4 ms·

Twitter data leak exposes over 5.4M accounts

7 points by firstSpeaker 4y ago

aww_dang 4y ago
>If you are thinking of using two-factor authentication, now would be a good time So they can leak my phone number in addition to my email address? Elsewhere in their linked article on the same site: > For users trying to keep their identity hidden, the company recommends not adding a publicly known phone number or email address to an account. It also suggests adding two-factor authentication.
- alexb_ 4y ago
  You know, I'm really starting to hate how 2FA, and phone numbers in general, have been hijacked into being an ID that companies just assume you have. A lot of the people who would be extremely opposed from "give us your driver's license or you can't use this service" are perfectly fine with forced 2FA - these leak the same amount of information!
  - aww_dang 4y ago
    How long are we expected to keep the same phone number or live in the same country? There are too many assumptions baked in. It is still possible to use Twitter without a phone number, but it requires jumping through hoops. Telegram, the "privacy" app is even worse. No phone number, no account. No app install, no account.
    - alexb_ 4y ago
      Not to mention a lot of people don't have and do not wish to have a phone number. Yes, they exist - and while I'm not one of them and do not plan to be one of them, designing systems such that you require monthly subscriptions is incredibly classist and harmful in general.
- jimsmart 4y ago
  Text message via one's phone number isn't the only way of doing 2FA... Twitter also support the use of an authentication app to generate codes [0] (or a physical security key, which likely is far from practical for most folk). I use an authentication app for 2FA on a few different sites, I think the process is alright, and don't mind the small amount of extra friction for the gain in security (whilst additionally not disclosing my phone number). I'm currently using Authy [1], recommended by a friend, and haven't really looked at others, but there are a few different alternatives available (some of which are mentioned on the Twitter 2FA page here). [0] https://help.twitter.com/en/managing-your-account/two-factor-authentication https://help.twitter.com/en/managing-your-account/two-factor... [1] https://authy.com https://authy.com

7 points by firstSpeaker 4y ago

>If you are thinking of using two-factor authentication, now would be a good time So they can leak my phone number in addition to my email address? Elsewhere in their linked article on the same site: > For users trying to keep their identity hidden, the company recommends not adding a publicly known phone number or email address to an account. It also suggests adding two-factor authentication.

alexb_ 4y ago
You know, I'm really starting to hate how 2FA, and phone numbers in general, have been hijacked into being an ID that companies just assume you have. A lot of the people who would be extremely opposed from "give us your driver's license or you can't use this service" are perfectly fine with forced 2FA - these leak the same amount of information!
- aww_dang 4y ago
  How long are we expected to keep the same phone number or live in the same country? There are too many assumptions baked in. It is still possible to use Twitter without a phone number, but it requires jumping through hoops. Telegram, the "privacy" app is even worse. No phone number, no account. No app install, no account.
  - alexb_ 4y ago
    Not to mention a lot of people don't have and do not wish to have a phone number. Yes, they exist - and while I'm not one of them and do not plan to be one of them, designing systems such that you require monthly subscriptions is incredibly classist and harmful in general.
jimsmart 4y ago
Text message via one's phone number isn't the only way of doing 2FA... Twitter also support the use of an authentication app to generate codes [0] (or a physical security key, which likely is far from practical for most folk). I use an authentication app for 2FA on a few different sites, I think the process is alright, and don't mind the small amount of extra friction for the gain in security (whilst additionally not disclosing my phone number). I'm currently using Authy [1], recommended by a friend, and haven't really looked at others, but there are a few different alternatives available (some of which are mentioned on the Twitter 2FA page here). [0] https://help.twitter.com/en/managing-your-account/two-factor-authentication https://help.twitter.com/en/managing-your-account/two-factor... [1] https://authy.com https://authy.com