[kerkeslager]

Sure. To be clear, I'm not saying "force users to use SMS". The ideal solution for most (not all) situations, in my opinion, is to require a password and one of HOTP|SMS as a second factor.