3 ms·

Very cool, also you can't use MFA authentication on Twitter without giving them your phone number.

• FeatureIncomple 7y ago
  Twitter now supports OTP 2fa as well.
  • tialaramex 7y ago
    And FIDO Security Keys (U2F / WebAuthn) The particularly nice thing about FIDO Security Keys that's relevant here is even a hideously incompetent implementation doesn't hurt you. The Relying Party (in this case Twitter) doesn't end up with any secrets, they get an apparently random "cookie" value to give back to you when they want you to prove you've still got that key, and a elliptic curve public key that doesn't correlate to anything except your login on their site. If they screwed up so badly that the Twitter web site showed a user's U2F parameters to every single visitor looking at their tweets it not only wouldn't unmask any pseudonyms used (as a phone number definitely would) it wouldn't even make it easier to login in as that user. FIDO is the right thing everywhere that a second factor is needed, but even more so when you don't trust the implementers to do a good job.
    • woadwarrior01 7y ago
      Twitter currently, does not allow adding more than one U2F keys to an account. It’s normative to have at least one extra key for backup. Google, Github, even Facebook support adding multiple hardware tokens to an account, but not Twitter. Also, if you try requesting for an API key, they insist that you add a phone number to your account.
• app4soft 7y ago
  > you can't use MFA authentication on Twitter without giving them your phone number. GitHub also require MFA authentication since this year. Does it mean that any MFA authentication now has same leaks?
  • tialaramex 7y ago
    No. But you should be concerned if you choose to give your phone number to people, because if they know it they might leak it through any combination of malice or incompetence. Other than my banks, none of the systems I've enabled MFA for required a telephone number. That includes: Dropbox, GitHub, Slack, Facebook, Nintendo, Google, Login.gov and the Digidentity.eu variant of Gov.uk Verify. Everywhere it was possible I used my FIDO Security Keys which are phishing proof, impractical to de-anonymise and foolproof because the site has no secrets to leak. Whenever I hear that a site I already used MFA for gained WebAuthn or U2F I go back and switch that site to Security Keys. Everywhere else I used TOTP (Google Authenticator) which can be phished using a live proxy and the site could leak their copy of your TOTP secret (not the changing code, but the secret that drives it) but other than those two concerns it's pretty safe. At least nobody can work out your real world identity by knowing your TOTP secrets.
  • brentonator 7y ago
    Not unless the service requires a phone number in order to enable MFA. Some providers require the phone number for "recovery" purposes once MFA is enabled very much defeating the usefulness. Countless times we've heard of a helpful AT&T / T-Mobile / Verizon employee forwarding texts or generating a new SIM card for a scammer with a fake ID. It's just too easy.
• r1ch 7y ago
  This was changed recently, you can remove your phone number and continue to get 2FA support. The developer dashboard however won't function without a phone number for whatever reason.
• codedokode 7y ago
  Also, if Twitter considers your behaviour "suspicious" (or if someone has reported you), it will require a phone number, if I remember correctly.
  • Can_Not 7y ago
    Suspicious activities mostly include "not already having an account" and "not having a phone number on file to sell".