I've been thinking about this subject, and found paradoxical fact. Having a service that has 2-step authorization using SMS might become more harmful and open vulnerability hole (read SMS can be intercepted ), then being without using 2-FA at all.
example for Google, FB or any major services:
With 2-step SMS authentication, you are required to set your phone number in your profile. Those numbers are generally used as recovery method. So, if an attacker doesn't have your password, but can intercept GSM/SMS, then you are in more danger because he can click "password recovery" and then force website to send SMS code to reset your password.
Of course, some of you say that this might be "rare" occasion, however, if target is solid and attacker is not newbie, this becomes quite a possible route.
Just for reference, who wants to see if there are other people thinking like this, I have also found similar thoughts: :
- [https://www.finextra.com/blogposting/18645/dont-use-sms-for-2fa-here-is-why] 4
- Reddit topics (1, 2)