Instinct Now Holds Your Second Factor, and Security Twitter Screams

What people were saying

The day belonged to one feature. @noahrshinn announced that Instinct can now generate and enter TOTP codes itself, the same standard your phone authenticator uses, stored alongside your password in Vault. The stated reasoning is practical: 37% of users save at least one password in their first three weeks, and a six-digit prompt is where an otherwise finished task goes to die.

The stated reasoning did not carry the day.

The pushback

The objection was crisp and repeated by roughly forty people independently, which is usually a sign the objection is correct. @orenbarzilai put it plainly in the replies: two-factor auth is something you know plus something you have, and if both live in the same vault, the second factor is just a longer password. A sizable Hebrew-language contingent piled on with varying degrees of despair, one noting that authenticators are apparently where security goes to quietly expire. Others predicted a coming wave of people who lose a lot and never quite understand why.

Separately, @varun_mathur raised a structural worry: delivering blue bubbles at scale means a relay farm doing matchmaking across a shared identity pool, and you are trusting someone's routing logic not to cross wires. He also, earlier in the day, suggested Apple or Google should buy the company this weekend for anywhere from $20B to $50B, so his position is nuanced.

The praise

@Jack_Raines asked whether anyone is actually using this thing, and got ninety-nine replies that mostly amounted to yes, extensively. Cleaning company quotes. An insurance adjuster. Trip planning in Paris. One person got pulled over without registration and had a replacement plus a temp ordered within minutes. Another used it to scrub his name from data brokers.

@drjoshcsimmons claims $14,000 saved, including 25% off Verizon and a refund for melted protein bars, all dispatched over iMessage while holding a newborn. @aitordri had a company chatbot promise a $1k bonus four times before a human reversed it; Instinct got the money in two days. @mvanhorn catalogued nine prompts people are running, including unclaimed-property sweeps (over $2,000), Amazon back-refund audits across sixteen years, and a Comcast bill negotiated from $100 to $60.

Notable anecdotes

@VoyageBliss offered the most useful post of the day: read-only Cloudflare tokens, secondary frequent-flyer accounts, low-limit cards, and a request for an independent security audit before anyone hands over the good credentials. @barsisyphus reported the opposite of magic, getting nothing from Resy. And @NotZainAgain let it loose on his inbox, learned it had replied-all to something, and decided to find out later how bad it was.