There are problems with any method of authentication when being targeted by a determined enough theoretical attack. The key is to find a process that balances r

There are problems with any method of authentication when being targeted by a determined enough theoretical attack. The key is to find a process that balances risk against inconvenience. Google Authenticator (which, by the way, isn't what your link refers to. That only covers SMS) is a great middle ground for most reasonable security requirements. If you feel the need for something stronger then go for 3 factors, alerting systems, disable remote logins entirely or whatever extra steps is recommended by your pen testers. I should also add that to just highlight problems with one specific method of 2FA without establishing that it is still more secure than a single factor password, let alone acknowledging that other methods of identification are available, somewhat misses the point of 2FA.