Authy doesn't implement SMS 2FA (how could it). A phone number is part of your user profile for registered mobile devices hosting the app.

> Authy doesn't implement SMS 2FA (how could it).

https://www.authy.com/integrations/ssh/

"Someone in your organization doesn't have a smartphone? We got you covered. Authy SSH can send them the token via SMS or a phone call."

Even worse... Sounds like phone number is irrelevant, yet they collect it.

It's used to store and retrieve your 2fa secrets in case you lose your device

> > Even worse... Sounds like phone number is irrelevant, yet they collect it.

> It's used to store and retrieve your 2fa secrets in case you lose your device

The phone number doesn't store anything?

But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem.

Except it often is, and that's the problem.

Do what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.

You can enable multi device, and have it on multiple devices, then disable it.

https://authy.com/blog/understanding-authys-multi-device-fea...

Yep. I've done this. Lots of people I know use "burner" phones without cellular for 2FA.

How else are they going to track people with a hard-to-change identifier?

> How else are they going to track people with a hard-to-change identifier?

Using the device advertisee ID that the user is entitled to change.

// Sorry, for a moment I thought you were serious.

I just did some quick research on these IDs. Correct me if I'm wrong, but it seems like each user account would be tied to one device. It also seems like the user, at least on Apple devices, has to opt into advertising tracking in order for your app to even get access to this.

Ignoring the security pitfalls of phone numbers, it really doesn't seem like these advertising IDs are a drop in replacement for using phone numbers.

In fairness, you cannot. It requires a backup password.

> for the 100,000th time, just stop using phone numbers for 2FA.

I agree, and I say this to whoever asks me too, and I avoid any services that still use phone numbers as a way to associate it to you (Signal, I’m looking at ya!)

However, easier said than done, some services still require you to use a phone number, like banks, some government agencies, insurance companies, etc., the services that actually matter if your data get leaked. I believe there should be a regulation to prevent using the phone in any way to confirm your ID, and never force you to provide one to access such services.

If you use Authy, turn off "allow multi-device" and SIM-swapping isn't an issue. This should be on regardless of the leak.

But one of the selling points for me was to allow multiple devices so that if one broke I'd still have access.

You can enable multi device, and have it on multiple devices, then disable it (and keep it on multiple devices - it's just that then adding yet another device needs toggling multi-device on from an existing device, a confirmation SMS is not enough).

Perfect. I can just toggle it on when I add another device. Thank you, great solution.

people with this use case would need to be comfortable taking on the extra risk.

It doesn’t scare me because in Authy you also set a password which without you cannot access the codes.

The phone number here just acts as a username.