One of the things I really like about the file system is that it's a sort of universal API: if you can get the files a program has written, then you can do all

One of the things I really like about the file system is that it's a sort of universal API: if you can get the files a program has written, then you can do all sorts of stuff, like version control them, back them up (and restore them!), sync them across machines, and develop interoperable tools. This is particularly useful with an application that provides TOTP codes. But modern mobile apps have an architecture that makes reading directly from the filesystem the exception, rather than the rule, which leads to apps directly managing all their data in their own database, rather than in a shared filesystem. This removes a lot of user agency, and opens the door to tough-to-remediate bugs, like a new version of the app corrupting or erasing old data. > Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users’ apps share the same username. Google Authenticator and just about every other authenticator app add the name of the issuer — such as a bank or a car company — to avoid this issue. Microsoft only uses the username. I feel like mobile took a step backward when it made the filesystem a second-class citizen, despite some of the security improvements mobile brought with app sandboxing. Restoring from a backup would have fully remediated this issue, at least once folks understood what was causing it.