I'm looking at implementing a two-factor authentication system for my web site, utilizing a user's cell phone as the "something you have" part of a two-factor system. It seems like there are two typical approaches to do this:
- Send a code via SMS or voice message to the user and ask them to enter the code on a web page to complete the login.
- Use an app on the phone to generate a TOTP token, and ask the users to enter the token to complete the login.
I'd like to avoid the expense and complexity of sending a code via voice or SMS, but are there any security or even usability benefits I get by supporting option #1? Of course, one benefit is a wider range of supported phones since SMS and voice works with feature phones as well as smart phones. However, as smart phone adoption increases, that benefit will be reduced. Are there other benefits that SMS/voice provides? If not, is two phase authentication using SMS/voice effectively dead?