zlacker

>>fahimu+(OP)
Why state-sponsored hacking specifically, as opposed to any (likely) unauthorized access?

>>Pyxl10+q1
Also, how will sending a new password to your cell phone help? If you are dealing with state sponsored actors, why not assume they can see all text and email?

>>jsprog+x1
A two-factor authentication token to sent via text, not the actual password.

That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.

>>Lafore+K1
How does TOTP compare to HOTP?

>>suneil+c4
HOTP tokens does not expire with time, so there is a bigger risk of them being stolen from transit/storage and successfully used.