Authy has access to the secrets if someone enables cloud backups, but they're encrypted with a user-provided key that must be re-entered upon syncing to a new d

Authy has access to the secrets if someone enables cloud backups, but they're encrypted with a user-provided key that must be re-entered upon syncing to a new device. I'm aware of the simjack risk, but that would require: 1. That I'm using cloud backups 2. That the attacker has also obtained my backup key None of this seems fair to summarize as: > Your security tokens can be reset using SMS. I'm not claiming Authy is perfect, but it seems to use a reasonable approach for people who don't fall under the "high value target" category.