Generally speaking, all of these security products are solid enough for casual end-users. When it comes to end-users, most of the vulnerabilities come from the way the person uses it, not from weakness in the method itself. For example, do you leave your RSA SecureID card where your kids have easy access to it? If you use a code generating app, then does your phone have a strong password lock on it?
As mentioned by @SteffenUllrich, if you happen to get spyware on your mobile device with root access - which is more common than you might expect (see StageFright and drive-by downloads) then your SMS, email, and maybe even app based methods could be compromised.
I think that if you've careful about how you use it, and have good security practices on your devices, then any of these methods are fine for the average end-user worried about drive-by (ie non-targeted) password cracking from database leaks. If you want to go the extra mile and sacrifice some convenience, then I suppose the ordering would be SMS/email < app/OTP/TOTP < hardware token.
Now, if you're not an "average" end-user, but a high-value target that nation state actors are trying to break into, then everything changes. For example, if you've made enemies with the US government's NSA then they can sniff any code sent to you over SMS or email, and can likely sniff the packets of the first-time setup of the Google Authenticator app (or, you know, just ask Google for the code). In this case, hardware tokens really are king because they are entirely "out of band" (ie nothing sensitive ever crosses the internet).
Just for completeness, here is a copy of the tag wiki from the multi-factor tag (which I wrote).
You can break 2FA methods into three broad categories:
Something you know - information, like a password, or your mother's maiden name, or a public key stored in a key file.
Something you have - usually a physical object like the phone that can receive SMS at your number, or a One-Time-Password (OTP) token or public-key enabled smart card / USB stick:
- Something you are: aka "biometric" like fingerprints, iris, voice, typing rhythm, etc.
The reason for splitting auth methods into these categories is that each one requires a very different kind of theft in order for a hacker to acquire it.
If you are required to provide a proof of identity from more than one of the above catogories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.
