Some services limit you to one account per phone number. Not only are there 5 numbers that route to my card (probably common given that this was a local provider's standard offering some time ago), once I even got a one-time token for some account a previous owner of a number was apparently trying to reset. It helpfully informed me which service it was for, so I could have likely used the fact that I now control that number to take over their account.
Using phone numbers for 2FA/account resets is worse than e-mail, even ignoring the fact how vulnerable telephone networks are to spoofing/intercepts.
Invariably you forget one of the pitfalls.
The things that annoys me about "Falsehoods Programmers Believe about Email Addresses" is that one person can have several email addresses, or use one email address for several different uses, so using an email address as a login to a website account can get really, really messy.
Is this true? Do carriers actually accept [a-zA-Z] in their phone numbers? (if so, how are they encoded?). I couldn't find any reference to this elsewhere.
I had assumed that advertisement-numbers like `1-800-Flowers` had to be translated by a person when they entered the number on their phone via their keypad.
Maybe the document should be called falsehoods programmers believe about what people will provide when asked for their phone number.
