To prevent brute force and other attacks targeting password-only authentication, some form of 2FA is needed. The good news is that there are multiple secure alternatives to SMS-based 2FA: hardware authentication, software authentication, and IP-based authentication.