[jszymborski]

I understand how sending an SMS text is 2-step verification, however this article then tries to expand this to include smartphone apps like Google Authenticator, which is just wrong.

The argument they use is that Google Authenticator is something-you-know auth because you "know" the token, however from my understanding this isn't any different from any other Synchronous 2FA.

2FA, whether Sync, Async or Challenge response require your device to store a password, OTP or Key Pair.

Bad sales pitch is bad.