees into not keeping the rule, make it an automatic firing through a contract clause.
1. Phones are an important attack vector to consider
2. We should be using strong 2FA ala FIDO2
Given that phones can act as FIDO2, I think that only strengthens (1).
Even if a phone isn't used for 2FA, it still is likely to have access to company resources - Slack, Email, non 2fa text messages, etc.
The attacks on SIM cards are not on the SIM itself, but by the carrier binding your identity to a different card. A function they must perform at least sometimes! If you lost your yubikey, I'm sure you want your replacement to be able to activate your cell phone.
That's just nonsense. You need to explain what you mean by that, because otherwise you sound like someone who doesn't know what they are talking about. If you mean SIM swap attack, then that's basically 'social engineering' with a help of identity theft targeting providers and has nothing to do with SIM cards themselves.