Having helped people set up 2-factor auth, I find that SMS is a reasonable mitigation for people may find U2F and other measures to be intimidating enough to no

Having helped people set up 2-factor auth, I find that SMS is a reasonable mitigation for people may find U2F and other measures to be intimidating enough to not try. That is, the vulnerability introduced via SMS is at least a magnitude less compared to 1-factor-auth of email/password. The pragmatic optimist in me thinks that it's more likely that we'll see phone companies meaningfully harden their customer auth processes, because it's easiest to focus public blame/scrutiny on them for the time being.