> The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part. (SMS 2FA + Stro

> The thing is, SMS 2FA is still way better than no 2FA and users are more likely to use it since it requires very little effort on their part. (SMS 2FA + Strong Password) is worse than (SMS 2FA + Weak Password). SMS 2FA doesn't solve phishing and it muddies your identity with a weak, transferable identifier. If you've taken the time to set up SMS 2FA for yourself you could have just used a strong password, especially since password manages are now built into browsers. At least with TOTP you aren't adding additional vulnerabilities, but frankly most 2FA is pointless unless it's FIDO2, assuming you just use a password manager and use strong passwords.