It would be nice if a company did the right thing by themselves, not only when the angry mob shows up.
- Keep things as they are
- Avoid TOTP data getting lost with lost passwords
- Avoid TOTP data getting distributed when the Google-side backup ends up becoming public
Maybe this might have been a suitable situation for a "beta" label, though: "We have this, it offers advantages, it has caveats, if you don't care about them, feel free to sign up, otherwise wait until we sorted it out."
(Disclosure: work at Google, but no insight into what Authenticator is doing)
It seems like most of the time when there's some kind of outrage (at least on HN) there's just silence for 20 - 40 days, then some kind of announcement that either doubles down or backs off. This whole outrage started what, Yesterday?