I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS?
(Assuming the email - rather, webmail - account is itself reasonably well-protected with strong passwords and 2FA.)
- How hard is it to intercept SMS (two-factor authentication)?
Database leak exposes millions of two-factor codes and reset links sent by SMS - Ars Technica
The database provided a portal that showed two-factor codes and resent links being sent in near real-time, making it potentially possible for attackers who accessed the server to obtain data that would help them hijack other people’s accounts.