We had to change our old domain. guideora.net is our new and only official domain. Never trust any fake domain using the GUIDEORA name, or similar names pretending to be GUIDEORA.

GUIDEORA

password managers comparison

SMS vs Authenticator vs a Hardware Key: A Ladder, Not a Personality

Sam OkonkwoSam Okonkwo· Security Researcher· Updated August 28, 2024· 11 min read

Some links on this page may earn GUIDEORA a commission. Disclosure

Quick take

SMS 2FA can be stolen with a port. Authenticator apps and passkeys/hardware keys are stronger. 1Password currently holds TOTP and passkeys for many users — it is not a SIM freeze at the carrier. Climb the ladder on email and money first. GUIDEORA does not issue keys.

Purity contests leave people on zero rungs

Security Twitter will mock SMS until the reader turns 2FA off. A text code is a cheap lock. A reused password is an open door. Put the cheap lock on, then upgrade.

Email and the password manager are the accounts that unlock the rest. Those get keys first. The recipe forum can wait.

From the record

Climb. Do not jump off because the top rung exists.

GUIDEORA rule for 2FA ladders

Where SMS still fails

SIM-swap, SS7-shaped attacks, and recovery flows that fall back to SMS after you added an app. Print backup codes. Put a port freeze on the mobile account.

SMS, an authenticator app, and a hardware security key
A ladder. The bottom rung is still a rung.

SMS

Better than none

App TOTP

Better

Key / passkey

Best of these

Carrier PIN

Still do it

  • Do not store backup codes in the same inbox you are protecting.
  • A vault that fills TOTP is convenient and is now a master key. Guard it.
  • Hardware keys need a spare in a drawer.
  • SMS is still fine as the only option on a site that offers nothing else — until it offers more.

1Password as a TOTP and passkey holder

1Password currently stores one-time codes and passkeys in a vault people already use. That reduces phone-as-only-token risk. It concentrates risk in the vault — which is why the master password and travel mode matter. Confirm live passkey docs.

Watchtower-style alerts are extra. They are not a carrier PIN.

Pros

  • +A ladder people will actually climb
  • +Vault-held TOTP survives a smashed phone
  • +1Password currently documents passkeys without pretending SMS vanished

Cons

  • −The vault becomes the kingdom
  • −Keys get lost
  • −Sites still force SMS recovery

Email and money first

SMS, then app, then keys on the accounts that unlock everything. 1Password is the vault example. GUIDEORA does not ship a YubiKey.

Editor take

Climb the ladder

SMS beats nothing. Apps beat SMS. Keys beat apps. 1Password can hold TOTP and passkeys. Confirm live. Carrier PIN anyway.

See 1Password's current plan