5 ms·

I think 2FA is to guard against someone gaming their "lost my password" process as much as against someone brute-forcing your pw.

jacquesm 4y ago
Yes, but that would actually be less secure because my phone number is quite public and I'd be a SIM swap attack away from someone being able to compromise this account in a way that I would not be able to easily recover from (and to lose my long time phone number in the process).
- latchkey 4y ago
  You don't have to use SMS for 2FA on twitter. Have you checked: https://twitter.com/settings/apps_and_sessions https://twitter.com/settings/apps_and_sessions
  - jacquesm 4y ago
    That brings up a page where Twitter wants my phone number, which they can't have.
    - latchkey 4y ago
      You're assuming at this point they want your number. It is not unreasonable to assume that this has been changed to the attackers number.
      - jacquesm 4y ago
        True, but they are still asking for it even now and they prefix it with the NL country code.
        latchkey 4y ago
        Easy enough to figure out NL, your phone number is in your HN profile. Then, the hacker just gets a local number, which should be easy enough these days.
        jacquesm 4y ago
        True, but I would assume this is because Twitter has geolocated my IP to NL.
    - neogodless 4y ago
      Oddly enough I was able to select between [ Text message, Authentication app, Security key ]. I chose Authentication app, and I was not asked for my phone number. Though your account may now be in a "special state" due to these circumstances. EDIT: Ah I see elsewhere you said you don't use a smart phone (thus, no authentication app.)
- jffry 4y ago
  AFAICT you can configure TOTP / Security Key based MFA for Twitter and disable text messages, but I don't recall if they force you to give them your phone number first: https://twitter.com/settings/account/login_verification https://twitter.com/settings/account/login_verification Regardless that still wouldn't protect you against somebody social engineering their support team. The account security page at https://twitter.com/settings/security https://twitter.com/settings/security has an "Additional password protection" but that seems to inhibit automated password reset requests, not support-related ones.

jacquesm 4y ago

Yes, but that would actually be less secure because my phone number is quite public and I'd be a SIM swap attack away from someone being able to compromise this account in a way that I would not be able to easily recover from (and to lose my long time phone number in the process).

latchkey 4y ago
You don't have to use SMS for 2FA on twitter. Have you checked: https://twitter.com/settings/apps_and_sessions https://twitter.com/settings/apps_and_sessions
- jacquesm 4y ago
  That brings up a page where Twitter wants my phone number, which they can't have.
  - latchkey 4y ago
    You're assuming at this point they want your number. It is not unreasonable to assume that this has been changed to the attackers number.
    - jacquesm 4y ago
      True, but they are still asking for it even now and they prefix it with the NL country code.
      - latchkey 4y ago
        Easy enough to figure out NL, your phone number is in your HN profile. Then, the hacker just gets a local number, which should be easy enough these days.
        jacquesm 4y ago
        True, but I would assume this is because Twitter has geolocated my IP to NL.
  - neogodless 4y ago
    Oddly enough I was able to select between [ Text message, Authentication app, Security key ]. I chose Authentication app, and I was not asked for my phone number. Though your account may now be in a "special state" due to these circumstances. EDIT: Ah I see elsewhere you said you don't use a smart phone (thus, no authentication app.)
jffry 4y ago
AFAICT you can configure TOTP / Security Key based MFA for Twitter and disable text messages, but I don't recall if they force you to give them your phone number first: https://twitter.com/settings/account/login_verification https://twitter.com/settings/account/login_verification Regardless that still wouldn't protect you against somebody social engineering their support team. The account security page at https://twitter.com/settings/security https://twitter.com/settings/security has an "Additional password protection" but that seems to inhibit automated password reset requests, not support-related ones.