The material in here isn't terribly wrong but it seems like an elaborate way to say “you should have a threat model when making security decisions” and “RSA is overselling their software tokens to the point where legal authorities should investigate”.
In particular, it's about 5 years obsolete with no mention of U2F/FIDO, which avoids all of the problems mentioned and prevents phishing attacks from succeeding if they capture TOTP/SMS challenges.
In particular, it's about 5 years obsolete with no mention of U2F/FIDO, which avoids all of the problems mentioned and prevents phishing attacks from succeeding if they capture TOTP/SMS challenges.