3 ms·
As long as the only viable alternative to SMS 2FA is some kind of Authenticator app on your phone, and as long as most people change or lose their phone FAR mor
by simiones 4y ago
As long as the only viable alternative to SMS 2FA is some kind of Authenticator app on your phone, and as long as most people change or lose their phone FAR more often than they change their phone number, I really don't see how anything other than SMS has any realistic chance of being accepted as 2FA.
In fact, most services that allow you to configure a different 2FA still fall back to SMS if you say you don't have access to your Authenticator app anymore.
And no, yubikeys or other self-acquired hardware tokens are not a viable alternative.
Edit: just for reference, I've been using the same mobile number for ~15 years, back when I had a Nokia 3310. I have probably had 10 different phones in the same period - which would have meant I would have had to go to each service I used 2FA on 10 times in the same period to switch to the new 2FA if I had been using Authentication apps (and if anyone had been offering 2FA ~15 years ago). Note that one of these 10 phones was stolen, so recovering the accounts after that would have been a joy.