The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup o

The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure. I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above. If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0]. More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens. [0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...