Expiring your SMS token in 20 minutes will not mitigate the attack. Bad actors can either use SS7 routing attacks, or social engineering to gain access to your text messages. The social engineering attacks are much lower tech and easy to do. They essentially involve:
- Calling your cell phone provider
- Authenticating as you, or just convincing the customer service rep to help them. (See: https://youtu.be/lc7scxvKQOo?t=30s). The recent Equifax breach makes this even easier since bad guys can now answer your security questions as well (in many cases).
- Changing the IMEI of your phone to their burner phone (like what happened here: https://carpeaqua.com/2017/07/07/hack-the-planet/).
- Initiating password resets (to your email or other services) with text messages, which are now routed to the burner phone.
Once they have gained control and access to a few key accounts (your text messages and your primary email) they have the keys to the kingdom, and can take over - resetting passwords and locking you out of accounts as fast as they can. Typically, it takes people around 1 hour to figure out they got hacked. But, even if you notice in 15 minutes, it's very possible you've already lost control of key accounts, and it will take some time to get back in. During that time, the bad actors are routing around in your personal information collecting data and planning the next move, which includes further locking you out.
For strong, out of band 2FA, very little exceeds the security of time based one-time passwords, which Google authentication Yubikey utilize.
There are a number of libraries you can use to generate the 2FA keys. Here are some examples:
I'm a little concerned OWASP hasn't updated their list in light of both the NIST recommendations as well as the Equifax breach, which puts people's security questions at risk. Perhaps they have their reasons. Speculating on what those reasons are, it could be that security questions don't have to be answered truthfully. Example: when asked: "What street did you grow up on?" I typically answer with a GUID. This, of course, requires the use of a password manager like LastPass and / or KeePass to keep track. But, security requires effort. Also, social media is a gold mine of security questions and answers. So, perhaps the recommendations don't need to change ... yet.