Is two phase authentication using SMS/voice dead?

Question

I'm looking at implementing a two-factor authentication system for my web site, utilizing a user's cell phone as the "something you have" part of a two-factor system. It seems like there are two typical approaches to do this:

1. Send a code via SMS or voice message to the user and ask them to enter the code on a web page to complete the login.
2. Use an app on the phone to generate a TOTP token, and ask the users to enter the token to complete the login.

I'd like to avoid the expense and complexity of sending a code via voice or SMS, but are there any security or even usability benefits I get by supporting option #1? Of course, one benefit is a wider range of supported phones since SMS and voice works with feature phones as well as smart phones. However, as smart phone adoption increases, that benefit will be reduced. Are there other benefits that SMS/voice provides? If not, is two phase authentication using SMS/voice effectively dead?

Answer 1

The only benefit I'm aware of to providing SMS-based two-factor authentication, though it's potentially a big one, is that it provides a better defense against you losing any particular phone. I.e., with TOTP, if you lose your phone, you have to use your backup codes for each site and generate a new key with your new phone. Doing this inevitably requires locating your backup codes, which, if you're a normal person, you probably don't carry on you all the time. Thus, the bootstrap process can be annoying. With SMS, you'll just receive a text like usual, and go on your merry way.

In practice, several sites I use provide TOTP as their primary two-factor auth, but will fall back to SMS to cover exactly the second scenario. That seems like a good compromise for the time being.