For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.
I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.
I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.
I don't have any money in there, it just mediates broken payment interfaces (e.g. Patreon rejected all my payment cards, from multiple banks apparently they're all fraud or something? No idea, the cards remain working no problem everywhere else, but I wanted to give people money for what they do, so I used Paypal to manage that)
It's pretty sad that in 2020 PayPal thinks SMS is a reasonable choice for protecting accounts that might actually have money in them...
If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero.
Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access my accounts. This has led to me needing to ask a total stranger to help me login to my accounts, potentially allowing them full access to all of my data in the name of "security." But hey, nobody ever said Google hires smart people.
- Why can't you recieve sms abroad?
Because I use e-sims and pay $10 for 30 days of data only vs. the $30 my provider would add to my bill for "global data".
> Do you leave your phone behind when you travel?
No, but I do leave my US number "dormant" in that i can't use it.
> Why can't you give Google your current phone number?
Because they already have a clear enough data picture of who i am, and I don't want them to have any more data that I'm willingly giving them.
Because my SIM card is useless the minute I'm outside of its recognized area.
> Why can't you give Google your current phone number?
Because my phone number is useless the minute I'm outside of its recognized area.
My old bank accounts have my old phone number on record. It hasn't been my phone number in 6 years and they don't accept phone numbers from my current country.
I'm not going to give Google my current phone number, because if it changes again, I'll be locked out of those accounts forever should I move or change numbers again. As it is, I can still login while having someone lend me a phone and making my account completely insecure.
While I understand your desire not to, reality is what it is, and at some point, e.g. your bank may force you to give them a phone number.