Followup - authy's blog post confirmed what I thought: they do encryption of all the user-entered TOTP secrets on the client side and don't store decrypt keys.

Followup - authy's blog post confirmed what I thought: they do encryption of all the user-entered TOTP secrets on the client side and don't store decrypt keys. So anyone who was able to intercept your secret store would still have to decrypt it, which is (hopefully) Quite Difficult. link: https://www.authy.com/blog/security-notice-authy-response-to-cloudflare-cloudbleed-incident/ https://www.authy.com/blog/security-notice-authy-response-to...