My bank issues a physical token generator, where I have to insert my card, type in my pin, and then it displays the code on a little screen.

You are lucky that your bank still issues physical tokens. My bank started to require its app for authentication a few years ago, but it still offered tokens for presumambly elderly or "luddite" clients. Now it has announced that physical tokens will be phased out in 2019.

There are lots of ways, how about a Yubikey

Nothing makes me sadder than 2-factor that supports a phone but not my Yubikey. Yubikey is so much more convenient.

At my last job, I begged IT to turn on the U2F feature of our SSO product. Sadly, they did not, even though it was literally a checkbox in the service’s UI. I even sent them a link to the knowledge-base article.

That'd be a great answer. Sadly, it's not the one people I've met who've abandoned their smartphone go for. They don't use 2FA, or they use SMS where they don't have a choice.

I'm all for people taking control of their life, but having a smartphone can have a material impact on the security of the services you use, and abandoning that in order to stop yourself using Facebook as much is a Bad Idea.

Variously: SMS; the "call my landline and speak the code to me" options some systems have; 2FA app on an android tablet; special purpose just-shows-a-number dongle. None of this is great, though. I believe you can run 2-factor-auth clients on a Linux box somehow, but I've never investigated that.

I don't log in to secure websites on my mobile device. When I'm on my computer, I have a TOTP generator available. I do still receive some 2fa via sms, but if available, I always use email or TOTP.

Is two factor authentication something you can't live without, then?

I wouldn't be able to do my job or access my bank without it, so I'd say yes, I can't live without it.

I use a VPN and every so often I can't log into my gmail without having a text sent to me, so it's pretty important.

My job requires it, for a start.

This was really my only problem with not having my phone, but most if not all of what I use will send you an SMS with your 2FA so this could be easily replaced with a $9 flip phone, at least for me, but YMMV.

For work I use Winauth. I am a hourly corporate tech employee with no on-call duties currently so I don't have work Slack or any work 2FA on my personal devices.

I am looking into a yubikey or similar for the future.

Depending on the service you are talking about there are quite a few non-smartphone reliant options like SMS or email.

SMS is like having someone shout your second factor off of a rooftop a few streets away, loud enough that you can hear it. There is 0 security on it and anyone with even a modicum of motivation can intercept it without you noticing (ever). This is bad advice.

Email is bad for similar reasons (although slightly less in terms of exposure if you use a good provider).

SMS interception is hardly a low bar for attackers. If you are being targeted by someone with these capabilities then there is a lot more you have to worry about. Many other 2FA mechanisms would be similarly vulnerable to an attacker with that amount of money and technology...

I thought bad guys could get your SMS only if they manage to clone your SIM or call provider to change the SIM by social engineering. In both cases service on my SIM will stop. Unless they are state sponsored, in which case they can just arm twist telecom provider to give them texts.

Could you please tell how they can sniff SMS without user ever noticing?

I just by accident and not trying, held onto my hard token and no one has noticed for my main user acct. But my other tokens for different domain accounts administrator accts are on my smart phone. I have it for only that reason. I much prefer candy bar nokia's.

I use sometimes an old Samsung Galaxy S Wifi personally, it's technically Android but it's more like an iPod than a smartphone.