[pgeorgi]

"a text message" is not a secure channel.

[kelnos]

No, but for many use cases it's secure enough. Especially when you consider the tokens are short-lived and single-use