It really depends. Not so long ago the humble bundle forced 2FA on me and I had the choice of forfeit my 100 games library or set 2FA. I don't care at all that steam gives them heat about how some steam keys are used, and I care enough about my phone number not to give it away.
Then there was the time when I was traveling and verification SMS would not reach me because my carrier plan does not include receiving SMS internationally.
Then there was a few other times and cases where not using your phone (provided you have one and carrier plan) but a public text service instead.
To me phone based 2FA is mostly a scheme to collect users' phone numbers as there were in the past to collect email addresses. It introduces a pretty serious point of failure by relying on mobile number (no battery, no signal, no phone, changed number, prepaid card, etc.) while only being helpful in fringe cases such as when my password has been stolen.
Moreover it promotes bad security practices instead of fixing security issues, just slap some 2FA on top of whatever exists and now it is secure.
Then there is the question of how do I change my associated number when I change phone number, then what prevents a social engineering pro from changing the number too ?
I'm not sure using a publicly readable text service is so wrong, it mitigates the relying on phone point of failure, protects your privacy better, someone else reading the code may not be a problem as the code alone is useless.
As usual this really depends on what is the threat model you trying to protect from. Neither option will be able to protect you from a nation state targeted attack.
Then there was the time when I was traveling and verification SMS would not reach me because my carrier plan does not include receiving SMS internationally.
Then there was a few other times and cases where not using your phone (provided you have one and carrier plan) but a public text service instead.
To me phone based 2FA is mostly a scheme to collect users' phone numbers as there were in the past to collect email addresses. It introduces a pretty serious point of failure by relying on mobile number (no battery, no signal, no phone, changed number, prepaid card, etc.) while only being helpful in fringe cases such as when my password has been stolen.
Moreover it promotes bad security practices instead of fixing security issues, just slap some 2FA on top of whatever exists and now it is secure.
Then there is the question of how do I change my associated number when I change phone number, then what prevents a social engineering pro from changing the number too ?
I'm not sure using a publicly readable text service is so wrong, it mitigates the relying on phone point of failure, protects your privacy better, someone else reading the code may not be a problem as the code alone is useless.
As usual this really depends on what is the threat model you trying to protect from. Neither option will be able to protect you from a nation state targeted attack.