Is it more secure to do 2 factor authentication via email or via SMS? What are the risks in both cases?

  • The topic of the security of SMS 2FA has been well-discussed here over the years.
    – schroeder
    Dec 31 '21 at 15:08
  • @schroeder do you have any more resources about email 2FA ? I already found the two questions about SMS 2FA before Dec 31 '21 at 17:28
  • Every single hit on the first page of: google.com/search?q=sms+2fa ... and most of the 2nd page of hits ...
    – schroeder
    Dec 31 '21 at 19:01
  • And NIST and the UK NCSC and Europe's ENISA. I could keep looking, but you get the idea ... I encourage you to look this stuff up. All of this was after 4 minutes of googling around...
    – schroeder
    Dec 31 '21 at 19:06
  • @schroeder those all seem to be about SMS 2FA. I can't find anything about email apart from in the second link where it seems to assume email 2FA should use a different email address to the one that is used to reset your password (but doesn't say why) Dec 31 '21 at 19:49