Thank you, digital_ins. Yes, I know it's scary. If we get some traction - we'll probably convert the SoundLogin project to open-source. We are already talking with potential backers. I think open-source is the best route for trust-based product.
For now, we have to rely on browser extensions (maybe in the future some services will integrate our scripts directly on login pages). Browser extensions are in JavaScript. The code is available to everyone for review. To reduce concerns we do not use any analytics or tracking code in browser extensions or mobile apps.
Thanks for the tip on bookmarklets, we'll check if it is technically feasible.
Benefit is convenience. 2FA requires you to enter 6-8 digits (4 is not secure). If you have to do it every time you login to your account (e.g. AWS, Github, Twitter). It may be really annoying. So, we try to improve 2FA usability.
Thank you for feedback!
1) Yes, we are planning to add more sounds. We have 5 different melodies for now (in Settings), but we'll try to add more and also add an option for custom soundtrack as well.
2) The sound technology is sort of acoustic watermarking. It is based on multicarrier spread spectrum and it uses simple masking mechanism to hide behind host audio signal. It should be quite robust in various noise scenarios and multipath propagation (although every system has limitations)
3) Did you enable 'encryption' in settings? For web-test do not turn on 'encryption' in app settings. If you enable encryption the decoder shall detect wrong sequence (even if your password is blank). We use it to protect our acoustic channel. If an adversary will try to intercept your 'encrypted' acoustic signal he/she will not be able to decipher it and even know if the encryption is enabled or disabled. On the other hand, SoundLogin has internal error check mechanism - probability that the decoder will come up with wrong number because of channel noise is less than 10^-10.