> If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping...
Do not, ever, store the TOTP seed in your phone! At least not as the one and only location.
Do not, ever, store the TOTP seed in your phone! At least not as the one and only location.
SMS, for all its security shortcomings, is at least something that the vast majority of people understand already.
But of course SMS suffers of the same problems as naive use of TOTP: Lose your phone, you're locked out of every account you have.
So in the worst case, TOTP is as bad as SMS. But, with some awareness/education TOTP is far superior if the user doesn't fall into the trap of attaching the TOTP seed to a phone.
i.e. for the aware user, TOTP is far better. For the naive user, TOTP is no worse than SMS. Thus, always favor TOTP.
This isn't about an attacker getting access to your TOTP codes - it's about you losing access to them.