3 ms·

Is it? Non-SMS authentication requires a smartphone and not just a cell phone. And they still allow it. They just make you pay for it. So it isn't a decision b

by bmitc 4y ago

Is it? Non-SMS authentication requires a smartphone and not just a cell phone. And they still allow it. They just make you pay for it. So it isn't a decision based on security, even though they chalk it up as such.

toomuchtodo 4y ago
Is anyone using Twitter from a non smart mobile device? And if you’re using a desktop/laptop, you can use TOTP (via password managers or similar apps) or secure authenticators (hardware or passkey), no? What are the odds you’re using Twitter without a smartphone or a desktop/laptop? Twitter deprecated tweet via sms long ago. Anyway! I stand by the assertion. Less users using SMS for 2FA is a good thing, even if a much, much smaller paid cohort still can (~300k Blue subscribers vs ~237M daily active users). I include CISA and NIST factsheet links on the topic in another comment in the thread, so I won’t duplicate them here. https://www.theverge.com/2019/9/4/20849865/twitter-disables-sms-text-message-tweeting-jack-dorsey-ceo-hack https://www.theverge.com/2019/9/4/20849865/twitter-disables-... https://www.theverge.com/2020/4/27/21238131/twitter-sms-notifications-disabled-jack-dorsey-hack https://www.theverge.com/2020/4/27/21238131/twitter-sms-noti...
- deleted 4y ago
  [deleted]
csande17 4y ago
Are there any cell phones left that can connect to modern cell networks but cannot run a TOTP authentication app? There are even authenticator apps for Java ME!
- bmitc 4y ago
  I was thinking of users who might have phones that have a Twitter app or capability (didn't realize at the time of my comment that SMS tweeting is no longer allowed) but no authentication method other than SMS, presumably also without a computer or reliable access to one. Maybe this is inaccurate. However, it still stands that Twitter is pushing people towards the paid subscription by using poor security arguments.
_-david-_ 4y ago
>Non-SMS authentication requires a smartphone and not just a cell phone. Not accurate. There are applications for totp for Windows, Mac and Linux.

by bmitc 4y ago

toomuchtodo 4y ago

Is anyone using Twitter from a non smart mobile device? And if you’re using a desktop/laptop, you can use TOTP (via password managers or similar apps) or secure authenticators (hardware or passkey), no? What are the odds you’re using Twitter without a smartphone or a desktop/laptop? Twitter deprecated tweet via sms long ago. Anyway! I stand by the assertion. Less users using SMS for 2FA is a good thing, even if a much, much smaller paid cohort still can (~300k Blue subscribers vs ~237M daily active users). I include CISA and NIST factsheet links on the topic in another comment in the thread, so I won’t duplicate them here. https://www.theverge.com/2019/9/4/20849865/twitter-disables-sms-text-message-tweeting-jack-dorsey-ceo-hack https://www.theverge.com/2019/9/4/20849865/twitter-disables-... https://www.theverge.com/2020/4/27/21238131/twitter-sms-notifications-disabled-jack-dorsey-hack https://www.theverge.com/2020/4/27/21238131/twitter-sms-noti...

deleted 4y ago
[deleted]

csande17 4y ago

Are there any cell phones left that can connect to modern cell networks but cannot run a TOTP authentication app? There are even authenticator apps for Java ME!

bmitc 4y ago
I was thinking of users who might have phones that have a Twitter app or capability (didn't realize at the time of my comment that SMS tweeting is no longer allowed) but no authentication method other than SMS, presumably also without a computer or reliable access to one. Maybe this is inaccurate. However, it still stands that Twitter is pushing people towards the paid subscription by using poor security arguments.

_-david-_ 4y ago

>Non-SMS authentication requires a smartphone and not just a cell phone. Not accurate. There are applications for totp for Windows, Mac and Linux.