Let me turn off SMS after I enroll a passkey

I’m increasingly uneasy that a service can let me enroll a passkey or hardware security key, then quietly keep SMS as the way back in. The passkey is meant to give me a stronger, phishing-resistant sign-in, but anyone who gets control of the phone number I reuse across many accounts may still have a weaker route through login or recovery. That makes the threat model feel conditional.

I understand why platforms keep SMS: people lose devices, travel, use an unsupported device, or simply cannot navigate recovery codes. Removing it could lock out less technical users, which is not a small cost. But does “more recovery” quietly undermine the protection users thought they had? Should platforms offer a clearly labeled “no SMS fallback” mode after enrollment, or require everyone to keep a weaker path? Disagree if you think I’m overvaluing purity, and share how you handle this trade-off.

I think the opt-out is important. Recovery is part of the authentication system, not an administrative footnote. If SMS remains usable, the account’s effective security is closer to that weaker path than to the passkey. The setting should be prominent and reversible only through an equally strong method.

The problem is that “no SMS” sounds clear to us and terrifying to someone who just lost their phone. I’d support the mode, but only with a very explicit warning about permanent or extended lockout and a guided setup for a second key or recovery codes.

There’s a reliability argument on the other side. A lost authenticator is an outage, and insisting on perfect key redundancy is unrealistic for ordinary accounts. But I’d rather see delayed, auditable recovery than pretend an SMS code preserves the original assurance level.

The strongest case for your proposal is not that every user should disable SMS; it is that the choice should be honest. Calling an account “protected by a passkey” while retaining a weaker recovery channel can create a misleading impression unless the interface explains that distinction.

I’d make it a mode people choose during passkey setup: “Convenient recovery” or “Strongest recovery protection,” with plain-language consequences. Defaults matter, but so does comprehension. A buried toggle will mostly reward people who already know what they’re looking for.

I’m not convinced the answer is a binary switch. Some services could impose a waiting period, require multiple existing signals, or let a trusted recovery contact help. Those still have risks, but forcing SMS off may turn a manageable account problem into an irreversible one.

I use two hardware keys and keep recovery codes offline. That works for me, not necessarily for my less organized relatives. Give experts the “no SMS fallback” button, explain the consequences plainly, and stop pretending one recovery policy fits everybody.