4 ms·
The problem with Twitter is they don't allow adding more than one security key (like Yubikey, NitroKey etc) per account. Google, FB, Github and almost everyone
by woadwarrior01 6y ago
The problem with Twitter is they don't allow adding more than one security key (like Yubikey, NitroKey etc) per account. Google, FB, Github and almost everyone else who supports security keys does support multiple keys. Without it, I wouldn't disable SMS auth on Twitter, yet (the security key could die at any point, hypothetically speaking; which is why you have a backup or two).
- war1025 6y agoWhy wouldn't you just record the authenticator code somewhere? You can easily generator OTP codes the same as any of the "authenticator" apps using, for example, oathtool [1] You don't even need the code to be stored on a computer. Just write it down somewhere safe if you're paranoid about getting hacked. The seed codes are usually 16 characters or so. [1] https://www.nongnu.org/oath-toolkit/oathtool.1.html https://www.nongnu.org/oath-toolkit/oathtool.1.html
- woadwarrior01 6y agoYou're right, that's exactly what I've got. I'd forgotten the exact setup I have on Twitter. I just checked and I've got a TOTP app (with backup codes on paper) + Yubikey. I'd disabled SMS for 2FA last year, around the time when Jack Dorsey's Twitter account was compromised with a SIM swap attack.