I'm working on one smaller system where it will be required to enter One-Time-Password (OTP, not to be confused with a One-Time-Pad) to download sensitive files which will be delivered to the user.
The primary idea was, to send an OTP via SMS within a pre-set time limit.
But since the SMS in not enough secure, I started to think about any other alternative for delivering an OTP to my users.
I can suggest to my users to use Signal and then deliver them information, but in that case I'm afraid that it will be too complicated for them.
Any idea or should I follow my primary idea?