At Duo, we recommend push-based, FIDO Security Key, and biometric authentication, because these make it very difficult for an attacker to pose as an authorized user.