2FA4 min read
SMS 2FA is better than nothing. Barely.
Texts can be intercepted. SIM-swapped. Spoofed. Use an app instead. Takes 90 seconds to set up.
Saved only in this browser. No account needed. Does not sync. Clearing browser data removes the list.
Published
Two-factor authentication via SMS got popular because it was easy. It's also the weakest kind.
Authenticator apps (Google Authenticator, Authy, 1Password) generate codes on your device. No carrier in the loop. No SIM swap risk.
Hardware keys (YubiKey) are the gold standard. Phishers literally cannot get past them. Costs $25, lasts forever.