Why SMS two-factor authentication codes aren't safe and what to use instead

A million two-factor authentication codes sent via SMS passed through an obscure third-party company. Here's how it happened and why it's a problem.