Is phone-based two-factor authentication significantly more secure than email authentication?

Question

Phone-based authentication must be more secure than email-based, because it is more difficult to take control of a phone than an email account. Should I use phone authentication over email verification?
SMS verification shouldn't be used.

Answer 1

A good practice in two-factor authentication is to use an authenticator app (like Google Authenticator) as the second factor. If an attacker has access to your phone this won't help you either. But the thing with SMS as a second verification step is that it introduces additional risks pertaining to carrier security. Due to this, NIST no longer advises to use sms-based 2 factor authentication in the latest sp800-63b publication (https://pages.nist.gov/800-63-3/sp800-63b.html section 5.1.3.2. Out-of-Band Verifiers)

Answer 2

It is advisable to use a second factor that is even physically separate from the first factor. This way, even if one of the devices is captured, the adversary cannot gain complete control of the account.

If you are expecting most of your incoming traffic to be from a non-mobile device, using a phone based authentication would definitely be secure. Though, as a good practice you should consider the case that a user lost their phone and want to connect. You can check dropbox for that.