- Out-of-Band Authenticators (mobile app over secure channel)
- Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device)
- Single Factor Cryptographic Devices (insert into computer)
(among others)
I get a new phone every year, and Google Authenticator sucks for that, but it's by far the second most common 2FA provider. I just got a new phone today, and had to go disable 2FA on all my accounts then re-enable it to generate a new code. SMS is always a good fallback in my experience.
If used exclusively as a second factor, yes, it's better than nothing. However, many systems also allow you to use a phone as a password recovery system, which makes it much worse than no 2FA. Many people have had every account they own broken into, starting with a social-engineering call to their cell service to get their number moved to a new SIM/phone, followed by a reset of their email, followed by a reset of everything else.
Adding bluetooth to work with mobile devices would make it a complete solution.
Edit: corrected U2FA to U2F.
Bluetooth and NFC are standardized, and the first products are out. I really hope U2F and UAF are gone 'make it' in the market.
I also use it for Bitbucket and Githib, but I take your point and also hope it becomes a widespread standard.
Or use a Cloudbased system, LastPass Password Manager for example does this. Authy does the same thing.
https://blog.agilebits.com/2015/01/26/totp-for-1password-use...