As a dev I love the idea that there's 3rd party to handle the finer points of my 2-factor auth.
As an end user, I don't want to touch your app with a 10ft pole since you're an untrusted/unvetted source holding on to some very important tokens.
As an end user, I don't want to touch your app with a 10ft pole since you're an untrusted/unvetted source holding on to some very important tokens.
For me at least (personal use, not company use) that's a worthwhile compromise: I doubt any attacker could get my main password in the time it'd take for me to change it in the unlikely event that Authy be compromised.