Auto-complete of second factors such as SMS codes should be consider browser mediated

[johnwilander]

In addition to the use of WebAuthn or a password manager, auto-complete of an SMS code may also be a trustworthy signal of the user logging in and should be included in the browser mediated category.

[gffletch]

SMS based "authentication" has been 'restricted' by NIST circa 2017. https://www.onespan.com/blog/nist-softens-guidance-sms-authentication

At the same time, push notifications to a trusted App are much more secure. While the browser can't detect this (push to app) method directly, it is a better authentication method than SMS codes. I am concerned about the browser treating this method as a "mediated" method which is less secure than other methods which can not be classified as "mediated". It may push sites to use less secure authentication methods which weakens the security of the user.