I’ve always been suspicious of services that use SMS as the primary 2FA mechanism. TOTP is more secure and convenient, but it doesn’t allow the service to collect and extra datapoint. Using a communication channel intended for security as a method to boost falling engagement is as shady as it gets.
Matthew Green’s twitter thread[0] on this is an interesting read.
0: https://twitter.com/matthew_d_green/status/96376666146678784...