I read their article but didn’t understand their methodology. This is pretty much in contrast to this video where a bunch of apps got audited and to everyone’s surprise Google Authenticator seemed like one of the most private alternatives.

Really not trying to defend Google here because… they’re fucking Google, but I’m wondering why the results are so different.