3 ms·

This is mobile operator problem, not Twitter. How on earth the mobile operator can hand a SIM card to someone else?!

• willvarfar 7y ago
  Because people get new sims and legitimately transfer their numbers _all the time_. I'm not saying they shouldn't put more effort into verifying the transfer, I'm just explaining why its quick and easy and they don't invest in checking much.
• brod 7y ago
  This was a problem before Twitter allowed 2FA via SMS, so I'd argue this is very much a Twitter problem. Afaict this all stems from mixing verification with authentication, where verification may be required when creating an account and authentication (and possibly more verification) when using the account.
  • brod 7y ago
    And even more simply, verifying the user is a "real person" in contrast to verifying the user is the "right person".
    • nialv7 7y ago
      How does that help? Surely the attacker is a real person too.
• danShumway 7y ago
  Twitter is the service that accounts are being stolen from. There exists a trivial solution to the problem (stop allowing people to reset accounts via only SMS verification). As a user, I'm at risk because Twitter is refusing to implement that trivial protection. I don't care who's fault it is, but it is very much Twitter's problem.