I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number.
Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have my phone number. 2) authy runs out of money and needs a revenue stream. Thus it changes the TOS and starts selling phone numbers. 3) authy shuts down. Who knows what's going to happen with my phone number then.
No. I'd rather use any other HOTP app that doesn't require any personal data (which is one of the basic ideas behind HOTP).
Authentication and my phone number are the two things you have to really prove you have got your act together before I trust you with them.
They already answered on these comments with regards to their already functioning revenue model. Banks pay them for securing their sites. They're a YC startup. You're on HN and you're afraid of trying out new technologies because they're offered by new startups?
No. I'm not afraid at all. Indeed I have accounts with most of the projects that are being shown off here. Some paid, some just trials. Some I still use, some I don't. However, I'm very cautious with entrusting my phone number or authentication related applications to a startup.
That's all I said. I'm not saying nobody should trust them. I'm not saying they aren't trustworthy in general.
I just said that I don't trust them with my phone number (or gmail HOTP secret for that matter).
Especially in matters of authentication services that require more private information than what's strictly needed leave a bad taste in my mouth.
Cellphone numbers can very easily be abused to steal money (premium SMS), to steal my identity, to spam me in the middle of the night, to pull me out of the "zone" by calling me/messaging me during work hours, to track my location while roaming and probably a lot more stuff that's not currently apparent to me.
Also, my phone number is known to some identity providers I trust. If they sent me an SMS asking me to click a link, I might be inclined to follow that link. This is quite right despite the sender being very easily spoofable because nobody but these identity providers know my phone number.
It is ridiculous to think that your number is private and even moreso to think that someone can steal money with just your cellphone number.
Of course you could be phished or tricked by SMS but to expect your number to be private is to expect everyone ever who you give the number to go to extreme to keep it private as well.
If you ever gave your number to someone who downloaded an app which has permission to contacts your number is no longer private (Facebook has taken big advantage of this, I'm sure there are less than reliable apps that took bigger advantage).
It's actually fairly easy in some cases. If the user is with Virgin mobile, their 6 digit password can be bruteforced in a couple of minutes, and then every text and call they've ever made is public. I've made a fuss to them about this quite a few times, but they've never done anything to fix it.
This is a fair point - not the flakiness or otherwise of Authy, but giving out a phone number. I hand it out like confetti, it being, well a phone number. But now it is the key to my google account.
It's not hard to pluck SMS out of the air and sooner rather than later that's going to be a new attack.
Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have my phone number. 2) authy runs out of money and needs a revenue stream. Thus it changes the TOS and starts selling phone numbers. 3) authy shuts down. Who knows what's going to happen with my phone number then.
No. I'd rather use any other HOTP app that doesn't require any personal data (which is one of the basic ideas behind HOTP).
Authentication and my phone number are the two things you have to really prove you have got your act together before I trust you with them.