Getting 2FA Right in 2019

Summary: Trail of Bits has worked with the Python Software Foundation since March to add two-factor authentication to Warehouse, the codebase behind PyPI, and as of today PyPI members can enable time-based OTP (TOTP) and WebAuthn, the latter in beta. The post cites Google research showing SMS prevents nearly all untargeted phishing attacks but that nearly one quarter of targeted attacks succeeded against users with only SMS-based 2FA.
What you should know: Nearly one quarter of targeted attacks got past users who had only SMS-based 2FA, and the post argues that TOTP not being as strong as a hardware key is no excuse to keep allowing SMS or voice codes.

Read the original at Trail of Bits Blog ↗