Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
From an OpSec-perspective, I'd argue that a second, dedicated phone (dumb or smart) is a good idea as long as you treat the dedicated phone as exactly that: dedicated to one exact use case.
You minimize the attack surface because you'll be less prone to web-borne attacks and you'll slightly elevate your security, albeit through obscurity (of your banking phone number). However, all this comes down to how well you operate your second phone.
To expand on that second phone's OpSec, with input from @schroeder and @ste-fu:
In regards to your second question, here's an excellent and in-depth answer on SMS interception/encryption.
As with most things, it depends. For SMS 2 Factor authentication the answer is - not really
The network /telco transmitting the the SMS data is the same whether it is a smart phone or a dumb phone. Call centre operatives who get socially engineered can allow takeover of the relevant number or the actual network can get hacked and the SMS intercepted.
If you had some particularly sensitive account, the using a dumb phone with a unique SIM/ Phone number for that one account would make it significantly harder for that account, but as soon as you start using the same number all the time, you risk that number becoming associated with all your accounts.
NIST published some guidance saying SMS 2FA was deprecated although they have backtracked a bit
Using a dumb phone avoids a lot of security issues present on smartphones. I consider a smartphone more a pocket computer, with all vulnerabilities of a desktop computer.
Using an old phone only for receiving tokens will protect the token at rest, because there will not be any running program capable of intercepting the token and sending it elsewhere. But will not protect the token in transit.
As your telco probably is not secure-aware, the token CAN be intercepted while in transit, your telco can be tricked and transferring your service to another user without much validation (SIM swap attack). Crypto traders are usually targets of this attack.
If possible, don't use SMS for receiving tokens. My bank can send tokens or get a number from an authentication app. I used the latter.