3 ms·

The problem with SMS 2FA isn’t just that it’s awful/fake security, but it’s also turned into a fraud with scammers generating SMS traffic to “premium” phone num

by zaroth 4y ago

The problem with SMS 2FA isn’t just that it’s awful/fake security, but it’s also turned into a fraud with scammers generating SMS traffic to “premium” phone numbers that charge extra for the SMS and then the scammer gets a cut. Small companies have been hit with absolutely massive bills due to this, I’d guess Twitter has probably had its share of exorbitant SMS bills too. Makes total sense to sunset the insecure login method, support the free & more secure version for everyone, while allowing paying users to continue to use SMS if they insist.

hn_throwaway_99 4y ago
> Makes total sense to sunset the insecure login method, support the free & more secure version for everyone, while allowing paying users to continue to use SMS if they insist. That's absolutely not going to happen. Tons of users who currently use SMS will just resort to having no 2FA at all - it's still optional.
- ed25519FUUU 4y ago
  While I don’t like leaving these legacy users in the dust, I do like that Twitter will no longer require a phone number when signing up (or soon after). So frustrating for companies to tell me it’s for my safety and not some stupid way to gather PII on me and eventually get hacked and lose it (like Twitter did in 2021).
  - LoganDark 4y ago
    > Twitter will no longer require a phone number when signing up ...Wait, did they start requiring this at some point? I thought it was optional unless they decided to randomly lock your account later. (In other words you could play the lottery to try to avoid it if you're lucky.)
    - ed25519FUUU 4y ago
      You could always sign up with email but every account was locked after it started any kind of activity (likes, tweets, etc), and was only unlocked by providing a phone number.
- zaroth 4y ago
  Tons of users might also be incentivized to spend the 3 minutes to check out and start using an Auth app to have the more secure 2FA for free.
batch12 4y ago
I wish I had one of these numbers I could associate with my public profile. I would be a little more willing to talk to spammers and scammers if they had to pay for the privilege.

by zaroth 4y ago

hn_throwaway_99 4y ago

> Makes total sense to sunset the insecure login method, support the free & more secure version for everyone, while allowing paying users to continue to use SMS if they insist. That's absolutely not going to happen. Tons of users who currently use SMS will just resort to having no 2FA at all - it's still optional.

ed25519FUUU 4y ago
While I don’t like leaving these legacy users in the dust, I do like that Twitter will no longer require a phone number when signing up (or soon after). So frustrating for companies to tell me it’s for my safety and not some stupid way to gather PII on me and eventually get hacked and lose it (like Twitter did in 2021).
- LoganDark 4y ago
  > Twitter will no longer require a phone number when signing up ...Wait, did they start requiring this at some point? I thought it was optional unless they decided to randomly lock your account later. (In other words you could play the lottery to try to avoid it if you're lucky.)
  - ed25519FUUU 4y ago
    You could always sign up with email but every account was locked after it started any kind of activity (likes, tweets, etc), and was only unlocked by providing a phone number.
zaroth 4y ago
Tons of users might also be incentivized to spend the 3 minutes to check out and start using an Auth app to have the more secure 2FA for free.

batch12 4y ago

I wish I had one of these numbers I could associate with my public profile. I would be a little more willing to talk to spammers and scammers if they had to pay for the privilege.