3 ms·

The Trump-tie aside, does anyone have a good reason why 2FA isn't absolutely enforced on all verified accounts? I can't really see a situation where the need f

The Trump-tie aside, does anyone have a good reason why 2FA isn't absolutely enforced on all verified accounts? I can't really see a situation where the need for "authenticity" of a person/account meets the bar for needing verification, but not be considered important enough for basic security practices.

sbarre 6y ago
A somewhat educated guess: Probably the "cost-to-serve" metrics that Twitter considers when making these changes. Force 2FA on your most high-profile customers, and your support costs skyrocket as a steady stream of these customers who didn't want this new and (relatively) complicated measure forget or lose their 2FA setup, and you find yourself constantly resetting it or changing it, which probably in the long term reduces the effectiveness of it since it becomes a routine for your support operation and it's easier for bad actors to fake it.
- input_sh 6y ago
  I've stumbled upon enough verified accounts that had their display name and photos changed to Elon Musk's and pretended to give away Bitcoins that I believe it's a worthy sacrifice to make.
  - sbarre 6y ago
    You and me both, but Twitter is a public company with fiduciary responsibilities to shareholders above all else (including the public good), so here we are. Until these kinds of problems affect their brand enough to cause financial harm, don't hold your breath for higher security and accountability measures by default.
bostik 6y ago
I can guess. People lose or break their phones often enough. It is a routine thing in an organisation of just 120 people. Now imagine that instead of an educated and selective group, you are dealing with a pool of desperately partying, drunk globetrotting influencers, political figures with Neanderthal technical skills or other walking security disasters. How often do you think account recovery due to lost 2FA would be triggered? For proper protection you need hardware 2FA, and for usability reasons you really need the NFC enabled Yubikey so the same second factor can be neatly enforced on a mobile phone too. But you can't have just one. If the access is for anything non-trivial or of high importance, you need at least two such devices. Preferably three. That's a lot of Yubikeys you need to subsidise, because most people sure as hell are not buying them out of their own pocket.
- nrmitchi 6y ago
  I'm not talking about all accounts though, just the ones which have been verified by twitter. I would expect that if the identity of the account owner has already been verified, the account recovery process in this situation would be much more straight forward than a non-verified user.
IvyMike 6y ago
I've seen several verified accounts say that 2FA was required when they got the verification, but apparently they still have the option to disable it later. https://twitter.com/mattblaze/status/1319295891765972992 https://twitter.com/mattblaze/status/1319295891765972992

sbarre 6y ago

A somewhat educated guess: Probably the "cost-to-serve" metrics that Twitter considers when making these changes. Force 2FA on your most high-profile customers, and your support costs skyrocket as a steady stream of these customers who didn't want this new and (relatively) complicated measure forget or lose their 2FA setup, and you find yourself constantly resetting it or changing it, which probably in the long term reduces the effectiveness of it since it becomes a routine for your support operation and it's easier for bad actors to fake it.

input_sh 6y ago
I've stumbled upon enough verified accounts that had their display name and photos changed to Elon Musk's and pretended to give away Bitcoins that I believe it's a worthy sacrifice to make.
- sbarre 6y ago
  You and me both, but Twitter is a public company with fiduciary responsibilities to shareholders above all else (including the public good), so here we are. Until these kinds of problems affect their brand enough to cause financial harm, don't hold your breath for higher security and accountability measures by default.

bostik 6y ago

I can guess. People lose or break their phones often enough. It is a routine thing in an organisation of just 120 people. Now imagine that instead of an educated and selective group, you are dealing with a pool of desperately partying, drunk globetrotting influencers, political figures with Neanderthal technical skills or other walking security disasters. How often do you think account recovery due to lost 2FA would be triggered? For proper protection you need hardware 2FA, and for usability reasons you really need the NFC enabled Yubikey so the same second factor can be neatly enforced on a mobile phone too. But you can't have just one. If the access is for anything non-trivial or of high importance, you need at least two such devices. Preferably three. That's a lot of Yubikeys you need to subsidise, because most people sure as hell are not buying them out of their own pocket.

nrmitchi 6y ago
I'm not talking about all accounts though, just the ones which have been verified by twitter. I would expect that if the identity of the account owner has already been verified, the account recovery process in this situation would be much more straight forward than a non-verified user.

IvyMike 6y ago

I've seen several verified accounts say that 2FA was required when they got the verification, but apparently they still have the option to disable it later. https://twitter.com/mattblaze/status/1319295891765972992 https://twitter.com/mattblaze/status/1319295891765972992