I remember this fact in 2021 (I had almost forgotten about it). AOPP is a KYC method to prove that a certain user owns the address, right?
Although it facilitates providing a simple and automated solution for signing a message with the wallet address that supports AOPP, it would be better if BitBox02 took a similar approach to Trezor by offering a guide for manual address verification.
The problem is that they are based in Switzerland, where it seems they are legally required to enforce AOPP.
However, from what I read on the
BitBox blog, during the execution of AOPP, the wallet displays the message to be signed by the address and the user confirms the signature. The problem is that the message and signature are automatically sent to the exchange, although they claim that only the signed message and the address in question are sent and not the extended public key or any other metadata.
They also state that using AOPP is voluntary and only necessary when using exchanges/services in jurisdictions that require it, but this is what is problematic.