1,155 karma · joined May 26, 2015
The base of most arguments against async. And it's false. You can call red from blue. And you should, sometimes.
Why is that desirable? I see it more like a limitation of server-rendered web apps. Many times you can show useful UI before actual data is fully loaded (i.e. search / filter controls or basic data you already have).
Certainly, cascading fetching is undesirable and you should know what data you need to fetch and start the requests as soon as possible, but not necessarily before the route transition occurs.
Pushing the subresource fetching down to the database requires using JOINs and fails badly when you have multiple one-to-many relations in one fetch.
Just do a single, separate query per table.
Reliability. It's extremely hard to accidentally break a SIM card. If you drop or drown your phone it may easily become inoperable, but the SIM will be still OK and ready to work in other device.
Availability. If you somehow destroy your SIM it is reasonably easy to get a replacement. Properely and securely backing up an app-based authenticator is difficult. Enrolling multiple authenticators is cumbersome and sometimes not possible at all. Migrating to new device is as easy as it gets.
Attack discovery. If you are being sim-swapped, you will notice immediately as your phone stops working. If someone is eavesdroppoing your SMS OTP you will notice as you will receive unsolicited authentication attempts.
Attack scope. The attack must be targeted as it is much more costly to do it in larger scale.
Attack mitigation. You can take back your stolen SIM as opposed to leaked keys.
I'm not saying SMS is best solution, but it is good enough in many aspects. Other solutions are best in one aspect and much worse in others. SMS strikes the right balance IMO and can be rasonably secure when used as second factor. (Not first and only!)