[kevincox]

SMS auth is great until your users move, get a new number and are locked out forever.

Pick you poison. Or even better, implement both and let your users pick.