To require the attacker to know your phone number and do costly and/or time consuming things to get access to it means moving from "script kiddie re-using username+password from leaked user databases" to "targeted attacks".
Sure, it's not Safe(tm), but it's a big step up from just username+password.
That leaves us with physical keys, which the average consumer probably doesn't want to carry around all the time (easy enough to keep on keychain, but most people don't carry keys around their own home).
Most places that offer 2FA auth apps also offer backup codes, which can be stored in any password manager, or offline in a little black book.
Disclaimer: I’m very far from a cybersecurity expert.
1. Consumers are terrible at security. Asking them to subscribe to a password management/MFA tool is likely to fail. If this were baked into iOS/Android, this would be better.
2. Many banks don't support this MFA scheme. A quick poke around 2fa.directory shows a massive number that don't support MFA at all, and another huge bunch that do SMS/email but not software/hardware. This puts consumers in the position of juggling multiple MFA schemes to access various sites.
I don't disagree with you in principle. But until there's a more standard approach to MFA, people will continue to use SMS because it's easy and broadly available as an MFA scheme.
No, since you can back up the seed in a secure location.
I feel like much of what's wrong with SMS 2FA comes down to a misguided idea of "everyone has exactly one phone number", which is simply not true for a lot of people.
username+password+sms = username+sms (no password)
But I agree, and would take it a step further:
username+password+sms = username+sms || username+password
And in the worst scenarios:
username+password+sms = sms || username+password
And the same goes for email instead of SMS as well, in most scenarios.
Adding SMS seems to add new points of attack that either hurt the user or just delays the hurting.
As someone else pointed out: that's not true if the SMS authentication can be used to recover the password. But let's for the sake of discussion rule those cases out.
Then yes, SMS verification does perhaps add a tiny bit of "security" to the process for the reason you describe. But that tiny bit of security has to be weighed against the enormous extra burden placed on the users performing the (far more plentiful) legitimate logins. Than burden may well be worth it if a lot of extra security is gained. I think it's definitely not for the "security" provided by SMS.
These accounts are only worth anything as long as they’re cheaper and easier to use than stolen credit cards.
No, it is unfortunately actually much worse.
If the account only has name+password and you use a properly good password, nobody will ever guess it (within the lifetime of the universe and all that).
But if the account also has a phone number and the attacker can trigger an SMS challenge to reset the password, now your wonderfully complex password is meaningless. The attackers just intercepts the SMS and done, they own the account.
It is equivalent to the problem of allowing "security questions" with trivially discoverable answers. A site may enforce 20+ character passwords (great!) but then forces user to enter the name of their best friend in high school (trivially findable in e.g. facebook for most people) and lets any attacker bypass the password with just the so-called security questions, rendering the strong password meaningless.