If they don't have a phone number they can't do all that transparently, which is bad when you are aiming your service at a broad audience.
If they don't have a phone number they can't do all that transparently, which is bad when you are aiming your service at a broad audience.
I'm not really interested in defending it, I probably don't like the idea of depending on a third party any more than feld does, I was just pointing out that there are simpler explanations for what they are doing than I'm not buying the story that you need to text me or call me unless you're storing the seed/token centrally and sending it to users upon request which I strongly disagree with.
Another one is that if they actually implemented TOTP like that their business would take a lot of damage when it was revealed publicly (because what's the point of paying for a broken implementation?).