I agree stat sms is a horrible second factor.

However, just doing a second https connection just uses the exact same technological implementation as the first factor. It's still the best/ most advisable thing to do.

Best would be if we finally implemented TLS encryption over phone network that are outside of internet/cellular. I doubt that will ever happen tho. Mankind will abolish POTS infrastructure in favor of VoIP completely before we implement TLS on POTS.