Is phone number-based login more secure than using a password?