My first Twitter rant: It is best to use credentials which were designed to be credentials. For all the beauty and genius and impact of SMS, it was never designed as a secure mechanism or to be a credential. Use push notifications.
Passwords are designed to be a credential but no mechanism stands the test of time forever. Mechanisms for compromising your password are varied and well honed. They mostly devolve to asking nicely or guessing. Passwords aren't enough.
It is worth mentioning that if you are using any mechanism which can be accessed or changed with just a password (e.g. to your mobile phone or email account) then you have devolved to "just a password" (not enough)
And generally, it is useful and correct to think of any sign in which relies on a phone or email or openid to be simply "federated" - reliant on the security of whomever provides the phone or email channel.
While we see statistically that any second step (phone, email) makes your logins about 99.9% safer (yes, that's a real number derived from our detections), targeted attacks can and do break SMS and email second factors on the regular.
This is why we are pushing push notifications - we can encrypt the messages so we are transport independent, we can easily change things up if attackers find a chink in the armor. Besides, it is easier, cooler, and more fun.
This is a good place to start for your Xbox, Skype, Outlook, Onedrive, Office 365, SSO app on @azuread or anything that wants an OATH token (which it also provides): microsoft.com/en-us/account/…
