Authy uses a modified form of TOTP. CloudFlare requires Authy, not a standard TOTP implementation. They make this very clear when you try to activate 2FA.

Authy works as a third-party authentication provider. Their servers are in the loop on every login. They aren't just a TOTP app + synchronization, they actually do the code validation themselves.

The correct analogy would be if every time you went to a website in Firefox, it asked Mozilla's servers if it was OK to go there. Also if, when installing Firefox, it demanded you create an account and give your cell phone number to Mozilla. (Or better yet, Google.)

Tbh, to setup sync or install extensions in Chrome, you need a Google Account, for which you need to give them your cellphone number. And it uses a blacklist hosted by Google to check if a page should show a malware warning, or not even display at all.

So your scenario isn’t even that far off.

I just installed AdBlock in Chrome, via the Chrome web store, on a Windows 7 box, that has never had a Google account logged in on it. So at the moment, I see no evidence that you need one to install extensions. Even if you did need one to install from the Chrome Web Store, you can also side-load.

With regard to the others, there are crucial distinctions:

* Chrome synchronization is entirely optional. You can use Chrome without ever logging into Google's servers. That's not the case with Authy.

* The malware blocklist feature uses data stored on your local machine that is frequently updated from Google's servers. It does not send the URLs to Google. Even aside from privacy implications, that would be annoyingly slow. And the block can be bypassed (last time I saw it, anyway) with a single click.