Hacker News Reader

Agreed. If BOTH are required than even if the second factor is relatively weak, it's still better than password-only.

If both are not required it's not a second factor. Two factor is something you know (password) plus something you have (a phone number).