Re: Codes sent by text message

Frank Slootweg <this@ddress.is.invalid> wrote:

  Huh? Who is saying that the "log into a web form" is done on a *phone*?

Web traffic volume generated by phones has surpassed web traffic
generated by desktop PCs.  Most logins are on phones, not desktops.

https://gs.statcounter.com/platform-market-share/desktop-mobile/worldwide/

  It's more likely done on a computer and in that case, the scenario
involves *two* devices and the thief/hacker must be in possesion of the
second device (phone), which he isn't.

2FA isn't about using 2 devices.  It's about 2 pieces of evidence:
password and 2FA code.