15 ms·
Twitter lets you use 2FA without a phone number
- behnamoh 7y agoFacebook doesn't even let you sign up without a phone number anymore. How did we get here?
- gkoberger 7y agoWell, I think the argument (whether you buy it or not) would be that platforms like Twitter and Facebook are trying to curtail abuse and bots, and "owning a phone number" is a decent way to tell if someone's human. To my knowledge, neither has ever texted or used the phone numbers for anything other than verification.
- londons_explore 7y agoExcept with number porting and the ability to be allocated hundreds of thousands of phone numbers by filling in a bit of paperwork, the whole thing seems moot.
- aristus 7y agoAhem: https://www.engadget.com/2018/09/28/facebook-two-factor-phone-numbers-ads/ https://www.engadget.com/2018/09/28/facebook-two-factor-phon...
- jeromegv 7y agoBoth can be true. I tried to open an anonymous Facebook account. Could never succeed. My twilio number was refused. I couldn’t give my normal phone because it’s already associated with my other Facebook account. They do want to limit the number of accounts per person even if that meant more accounts to advertise.
- jmccorm 7y agoI remember looking over the application form for the first Oculus Connect (after Oculus was purchased by FB). What struck me as odd was that the form didn't just ask for your phone number. It asked for your mobile telephone number. It was an unusual distinction that I hadn't seen before. Now, it could be nothing, but I came to a personal realization just how valuable a telephone number could be for such a well-positioned company to do a deep-dive into a person's background just by using their mobile number as the key to tie additional records to the user's identity. Or their activities before, during, and after a company's conference. To answer your question, I believe that Facebook wants the (mobile) telephone number of their users to facilitate any number of additional uses, and "account security" is one actual use that lets it slide under the radar of most people. Clever! (Or depending on your POV on privacy and personal security, unfortunate!)
- oefrha 7y agoThese days companies ask for cell phone numbers because no one uses landlines anymore. I fail to see what’s strange about that.
- jmccorm 7y agoI tried to make that distinction clear. I'll see if I can do a better job. Most companies ask a customer for a telephone number in their forms and in their applications. Actually, just about any context where the customer's mobile device is not the item of attention. This was my first encounter with a company that specifically requested a mobile telephone number in their application. This unusually specific request illuminated some interesting possibilities in my mind. If you experience circa 2014 has been different, actually, that's great! I'd like to see and compare some similar event applications around that same time period. (Still, it was the possibilities for the uses of a mobile number that really flagged my interest as well as the relevance to this conversation, not the rarity today of companies specifically requesting a mobile number.)
- oefrha 7y ago> mobile telephone number Did they use those exact words? Sounds strange to me as most American English speakers would say “phone number” or “cell phone number”, and both are used pretty much synonymously (because in practice they basically are) for a long time. More formal forms (government forms) might ask for something like “daytime phone number”. In particular I haven’t seen the word “telephone” in ages.
- sprice 7y agoThis is great. I ported my primary phone number into Twilio years ago. Most apps/websites have no problem with a `voip` number type. But some systems, including Twitter, have refused to accept it.
- illnewsthat 7y agoWhy did you port your number to Twilio? Isn't it a pain for things like group messaging?
- xyzzy_plugh 7y agoNot OP but I think I've participated in a group SMS maybe twice in 10 years and initiated none. I don't feel like I'd be missing out by not having group messaging support.
- nefitty 7y agoI use group texts every day so that would be a deal breaker.
- filleokus 7y agoDoes group SMS even exist? I know that you can send the same message to multiple recipients, but does it support "revealing" the recipients to each other? Or am I just out of date? I haven't sent a proper SMS in probably 5+ years.
- javagram 7y agoMMS is used for group texting. It's extremely common in the USA since most people in the usa have phone plans that include unlimited MMS and SMS, third-party chat apps like WhatsApp never became ubiquitous here as a result of that basic functionality being available through the phone.
- 7y ago
- jumelles 7y agoI can't believe it's taken them this long for proper 2FA.
- lysp 7y agoNot proper as it only allows a single key.
- FabHK 7y agoYou could argue that it’s up to you to have a proper key backup strategy (ie not Google Authenticator). You don’t have several user names and passwords for one account, either.
- tialaramex 7y agoThe specification for WebAuthn (Security Keys) explicitly tells implementers they SHOULD support multiple tokens because otherwise the recovery scenario is terrible. You can't realistically "back up" cheap Security Keys, their whole design is predicated on your being unable to extract the secret inside them which makes them work.
- FabHK 7y agoThanks, I stand corrected.
- roca 7y agoUnfortunately there are two big problems: -- You can't provision more than one security key. I want to provision a backup key. -- You must have TOTP or text-message 2FA enabled in order to use a security key. But the very reason I want to use a security key is because I don't want to trust my phone!
- rob-olmos 7y agoI wish I could understand why platforms are still only allowing one hardware key, especially a platform like Twitter with a sizable base of advanced users.
- tialaramex 7y agoRight, should we assume they're too incompetent to read where the spec says to do multiple keys? That's not good. Maybe they're too lazy to do the work? They're actively trying to discourage good practice? There aren't any good excuses.
- aftbit 7y agoYou can do TOTP authentication on any device that you do trust. It's just an HMAC of a timer. I use oauthtool: https://www.nongnu.org/oath-toolkit/ https://www.nongnu.org/oath-toolkit/
- toomuchtodo 7y agoAre there any tools out there where the TOTP seed is encrypted and multiple parties (X person key system) are requested to auth to grant access?
- ses1984 7y agoWhat do you mean by x person key system, multiple parties are requested to auth to grant access, something like shamirs secret sharing?
- 7y ago
- noodlesUK 7y agoWhy can’t we have more than one u2f key??? The most important guarantee that u2f gives you is a significant reduction in phishing risk. I can still be phished with a totp code by a social engineering attack and something like Modlishka...
- karpathy 7y agoI was also really hoping they would slip this into the update too, but looks like not yet unfortunately :( The whole login security ecosystem across the web is in a state of high entropy flux. Some websites still don't offer 2FA, some only do text, some demand text, some don't even offer text, some offer authenticator apps, some force specific authenticator apps, some offer hardware tokens, some allow only a single hardware token, ... The U2F hardware tokens themselves are only compatible with some of your devices due to the variety in ports, etc. And a typical person will have to have an account with ~100 different places that they want to use with continuity across multiple devices.
- filleokus 7y agoYeah, recently demo'ed Modlishka to my org, really scary stuff... Re U2F keys: I think I would prefer a security model where I provision a U2F key based on some master secret stored in a "secure" but accessible way, i.e paper. Then I could create a new key with the same secret when I loose or break the first one. Having two U2F fobs seems almost like having two different locks on all your doors, setup so that only one is needed to open the door.
- mrb 7y agoIt's possible to do what you describe with existing open-source/open-hardware U2F security keys, as they let you define the master secret from which the per-site private elliptic keys are generated. I haven't personally tried it, though. But for security you should still have at least two U2F security keys using different master secrets (if you lose one security key, you can deactivate it without deactivating the other).
- olliepop 7y agoNo doubt because Jack Dorsey was SIM jacked[1]. SMS 2FA is incredibly insecure. [1] https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-dorsey-hack.html https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-...
- GhostVII 7y agoI think SMS 2FA is fine for the most part, so long as you have a decent password, the problem is when companies introduce recovery numbers and make it back into 1FA
- lotsofpulp 7y agoHow is it fine for the most part when it’s been shown that thousands of employees working at the mobile network have the ability to forward your number thereby rendering the 2nd factor useless? More importantly, there simply isn’t a reason why TOTP, a superior actually secure 2nd factor that doesn’t rely on a third party, can’t be offered, unless you want to force the user to cough up their phone number so you can track them.
- FabHK 7y agoThe attacker would have to steal the password and SMSjack someone; that’s a fairly tall order (maybe feasible for targeted attacks, but it should be sufficient to thwart opportunistic attacks.) The problem is that many sites allow password resets with the SMS, thus rendering it 1F, as GP said.
- GhostVII 7y agoI think it's fine because in order for someone to hack me if I have true 2FA authentication with SMS, they would both have to both get my password, and do some kind of social engineering attack to get access to my messages. If you have a secure password already, that is probably good enough security for the vast majority of people. Just because the second factor can be compromised, doesn't make it useless. Pretty much any security mechanism can be breached, it's all about increasing the difficulty of an attack until it matches the value of what you are trying to protect. SMS 2FA protects you against untargeted attacks like credential stuffing, which is probably sufficient for 95% of people.
- AA-BA-94-2A-56 7y agoI still can’t log into Twitter because they refuse to send the verification to my phone number. It’s been three weeks of multiple emails to their support. All this and I only need the damn thing for my data analysis course.
- nomooses 7y agoThis is wonderful news. I hope that others follow their example. (In particular, Apple...)
- wyuenho 7y agoWhat took Twitter so long?
- FabHK 7y agoGood, but pathetic that it took so long. The only other 2FA I still do via SMS occasionally is a bank.
- badrabbit 7y agoTwitter,google and the rest refuse to let you register without a phone number and they are agressive about not letting burner services. So I spend money buying burner sims. I can. But normal people can't. They use phone numbers more than IP addresses to uniquely identify people. Never use apps if you can use a website! And screw these companies that are sneakily hostile against their own user base.
- ganlaw 7y agoTwitter lets you register without a phone number. All you need is a email
- judge2020 7y agoI believe recently it will lock your account for "suspicious activity" or something until you verify by adding a phone number.
- typenil 7y agoThat's been my experience.
- flingo 7y agoThey've done that for a couple of years. If you can actually submit a support ticket, get them to agree that a phone number is not required (like it says on their website), and to reply when that's done, you'll get your account unlocked after a few days. (usually)
- nontoxyc 7y agoI use a lot of burner phones cuz I'm paranoid, and when you sign up for fb/google/whatever they treat a burner phone you just turned on completely different from your regular, existing phone number. Example: if you activate a burner phone and sign up for tinder with the number, it pauses after you enter the code and then asks for your email address. You have to sepetately login and verify your email. On the other hand, if you sign up for tinder with your normal number you're verified; it doesn't request an email address. They get some kind of information packet about your account that I would guess includes activation date, your approximate age, whether your service is prepaid etc. I should say, I use the term "burner" for a cheap Android phone you insert a bring your own SIM into. Don't worry, it's not that anonymous because they also track/correlate your device IMEI with the services you use. I had an interesting experience the other day. The burner phone service expired, and tinder knew within 24 hours the number was no longer active...... Creepy. 2010-2019 has been the smart phone decade and now it's coming to an end. I'm celebrating by letting my cell service expire. My smart phones leak way too much data. I'll be using my too-smart phones like an ipad, making and receiving calls and texts only when I'm connected to WiFi at home.
- shurcooL 7y agoI'm glad this happened; I've been waiting for more than 5 years for this.
- trimbo 7y agoBut I still had to add and verify my email before I could add 2FA.
- jokoon 7y agoI had 2 twitter old accounts over the years, I stopped using twitter and I end up having both disabled. I messaged their support but got no answer.
- jillesvangurp 7y agoI simply refuse to do 2FA with phone number. I change phone providers and phone number more often than email provider. I generally don't trust my phone provider to act responsibly and fully expect to get ripped off by them and their customer support to do all the wrong things. I implemented 2FA server and frontend support at some point and it's stupidly easy to do. It's arguably a lot easier to do than building SMS based 2FA because you don't need the integration with SMS. All you do is show a QR code, store the shared secret, and then run a simple algorithm to verify the current code and timestamp line up with what the user typed when they login. The algorithm for generating codes compatible with Google Authenticator, Authy, etc. is available in OSS form for several languages. Same for QR code generation. The rest is bog standard UX work and a bit of DB plumbing.
- diveanon 7y agoI hope paypal and transferwise follow this example. International travelers have been suffering for years due to this horrible ux. SMS based 2FA is a farce, I look forward to it going extinct.
- adambowles 7y agoPayPal[1] and TransferWise[2] already support TOTP, am I missing something? [1] https://www.paypal.com/us/smarthelp/article/faq4057 https://www.paypal.com/us/smarthelp/article/faq4057 [2] https://transferwise.com/help/12/managing-your-profile/2932125 https://transferwise.com/help/12/managing-your-profile/29321...
- diveanon 7y agoBoth require that you have sms based 2fa first. I have had this conversation with both of their support departments and its a non starter.
- eliseumds 7y agoWho came up with the idea of using SMS for 2FA in the first place instead of e-mail? It sounds insane.
- nyuszika7h 7y agoAs if they won’t arbitrarily lock your account and force you to enter a phone number because of “suspicious behavior” anyway... You could already disable SMS 2FA after enabling TOTP, but removing your phone number completely used to disable 2FA.
- VvR-Ox 7y agoSame here. I didn't want to give them my number and they blocked my account because of 'suspicious behaviour'. Now I wrote to their support after reading this and I am very interested in their response. I think if they go on trying to force me I will just delete the account. This is the only thing that helps those companies to understand their users needs when they have problems listening or seeing them on their own, I'm afraid.
- VvR-Ox 7y agoUPDATE: The support was very fast and kind and they unlocked my account without the need to provide a phone number.
- donalhunt 7y agoStill does from my experience today! If you log into your account and turn off SMS-based 2FA it also turns off TOTP-based 2FA!! Fortunately I wanted to switch to a different authenticator anyway (twitter buried their TOTP tokens deep within the android app).
- Yizahi 7y agoLet me guess (they didn't define it on linked page) - 2FA with a physical token only works in Googlenet Chrome?
- deleted 7y ago[deleted]
- sambe 7y agoI don't understand. I already have authenticator app ticked, and this doesn't appear to be the new default - I have it in the authenticator app already too. If I untick SMS, it says this will disable 2FA. What gives? EDIT Looks like a bug. Deleting the phone number gives no such warning, and 2FA continues to work.
- ycombonator 7y agoAnd people in the 60s thought we would be commuting in flying cars by now.
- Abishek_Muthian 7y agoBut if you reply to a tweet too soon to be misidentified as Bot & get blocked; then you have no choice but to link your mobile number to get unblocked.
- RandomBacon 7y agoYou don't even have to tweet before you get blocked. I created an account, after a few minutes of looking around, I was blockeed. (Still blocked, because not worth it.)
- Abishek_Muthian 7y agoWere you on VPN/Tor, not that I'm implying it's a legible case to block; but I've read VPN/Tor usage on Twitter will lead you to mobile linking inevitably due to said issue.
- thosakwe 7y agoYou don't need to be on a VPN, just make a new account, set a profile picture and bio, and it'll be locked if you don't have a phone.
- avian 7y agoI had the same experience. Not on VPN/Tor/anything. Before I even posted a single tweet I got blocked by a generic "our algorithms think you violated community guidelines" or something.
- deleted 7y ago[deleted]
- hartator 7y agoWe need to stop calling this 2FA. If you can reset your password via text or email, it’s not. I rather have no way of reseting the password. And if it is lost, it is lost.
- snarf21 7y agoExactly. SMS as a 2FA option is worse than no 2FA. It actually creates a new attack vector.
- JohnFen 7y agoGood move! A 2FA system that requires me to give a phone number is a 2FA system that I won't use. I'm not about to give my phone number out to most companies, and I'm too lazy to go get a burner phone just to set up 2FA.
- flingo 7y agoStrange. Since any new account I add to the site gets locked after about ten minutes and demands a phone number to verify. I get the account unlocked after a few days if I pester support about it. (which is not easy either)