We had to change our old domain. guideora.net is our new and only official domain. Never trust any fake domain using the GUIDEORA name, or similar names pretending to be GUIDEORA.

GUIDEORA

password managers guide

SMS Codes Are Weak. They Are Still Better Than Nothing

Jordan HaleJordan Hale· Privacy Editor· Updated June 30, 2024· 10 min read

Some links on this page may earn GUIDEORA a commission. Disclosure

Quick take

Turn on any 2FA rather than none. Then move important accounts off SMS to an authenticator or a hardware key. Bitwarden currently stores TOTP on paid plans as they document it. SIM-swap is covered elsewhere on this site. Do not skip 2FA because SMS is uncool.

Perfect is how people stay at zero

Security Twitter will dunk on SMS. They are right that SIM-swap exists. They are wrong if the dunk keeps you from turning on the only 2FA a bank offers.

Climb the ladder when the site allows it. Do not camp at zero waiting for a YubiKey shipment.

From the record

Weak 2FA beats reused passwords. Strong 2FA beats weak 2FA. Shame beats nobody.

GUIDEORA rule for 2FA ladders

Then leave SMS where you can

Email, vault, and money apps deserve TOTP or keys. Put a carrier PIN on the number either way. Our SIM-swap piece is the incident version of this paragraph.

An SMS two-factor code on a phone
Weak is not the same as off.

None

Open door

SMS

Soft lock

TOTP app

Better

Hardware key

Best common

  • Enable SMS if it is the only switch.
  • Export or record TOTP seeds in the vault kit, not in a screenshot album.
  • Hardware keys for the three accounts that recover everything.
  • Do not use the same SMS number as your only recovery forever.

Bitwarden as the TOTP house

Bitwarden currently includes authenticator (TOTP) storage on Premium as they list it. That keeps the second factor next to the password without a second app if you want. 1Password does this with polish. Confirm live SKUs.

Free Bitwarden still stores passwords. TOTP may be the paid bump. Checkout wins.

Pros

  • +A ladder meets people where the bank is
  • +TOTP in a vault reduces screenshot 2FA
  • +You can still add keys later

Cons

  • −SMS remains swap-able
  • −People will screenshot TOTP anyway
  • −Some banks never leave SMS

On, then better

Turn it on. Then upgrade the factor. Bitwarden is the vault example this site uses. GUIDEORA does not issue SIMs.

Editor take

On is the first rung

SMS is weak and still better than none. Move up to TOTP or keys. Bitwarden is the house example. Confirm TOTP SKU.

See Bitwarden