I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone calls:
- password + SMS (two places where shown) OR password + voice call (only received by your phone)
Both of which are visible in the case of theft of your phone. Compare this method to using a password + phone app generated one-time code in Android system. I cannot evaluate the security of the application for generating one-time passcodes in the Android phone. Access to it depends on having your passcode to your phone. Intuition suggests that it might be stronger than SMS/voice call. But what about possible vulnerabilities in the app.
How can you evaluate the security of these two methods? Why a well-designed app in Android is more secure than SMS/voice call?