Quote from: RickDeckard on February 21, 2022, 10:57:13 PM

If you let me o_e_l_e_o, I would like to point out what Authy claims[1] that they track (we don't know if it's all of it though) just to give other users an idea of what a "simple" 2FA app can track

On those lines, here's a post I made about Authy about a year ago which also picks out some interesting snippets from their Privacy Policy:

Quote from: o_e_l_e_o on March 04, 2021, 02:00:37 PM

I was reading from here: https://www.twilio.com/legal/privacy/authy

Quote

If we cannot easily confirm that you are the rightful account holder of the Authy account associated with your old number, we will ask you for your phone account information and a copy of physical identification such as a drivers’ license, national ID, or passport, which we then use to confirm your claim to the account. From time to time, if there are other situations where we need to verify that you are the rightful account holder of your Authy account, our support team may require you to provide identity information like a drivers’ license, national ID or passport.

Emphasis mine. More worrying that just for account recovery, they may also lock you out of your 2FA account (and therefore all of your online accounts which use 2FA) and demand KYC "from time to time". How reassuring. Roll Eyes

Quote

When you use an Authy token to log into an account, whether the token was generated on the app or one sent to you via your phone number, we collect and keep information associated with your login activity including information like your IP address, what application or program you logged in to, that you logged in, and when.

They track your activity across all your accounts, linking that to your email address, phone number, and IP addresses...

Quote

Over the last year, we have shared Identifiers and Internet or other electronic network activity information with third parties, as we describe in this section.

...and they share it with third parties.

I don't understand the benefit of this service. It is the equivalent of a web wallet for 2FA: You are letting someone else handle all your codes, have the power to lock you out of your accounts, and invade your privacy, all for something you can do yourself easily, freely, securely, and privately.

Quote from: RickDeckard on February 21, 2022, 10:57:13 PM

I would also like to remember that just five years ago, a user reported on r/bitcoin[2] that if you had multi-device setting ON Authy wouldn't protect you in case of a hacker gained access to your number (spoofing probably)

I did not realize this, though. This is absolutely appalling. This reduces the security of your entire 2FA set up to that of SMS 2FA, which is by far the least secure method and which everybody should avoid at all costs. Phone numbers can be stolen or phished in under 5 minutes and a single phone call to your carrier.

So you go to all this effort to set up Authy, knowing that despite the flashy interface and nice promises, you are only as secure as the worst 2FA method available, they spy on you, and they can lock you out and demand KYC at any time.