Phone based TOTP's are vulnerable to real-time phishing, but they still require you to sit there and enter the number on your phone. It still has to be your pho

Phone based TOTP's are vulnerable to real-time phishing, but they still require you to sit there and enter the number on your phone. It still has to be your phone. That's not ideal, but that's substantially better than SMS where someone can take your phone number and your second factor is gone. No real-time requirement. That makes phone based TOTP the most secure second factor that is pretty much universally accessible to lay users (i.e. not buying a dedicated second factor device, and most people have smartphones). FIDO U2F isn't quite there yet in terms of universal support, but its design is definitely promising from a usability perspective. It's one technology I'm willing to hold my breath for.