Hey all! Was curious if anyone knew why Ory Kratos doesn't support the most common and simple MFA methods, email and SMS text? Seems like a glaringly obvious feature and yet it's not supported. Will need to custom build it for my company and will consider contributing it to the open source project, but there must be a reason someone else hasn't done this already...

I'm not sure if it's Ory's official stance, but SMS is known as the least secure method for MFA, so it wouldn't surprise me if this was why it hasn't been adopted

That was my suspicion, what about email at least? Good enough for account recovery but not MFA?

Yes this is correct. SMS is difficult to support due to the multitude of issues associated with it such as sim swapping and SMS billing fraud. We even highlight inside this blog article the problems with SMS login (first-factor). https://www.ory.sh/overview-login-password-passkey-webauthn-totp-sso-faceid/#login-code-via-sms That said, we might support such a feature in a limited capacity in the future.