Two-Factor Authentication (2FA) relies on the principle of combining two different vectors of proof: something you know (a password), something you have (a phone or security key), or something you are (biometrics). While any 2FA is better than none, the underlying technologies have vastly different security profiles.
The most common consumer 2FA is SMS-based, where a server texts a 6-digit one-time password to your mobile device. While convenient, the SS7 protocols routing global SMS traffic were never designed for security, and texts are sent in plaintext.
The vulnerabilities of SMS and the SIM Swap
SMS 2FA is uniquely vulnerable to SIM swapping (or SIM hijacking). An attacker social-engineers your mobile carrier's customer support, claiming your phone was lost, and ports your phone number to a SIM card they control. Once executed, all your 2FA texts go directly to the attacker.
Because SMS codes are tied to the phone number rather than the physical device, this attack bypasses your physical possession entirely. The National Institute of Standards and Technology (NIST) has officially deprecated SMS as a secure factor for this exact reason.
TOTP Apps vs FIDO/WebAuthn Hardware Keys
Time-based One-Time Password (TOTP) apps like Google Authenticator are a massive upgrade. They rely on a shared secret seed (usually scanned via QR code) and the current Unix time. The app calculates HMAC-SHA1(Secret, Time / 30) to generate the code entirely offline. This eliminates SIM swap risks.
However, TOTP is still vulnerable to real-time phishing (where an attacker's fake site prompts you for the TOTP code and passes it instantly to the real site). The ultimate defense is a FIDO/WebAuthn hardware key (like YubiKey). These use public-key cryptography and cryptographically bind the authentication challenge to the specific domain name in the browser, making them entirely immune to phishing.