3 ms·
Authy service (one where they send you SMS) is centralized. It's not that it's safe or unsafe, but generally decentralized is better option.
by homakov 9y ago
Authy service (one where they send you SMS) is centralized. It's not that it's safe or unsafe, but generally decentralized is better option.
- zwily 9y agoAuthy also can backup your TOTP tokens (encrypted with passphrase on device). This is super handy when switching devices, but weaker than Google Auth where the TOTP private bits never go back to Google in any form.
- homakov 9y agoYes, sorry, that TOTP backup thing is great. Always hated that GAuth cannot back up. But what was meant is the SMS service they make money on.
- rocqua 9y agoThere have been quite a few cases where SMS authentication proved unsafe. It's gone so far as NIST recommending against SMS as a 2nd factor. In short, providers are rather too willing to transfer a mobile phone number.