THE problem with Authy in my humble opinion isn’t just that it’s an obnoxious proprietary app I shouldn’t need — it’s that it forces you to accept SMS as a get-out-of-security-free card. Being able to get a reset text to your registered number (and you MUST register a number, of course) unlocks all your OTPs for the attacker (who slipped some teenaged phone salesman $50 or a fake ID to swap your sims.)
SMS is cancer to security and I won’t use any system that forces me to accept something so easy to exploit as proof of my consent.
SMS is cancer to security and I won’t use any system that forces me to accept something so easy to exploit as proof of my consent.