The Core

Remove your cell from the process.

https://motherboard.vice.com/en_us/article/a3q7mz/hacker-allegedly-stole-millions-bitcoin-sim-swapping

Best alternatives?

Do most sites allow/use GA?

Google Authenticator, Lastpass Authenticator, Duo, etc are all essentially the same.

I think the hardest to defeat is probably something like Yubikey.

One tip for Google Auth - you might want to have multiple devices function for this. To do so, take a screenshot of the QR code and save it. You can use this to add a new device anytime. Just don't save it in the same place as your passwords :-)

"U2F is an emerging open source authentication standard, and as such only a handful of high-profile sites currently support it, including Dropbox, Facebook, Github (and of course Google’s various services). Most major password managers also now support U2F, including Dashlane, and Keepass. Duo Security also can be set up to work with U2F."


Google: Security Keys Neutralized Employee Phishing

https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/

Quote from: bill on August 17, 2018, 08:34:34 AM

I've been using Authy for years

https://www.reddit.com/r/Bitcoin/comments/6f0hhb/coinbase_recommendation_migrate_from_authy_to/

The old SMS text vulnerability... That is a down side.
Hard for me to migrate from Authy just due to the time involved. I used to religiously screenshot the QR codes and save them, but I was using multiple devices and maintaining my OTPs among them was a PITA. Authy made all that go away. Things like wiping my phone and restoring then meant I had to setup Google Authenticator from scratch with all of the codes.

I guess for things that are critical like a bank or financial account you could still use an alternate OTP app like FreeOTP. I haven't found one yet that will allow me to easily backup and restore a OTP store. That would be ideal.

Might need to look into this YubiKey app mentioned in the thread.

Yubikey looks like a good one. One bloke in office uses one.

I've had YubiKeys for years. Problem with them for me is that most of the FIDO alliance sites only work with Chrome. So it's still not optimal in terms of browser support.

What about Duo?

I have to use Duo for one account, but that seems to be more for enterprise rather than consumer. I do like the interface and functionality. Seems more polished and stable than others. Do they even have a free version?