Even assuming the insecure "choose 1 of 3" was for example, I don't really understand how this is better than e.g. a 4-digit numeric code?<p>It seems like this kind of authentication could be provided by the OS. I'm pretty sure I've used apps that sent a code via SMS to verify identity that detected when the SMS arrived and performed the authentication automatically. Given that you don't want to give every app unnecessary access to your text messages/email/whatever, I would think you could have a fairly secure process like:<p>1. App requests a unique session code from the OS and registers a callback.
2. App sends the session code to the server.
3. Server sends SMS to the phone # containing the app auth code + session code in a standard format.
4. OS detects that SMS is an auth message, matches the session code with the callback, and sends the auth code to the app.
5. App sends the auth code to the server for verification.<p>I haven't done any mobile dev so for all I know something like this already exists.