We strongly recommend the use of security keys and TOTPs wherever possible. SMS-based 2FA does not provide the same level of protection, and it is no longer recommended under NIST 800-63B.

We now take an opinionated stance on which second factor you should set up first – you'll no longer be asked to choose between SMS or setting up an authenticator app (known as TOTP), and instead see the TOTP setup screen immediately when first setting up 2FA.

But first, an important note — friends don't let friends use SMS 2FA.

The problem with using SMS-2FA to mitigate this problem is that there’s no reason to think that after entering their credentials, they would not also enter any OTP.

discussions about SMS-2FA get heated very quickly. I've found that SMS-2FA deployment or advocacy has been a major professional project for some people, and they take questioning it's efficacy personally

I believe that SMS 2FA is wholly ineffective, and advocating for it is harmful.

Unfortunately all SMS/voice gateway are owned by paid services, thus there is no such thing as open-source, that I can recommend.

Fortunately, we found RingCaptcha (https://ringcaptcha.com), which has a the 'starter plan' that offers free 500 OTP monthly. Just a small plug for them for providing freemium service; they are highly reliable because they are integrated with all major global, and regional providers, e.g., Twilio, Nexmo, Infobip, MessageBird, etc., and send your OTP through the best provider/route based on country/phone carrier, and can auto fallback to alternative paths. This means you just need to integrate with RingCaptcha, without the headache of deciding which SMS/voice OTP provider has best combination of price and reliability, which is a real headache when you are sending OTP world-wide.

But getting codes by phone turns out not to be not very secure at all. A vulnerability in SMS messaging is that crooks can reroute text messages(Opens in a new window).

nother good example is the SMS message, which started life as a way for Nokia engineers to keep in touch when they were out mending phone lines in the countryside.

We do know that, just like iMessage, this new approach will failover to SMS/MMS if a user cannot receive the encrypted variant or if bandwidth is insufficient on either end.

The issue, though—and it’s a big one, is that the SMS infrastructure is inherently insecure, lending itself to so-called “man-in-the-middle attacks.” Messages run through network data centres, everything can be seen—security is basic at best, and you are vulnerable to local carrier interception when travelling.

The thinking behind RCS was to deliver a best of both worlds solution—the cross-platform ubiquity of SMS with the functionality of WhatsApp and iMessage, but built right into the core network infrastructure

A couple of years after WhatsApp, Apple jumped into the game with iMessage—its obvious drawback, that senders and recipients had to be using iPhones, was overcome by integration with the standard SMS platform on those phones. If a recipient was not on iMessage or was offline, the message would revert to SMS.

WhatsApp has become the dominant messaging platform, dwarfing all other contenders with the exception of its Facebook stablemate Messenger. In doing so, this hyper-scale “over-the-top” platform has also pushed legacy SMS messaging into the background

Text messaging is very cheap in most parts of the world. In fact, in 2015, the cost of sending an SMS in Australia was calculated to be just $0.00016. While the bulk of a cell phone bill typically is its voice minutes or data usage, text messages are either included in the voice plan or are added as an extra cost.