Is there any alternative beside sending One-Time-Password via SMS?

Why can't you use TOTP or HOTP which is standard and supported by most authenticator apps?

When people register for your service they need to enroll their authenticator app by scanning a QR code which contains the secret seed used to generate codes.

On subsequent visits the site prompts them to enter codes generated by the app, without any network access since codes are generated locally on the device.

As a bonus, since you're using standard protocols your users may already have a compatible authenticator app installed, and if not, could nudge them into using the app for more services (their Google account, etc). In the end, users are more secure and everyone wins.

Vulnerabilities in A5/0 and A5/1 are unlikely to be a major issue for your authentication of a small system with a few hundred clients.

However, if you want to avoid using GSM as a delivery channel, you could have a time-based OTP (TOTP) using Google Authenticator. You would need to create a secret for each user on your server, which he/she can scan with the Google authenticator app. A sample of how this works is here

Since the question is about ideas:

Automated voice call with PIN code verification before spelling out the OTP.

• Very easy for inexperienced users - doesn't require additional software, instructions given in real-time, for example:

  Hello this is mirsad's verification system. Please enter your PIN to hear the password for your download

  Thank you, your password is ....., please use it within five minutes. Remember, do not give this password to anyone else!

• Requires users to remember PIN code

• Safer than SMS - prevents passive password retrieval (an attacker cannot read from the screen of an unattended device)

• Requires measures to prevent snooping, for example:

  • listening side produces random audible tones during PIN input and retrieves user-provided code by calculating the difference (my bank does it)

  • ask user to type a different set of random digits from a longer PIN, i.e. "press the 6th digit of your PIN, press the 3rd digit of your PIN" (my other bank does it)

As mentioned previously, both TOTP and HOTP are both standards which exist as alternatives to sending one-time codes over SMS.

• TOTP are time-based codes, and are often available using apps like Google Authenticator, or as RSA SecurID-style fobs or cards.

• HOTP are HMAC-based, and are often available through token-generating software, including Google Authenticator and similar platforms.

• There's also the OTP standard implemented by Yubico in the early-model Yubikeys, where the hardware USB dongle emulated a keyboard in order to enter an extremely long one-time password.

And finally, if we are to bring up options which aren't strictly OTP, but can act as a second factor:

• U2F, an open second-factor standard (stands for Universeal 2nd Factor). It relies on a challenge-response mechanism with a key exchange occurring at hardware registration time. Yubikeys are probably the most popular U2F fobs out there right now.

• Because they also rely on a key exchange and challenge-response mechanism, SSH keys could conceivably be used as a second factor when authenticating. This method doesn't see widespread use, however.

• PGP keys, likewise, can be used for this purpose — and like SSH keys, applications where PGP is used as a second factor are, to my knowledge, currently limited.