@ibRAD Sending the second factor by text is highly hackable by using either technical means or social engineering to get a valid SIM for the phone number in question (which is not especially difficult). With that, the passcode will be sent to the cloned SIM allowing the attacker to log in. It's generally ok for the average person (and much better than nothing), but for anyone who might be targeted specifically it's very weak. Emailing codes can be weaker or stronger depending on how well the person's email is secured. Phone authenticators are a big step up, but are still vulnerable to attacks where a fake login page is presented (as in @EssExTee's post), since if the user enters their credentials, the man-in-the-middle page can steal the session cookie returned when the log in is completed (this is also a risk for any sort of other code entry methods, as well as push notifications) physical keys, especially using the newer FIDO authentication standard are generally considered very strong (using biometrics for a third factor of course can make things even stronger), and the way to go if you are anticipating targeted attacks from hackers, or business/state-level espionage.
