6 ms·
An update on two-factor authentication using SMS on Twitter
- minimaxir 4y agogotta cut down on that Twilio bill
- Someone1234 4y agoI guestimate, if they were using Twilio with the volume discount, it might be $10.5K/day ish. Which both is a lot but also isn't a lot when you consider their currently daily losses. I imagine the main motivation isn't actually the raw cost, but rather attracting more people to Twitter Blue ($8/month) to keep the minority investors happy. Just looking for any feature they can move under that umbrella.
- reaperducer 4y agoWhich both is a lot but also isn't a lot We're talking about a company where you have to bring your own toilet paper to work now. The turnip will be squeezed until it bleeds.
- mrobins 4y agoInsane that this is how far cost cutting has come.
- belltaco 4y agoIsn't losing 4 million dollars a day insane for a 17 year old company?
- stefan_ 4y agoYes, geez, who would ever load up a company with a debt load like that? This is a "wet streets cause rain" level of understanding.
- belltaco 4y agoThey lost $1.14 Billion in 2020, long before Musk bought the company. They lost $270 million dollars in the latest quarter before Musk acquired them. This is 'make up bs to blame someone I don't like in spite of my total ignorance' levels of knowledge and understanding.
- deleted 4y ago[deleted]
- LoganDark 4y ago> They lost $1.14 Billion in 2020, long before Musk bought the company. But 4 million a day is $1.4 billion per year which is still larger than $1.31 billion (adjusted for inflation) > They lost $270 million dollars in the latest quarter before Musk acquired them. But $270 million a quarter is only $1.08 billion per year. So that means they were actually improving before they were acquired... but now they are getting worse again... what changed the slope?
- belltaco 4y ago[dead]
- toomuchtodo 4y agoEven if it’s because they’re broke, it’s a good move to drop SMS as an auth factor. https://www.coinbase.com/blog/authentication-matters-coinbase-account-take-over-statistics https://www.coinbase.com/blog/authentication-matters-coinbas... https://images.ctfassets.net/c5bd0wqjc7v0/3Ku5foxu1kUTXa3l5xdu6o/47b283c51bdec6fe9baa3fb69ac7458c/Screenshot_2023-01-19_at_1.31.39_PM.png https://images.ctfassets.net/c5bd0wqjc7v0/3Ku5foxu1kUTXa3l5x... (ato = account takeover)
- bmitc 4y agoIs it? Non-SMS authentication requires a smartphone and not just a cell phone. And they still allow it. They just make you pay for it. So it isn't a decision based on security, even though they chalk it up as such.
- toomuchtodo 4y agoIs anyone using Twitter from a non smart mobile device? And if you’re using a desktop/laptop, you can use TOTP (via password managers or similar apps) or secure authenticators (hardware or passkey), no? What are the odds you’re using Twitter without a smartphone or a desktop/laptop? Twitter deprecated tweet via sms long ago. Anyway! I stand by the assertion. Less users using SMS for 2FA is a good thing, even if a much, much smaller paid cohort still can (~300k Blue subscribers vs ~237M daily active users). I include CISA and NIST factsheet links on the topic in another comment in the thread, so I won’t duplicate them here. https://www.theverge.com/2019/9/4/20849865/twitter-disables-sms-text-message-tweeting-jack-dorsey-ceo-hack https://www.theverge.com/2019/9/4/20849865/twitter-disables-... https://www.theverge.com/2020/4/27/21238131/twitter-sms-notifications-disabled-jack-dorsey-hack https://www.theverge.com/2020/4/27/21238131/twitter-sms-noti...
- deleted 4y ago[deleted]
- csande17 4y agoAre there any cell phones left that can connect to modern cell networks but cannot run a TOTP authentication app? There are even authenticator apps for Java ME!
- fwlr 4y agoI’m generally positive about the changes at Twitter but they really needed to keep at least one PR guy on the payroll. Adding a single sentence, “We encourage Twitter Blue subscribers to migrate away from insecure SMS-based 2FA, but we will maintain that service for their convenience” would do wonders for the overall message here.
- NovemberWhiskey 4y agoThe new Twitter; where insecurity is a for-pay feature.
- ed25519FUUU 4y agoAsk any security professional their thoughts are on SMS 2FA. It was not only unsafe, but also led to PII leaks and anon account unmasking. Good riddance.
- ceejayoz 4y agoThen ask them if it's better than nothing, especially for casual users. A lot of the folks using SMS-based 2FA will just turn it off.
- NovemberWhiskey 4y agoIt depends on your threat model. If you're an average Twitter user whose worst threat is a password spraying attack then sure, it's better than nothing. If you're someone who is likely to be targeted specifically (you're a known crypto 'investor', you're a celebrity of some kind or another) then it's a disaster. You're much better off just having a high-quality, unique password than you are with a high-quality, unique password on a site that with a password reset flow via SMS 2FA.
- icanhasfay 4y agoNothing like putting a paywall on consumer security options.
- _-david-_ 4y ago2FA over SMS is the least secure option. It is free to use more secure options.
- jwestbury 4y agoNot having 2FA at all is the least secure option. SMS-based MFA is better than no MFA, and, to be honest, I'm not sure I trust most people to keep track of MFA tokens and apps. Heck, I don't even fully trust myself to keep track of my yubikeys.
- ravivyas 4y agoTwo points in a single sentence (ok 1 or 2 lines, not a single sentence) > While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used - and abused - by bad actors. So starting today, we will no longer allow accounts to enroll in the text message/SMS method of 2FA unless they are Twitter Blue subscribers. This is a cost cutting measure. The irony is that "Blue" users are probably are the ones to be attacked, and they are by no means more conscious about security. On a lighter note, I have won more lotteries on email when compared to SMS
- nerdjon 4y agoI am super confused about how they could write that with a straight face. Like what does "you have to pay us to use this feature" have ANYTHING to do with the flaws that SMS 2FA has? Does paying get you someone to look at every login attempt or something? Otherwise... the blue checkbox kinda paints a target on your back?
- chaps 4y agoI think you missed the point of their comment -- you both agree with each other.
- nerdjon 4y agoI am referring to the comment the OP is talking about. Updated to make that clear.
- CuriousCosmic 4y agoI'm guessing it's something like "pay us for the hassle of having to clean up your mess when you end up getting hit". But the reality of it is "please pay for twitter blue. we can't just make the whole site blue only so we'll piecemeal each bit of functionality until we can just make the site paid-for only."
- nerdjon 4y agoYeah that's exactly what it is, them desperately trying to find reasons to force people to pay. This one in particular is just a very odd choice. Pushing people away from SMS 2FA is one thing, but not like this.
- andrewe-ca 4y agoYes, it’s a cost cutting measure — but a particularly sad one as Twitter once hoped to lead in this space and seemingly conceded it all to Twilio. It’s a sad development for “Twitter Digits.” In 2014, having harnessed text messaging around the world, Twitter leveraged its global SMS support to create sign-in capabilities that anyone could use. (Twilio, Stripe, Shop now excel at this). https://blog.twitter.com/developer/en_us/a/2014/a-better-way-to-sign-in-with-digits https://blog.twitter.com/developer/en_us/a/2014/a-better-way...
- lxgr 4y agoIt’s hard to feel sad about the loss of a service that apparently propagates the idea of phone numbers as logins or user identifiers.
- djha-skin 4y ago> So starting today, we will no longer allow accounts to enroll in the text message/SMS method of 2FA Yay! Finally some horse sense is starting to penetrate the online community. > unless they are Twitter Blue subscribers Wait what
- aetimmes 4y agoIt's very straightforward. If you have money, you're allowed to be stupid. This is clearly the policy of Twitter 2.0.
- reaperducer 4y agoIf you have money, you're allowed to be stupid. At least they're dogfooding!
- vmoore 4y agoI protect my Twitter with Universal Second Factor (using a Yubikey). Does this mean Twitter will stop that feature and devolve to insecure SMS for paying members? If that's the case, it should be called out at every instance. Account takeover attacks are no laughing matter. They can defame people and cause a lot of damage. Yubikeys/U2F should be the de facto standard for 2FA, and that feature should be for free at all times. 'Everyone deserves good security'.
- jackson1442 4y agowhat? no- it directly says so in the linked article: > We encourage non-Twitter Blue subscribers to consider using an authentication app or security key method instead.
- infogulch 4y agoIt just makes sense to align your marginal costs with your marginal price.
- robomartin 4y agoDoes someone know of a good article on the issues with SMS 2FA suitable for non tech folk? I would like to send it to friends and family members. It just has to be easy to digest for a general audience.
- mrobins 4y agohttps://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-sc...
- robomartin 4y agoThat's not bad, thanks. I'll test it out with a few people and see what feedback I get. I've already had one person say "Why in the world would anyone target me? I am nobody out of hundreds of millions of people."
- paulpauper 4y agothree tiered twitter now: 1. legacy verified & regular verified accounts 2. blue accounts 3. neither Accounts in #3 are not allowed to make replies to their posts be visible in comments. They always get collapsed or hidden. Or when replying to others.
- rvz 4y ago> So starting today, we will no longer allow accounts to enroll in the text message/SMS method of 2FA unless they are Twitter Blue subscribers. Good. 2FA SMS was a liability anyway, and TOTP is a much better secure alternative to that. SMS 2FA should be removed entirely.
- zaroth 4y agoThe problem with SMS 2FA isn’t just that it’s awful/fake security, but it’s also turned into a fraud with scammers generating SMS traffic to “premium” phone numbers that charge extra for the SMS and then the scammer gets a cut. Small companies have been hit with absolutely massive bills due to this, I’d guess Twitter has probably had its share of exorbitant SMS bills too. Makes total sense to sunset the insecure login method, support the free & more secure version for everyone, while allowing paying users to continue to use SMS if they insist.
- hn_throwaway_99 4y ago> Makes total sense to sunset the insecure login method, support the free & more secure version for everyone, while allowing paying users to continue to use SMS if they insist. That's absolutely not going to happen. Tons of users who currently use SMS will just resort to having no 2FA at all - it's still optional.
- ed25519FUUU 4y agoWhile I don’t like leaving these legacy users in the dust, I do like that Twitter will no longer require a phone number when signing up (or soon after). So frustrating for companies to tell me it’s for my safety and not some stupid way to gather PII on me and eventually get hacked and lose it (like Twitter did in 2021).
- LoganDark 4y ago> Twitter will no longer require a phone number when signing up ...Wait, did they start requiring this at some point? I thought it was optional unless they decided to randomly lock your account later. (In other words you could play the lottery to try to avoid it if you're lucky.)
- ed25519FUUU 4y agoYou could always sign up with email but every account was locked after it started any kind of activity (likes, tweets, etc), and was only unlocked by providing a phone number.
- chrishas35 4y agoPosted today...dated 2 days ago.
- ed25519FUUU 4y agoThis is great news. For a long time Twitter required you to add a number. Even if you signed up without it, within a few days you’d be required to add it to unlock your account. What’s frustrating was that Twitter leaked numbers and caused a major unmasking for anon accounts. https://www.bleepingcomputer.com/news/security/twitter-confirms-recent-user-data-leak-is-from-2021-breach/amp/ https://www.bleepingcomputer.com/news/security/twitter-confi...
- diebeforei485 4y agoThis is absolutely the correct decision. SMS 2FA is a legacy feature. Those who want a legacy feature can pay for it.
- ravagat 4y agoI do hope this in one way starts a wave of removing SMS 2FA. While convenient it is the worst solution to added security that's come around.