Nothing

Apparently it is hard to export out of authy

I would argue its more like a 1.5 factor. Not secure when your bitwarden gets compromised. But more security for stolen, leaked, phised passwords.

I currently have 60 OTPs in Bitwarden, I probably would not have activated 2FA on so many sites without BW.

Consider your threat model. You could use a yubikey for Bitwarden log in.

You lose security, sure. But you are gaining so much more ease of use. Bitwarden autofills your credentials and puts your token into your clipboard. Also it syncs your tokens to all devices. Effectifly this makes a site as easy to login as a site without 2fa.

The alternative is on desktop always get your smartphone, open some app type a token or on the phone to switch to multiple apps to get your credentials. Not fun imho.

I currently activated 2fa on over 60 sites, I doubt I would use it as much without BW.

For me, the key benefit of 2Fa is getting more security against leaked, stolen, phished passwords, and that still holds up.

Sick! I didn't think to look at the forks but that's amazing.

Anything closed source could have backdoors. Trust no one.

Why does MS Authenticator need GPS permissions?

https://play.google.com/store/apps/datasafety?id=com.azure.authenticator

That depends. More of the popular ones don't encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
Some even uploads the keys to a cloud service for convenience, and they consider it a feature.

Said in the reply to the other comment here, but I don't really self host for security/privacy sake. And in addition to that comment I'd also like to say that I do use a YubiKey when possible for MFA. I'm not a security nut enough to care about TOTP (which kinda sucks anyway) all too much but for important things I do use physical MFA.

Fair, although I've said in a comment on this account somewhere else, I self host more for convenience sake than anything. I just like having my own password manager, sure it's not as secure to use it for MFA but it's better than giving my passwords to Google, LastPass, etc. and then using eg Google Authenticator. Self hosting is more a corporate distrust thing than a privacy thing for me

Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.

Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol