If you're going to do that, please make the two codes more different. e.g. Make one alphas and the other numeric, or give them different lengths, so it's stupidly obvious which one the user should type in.

IBM ISAM (enterprise access manager) was doing this 5+ years ago. The prompt for one time code will look like this [1]:

1234-_______, and email/sms will have two numbers 1234-554566.

Don't think they explained the reason for the first part in the message though. Just highlighted it in a different color.

[1] https://philipnyecom.files.wordpress.com/2017/02/otp.jpg

I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.

You are right, a duplicate SIM will stop the two-number method described from adding any protection.

But it will still protect against the fake messages like the ones being discussed here, and if someone has a duplicate SIM you are buggered in a number of other ways too.

Though this method, and several others that are effectively the same, only offers any protection if the user has the ware-with-all to bother verifying the other number. Unfortunately that means that in many cases it won't help at all because many would not be aware of the other number and expect to find it when the fake messages come in - unless the user knows to expect and require it the fact a fake message doesn't have it makes no difference.

> ware-with-all

The word you're looking for is "wherewithal", I believe.

Werewithal (or werwithal) forthcoming dictionary definition: transformational withal, typically during a full moon, though it regularly manifests in Hacker News posts, causes not yet fully determined. The withals can be complex.

If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone

Unfortunately I don't think that will work because the attacker is in the middle. They can request the verification number, then forward it to the victim.

It sounds like we want identity verification, which while solved for computers, is much harder for humans.

This could work - similar to what happens in some bluetooth pairing flows. But you could still send a text message with a phishing link under the same Sender ID and fool someone into opening it. You'd really need to know that the specific sender would never a) send you a link, or b) send you anything without the "two-way verification" flow you suggested. I don't think any of those options are realistic at a certain scale.

Maybe I'm missing something, but why would this work? Isn't it just 12 digits going to one phone number instead of 6? (also thinking about this is bringing me back to SYN-ACK from the old days)

The user chooses the second 6 numbers. For dumb users this won't add any security, but for smart users this ring alarm bells.

I like it, at least, for now. It's better than the current situation.