3 ms·
At first I thought the blame would be mostly on the cell providers but it seems Twitter deserves at least half the blame here. I just tested the flow. If your
by tempsy 7y ago
At first I thought the blame would be mostly on the cell providers but it seems Twitter deserves at least half the blame here.
I just tested the flow. If your phone is linked to your account, regardless of your 2FA settings you can just start tweeting to your account by texting to 40404 without being asked to enter a password and completely bypassing any 2FA settings on your account.
That seems highly unusual to me. Most of these attacks happen with the hacker knowing the password as well. In this case, so long as you’ve successfully ported the number you’re “in”.
- exolymph 7y agoEven worse than that, removing your phone number will _silently_ disable all other 2FA methods, even if you already had SMS 2FA turned off. The only way to prevent your phone number from being used in account recovery is to disable 2FA altogether, because Twitter does not allow any 2FA without a phone number attached to the account. It's appalling.
- techntoke 7y agoYes, actually they do allow 2FA without a phone number attached to the account and I have set this up multiple times.
- enra 7y agoHow? I just tried it and you need to add your phone number in order to enable the 2fa. After you setup the app 2fa, and go the the phone tab and hit delete number it will also remove the 2fa. Also it allows this without entering password or 2fa which is bizarre
- techntoke 7y agoI'm going to have to apologize on this. I did it before the recent site change, but I don't see anyway to do it now.
- pjc50 7y agoThis was the original use case of Twitter, to allow social media from dumb phones.