Two-factor authentication: SMS or app?

Apps are definitely more robust, but don't make too big a deal out of SMS either - most people don't get hacked because their carrier redirects their messages, that's more of a targeted thing. That said, if you have the choice, you might as well go with the app, it costs nothing and you'll sleep better at night.

SMS and app aren't really on the same security level, but not for the reasons people usually think. The thing is, SMS can get intercepted through SIM swapping or redirection at your carrier - it's rare, but it happens especially if someone's actually targeting you. An authentication app generates its codes locally on your phone, so interception becomes pretty much impossible. After that, if your phone gets stolen or hacked, both methods can be compromised, but at least with the app you've got something that works offline and nobody can sniff on the network.

What you really need to understand is that the real weakness with SMS isn't so much the technical interception - that stays marginal - but rather social engineering. Some guy calling your carrier and managing to get SMS sent to his line is easier than you'd think. With an app, there's no that attack vector. So yeah, the app is more robust, especially if you need to protect a really sensitive account. For less critical stuff, SMS works fine, but if you have the choice, you don't overthink it - you go with the app.

I personally use both at the same time on my important accounts, and it's clearly the best approach! Like for my bank or main email, I switched to an authenticator app because SMS made me anxious - I'd read stuff about SIM swapping and honestly it freaked me out. But for less critical things like social media, SMS is more than enough, and it saves me time. The whole idea is just not to put all your eggs in one basket!

It's not even really a question - an app is objectively more secure than SMS, full stop! SIM swapping has become pretty common and SMS codes can really get intercepted, whereas an authentication app generates its codes locally, there's nothing anyone can do about that.