5 ms·

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), als

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

middleclick 10y ago
Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.
- zeeZ 10y ago
  Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?
  - irremediable 10y ago
    What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.
    - sitharus 10y ago
      Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Twitter uses a one-time code sent via sms so I don't think this would be an issue unless the hack is persistent.
      - irremediable 10y ago
        > Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Oh, damn. Thanks for pointing this out. I'd never looked into the details of HOTP or TOTP -- I assumed they were using public-key crypto rather than just a hash of shared values. That sucks. :(
    - zeeZ 10y ago
      Almost everyone here was talking about a leaked database of accounts, so I went with that if the database leaks, shared secret 2FA is useless. The article says data may have come from user input, so yeah, 2FA would actually help there and wouldn't "leak".
  - brian_cloutier 10y ago
    According to some guy on reddit you are correct: https://www.reddit.com/r/crypto/comments/3et3va/why_does_totp_use_a_shared_secret_instead_of_an/cti7l7b https://www.reddit.com/r/crypto/comments/3et3va/why_does_tot... The post also gives a justification for using symmetric encryption, it lets the tokens users enter be shorter.
- bad_user 10y ago
  While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebook as well). If you're worried about your privacy, which is understandable, buy a prepaid sim card, a cheap phone and use it only for your 2FA accounts. Not sure about the US, but in my country prepaid GSM sim cards are cheap and you don't have to give away your ID to buy one (though this may change soon).
  - heartsucker 10y ago
    To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.
    - cdubzzz 10y ago
      By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.
      - scrollaway 10y ago
        "Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking. So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.
      - heartsucker 10y ago
        But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.
imrehg 10y ago
Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used the username+somestring@gmail.com trick to reuse my address, as one email can be used with only one twitter account...) then change it back.
- shurcooL 10y ago
  Yeah, no Google Authenticator is a deal breaker for me too.
- silversmith 10y ago
  Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.
  - datr 10y ago
    There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.
    - scrollaway 10y ago
      Additionally, it requires an active phone number, which may not be available to you in general or temporarily.
  - doublec 10y ago
    It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...
jwildeboer 10y ago
I am trying to activate that as we speak, but I never get the SMS. I tried 6 times in the last 3 hours. I guess it's overloaded or broken at least for my phone number (german mobile phone).
- tombrossman 10y ago
  I had a terrible time figuring this out too, because the mobile app offers it and provides no feedback as to why it never succeeds. The reason is that Twitter only supports a very limited number of mobile carrier networks. Here's the support page listing them and you can see there are none for Germany: https://support.twitter.com/articles/20170024?lang=de# https://support.twitter.com/articles/20170024?lang=de# All I can suggest is to keep trying every few months. I have been trying for years. My carrier still isn't listed but it finally started working about two weeks ago for me (I'm not in Germany though). Now I have to hope it keeps working with my still unlisted carrier or I risk getting locked out of my account. At least the bad guys are locked out too...
- thedaemon 10y ago
  I work for a company that utilizes texting to customers, we do this now via email, ie 1233451234@vtext.com for Verizon and there are others for the different carriers. These carriers are beginning to put a halt to this and are starting to require you to sign up and pay them to send SMS messages. Soon my company will not be able to send any SMS without paying the carriers. Perhaps this is the problem?
thinkt4nk 10y ago
Unfortunately this only helps protect a twitter account. It doesn't protect against the greater concern, where the password has been cracked and the user has reused the password on other sites.

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

middleclick 10y ago

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

zeeZ 10y ago
Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?
- irremediable 10y ago
  What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.
  - sitharus 10y ago
    Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Twitter uses a one-time code sent via sms so I don't think this would be an issue unless the hack is persistent.
    - irremediable 10y ago
      > Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Oh, damn. Thanks for pointing this out. I'd never looked into the details of HOTP or TOTP -- I assumed they were using public-key crypto rather than just a hash of shared values. That sucks. :(
  - zeeZ 10y ago
    Almost everyone here was talking about a leaked database of accounts, so I went with that if the database leaks, shared secret 2FA is useless. The article says data may have come from user input, so yeah, 2FA would actually help there and wouldn't "leak".
- brian_cloutier 10y ago
  According to some guy on reddit you are correct: https://www.reddit.com/r/crypto/comments/3et3va/why_does_totp_use_a_shared_secret_instead_of_an/cti7l7b https://www.reddit.com/r/crypto/comments/3et3va/why_does_tot... The post also gives a justification for using symmetric encryption, it lets the tokens users enter be shorter.
bad_user 10y ago
While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebook as well). If you're worried about your privacy, which is understandable, buy a prepaid sim card, a cheap phone and use it only for your 2FA accounts. Not sure about the US, but in my country prepaid GSM sim cards are cheap and you don't have to give away your ID to buy one (though this may change soon).
- heartsucker 10y ago
  To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.
  - cdubzzz 10y ago
    By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.
    - scrollaway 10y ago
      "Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking. So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.
    - heartsucker 10y ago
      But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.

imrehg 10y ago

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used the username+somestring@gmail.com trick to reuse my address, as one email can be used with only one twitter account...) then change it back.

shurcooL 10y ago
Yeah, no Google Authenticator is a deal breaker for me too.
silversmith 10y ago
Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.
- datr 10y ago
  There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.
  - scrollaway 10y ago
    Additionally, it requires an active phone number, which may not be available to you in general or temporarily.
- doublec 10y ago
  It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...

jwildeboer 10y ago

I am trying to activate that as we speak, but I never get the SMS. I tried 6 times in the last 3 hours. I guess it's overloaded or broken at least for my phone number (german mobile phone).

tombrossman 10y ago
I had a terrible time figuring this out too, because the mobile app offers it and provides no feedback as to why it never succeeds. The reason is that Twitter only supports a very limited number of mobile carrier networks. Here's the support page listing them and you can see there are none for Germany: https://support.twitter.com/articles/20170024?lang=de# https://support.twitter.com/articles/20170024?lang=de# All I can suggest is to keep trying every few months. I have been trying for years. My carrier still isn't listed but it finally started working about two weeks ago for me (I'm not in Germany though). Now I have to hope it keeps working with my still unlisted carrier or I risk getting locked out of my account. At least the bad guys are locked out too...
thedaemon 10y ago
I work for a company that utilizes texting to customers, we do this now via email, ie 1233451234@vtext.com for Verizon and there are others for the different carriers. These carriers are beginning to put a halt to this and are starting to require you to sign up and pay them to send SMS messages. Soon my company will not be able to send any SMS without paying the carriers. Perhaps this is the problem?

thinkt4nk 10y ago

Unfortunately this only helps protect a twitter account. It doesn't protect against the greater concern, where the password has been cracked and the user has reused the password on other sites.