SMS is better than no 2FA at all, but is the weakest choice. Avoid if possible, unless it is your only choice, in which case, it's still better than nothing.<p>Authenticator app, hardware token (e.g. Yubikey), or email will usually be a question of which ones are supported by the service you are 2FA-ing into, You usually don't get a choice, so use what they offer.<p>Phone-based 2FA and lack of network is only a problem if you are using SMS push, and have no data service on the phone. But in that case, what system are you using to access the service? Can that machine hot-spot, or can your phone share its network connection? In practice, I've never seen a case where you have network connectivity to talk to a service, but not phone connectivity to get your SMS 2FA. So I'd say "not a frequent problem".<p>Given my choice (assuming all are supported) my order of preference would be: 1) Hardware token (e.g. Yubikey), 2) Authenticator App, 3) email, 4) SMS<p>Tokens are portable, can move between machines, have nothing to remember, and are easy to use.<p>Apps are running on some device, so still a true second factor (something you have) - and again, have nothing to remember, and can be secured with biometrics.<p>Email - now you are on two different things you know (not really a second factor), and you have to access your email on some potentially untrusted device, just to get the code, potentially now compromising your email. It's one more basket that if someone gets access to, they can probably reset your other service passwords for total account takeover. Still better than no 2FA, but higher friction to use and access, and not really a second factor.<p>SMS - it's just too easy for SIM swap attacks, and good social engineering to phish SMS codes. "Hi, this is $BANKNAME - we saw some suspicious activity on your account, so we are going to send a one-time code to you now. Please enter it back to us here to verify your identity" (scammer then uses your stolen password, tries to log in, real bank sends you real code, which you now are tricked into sending to scammer to complete their login as you).