4 ms·

"A phone number is sufficient to password reset a Twitter account even if not used as 2FA" This sucks because Twitter will sometimes force you to link a phone

"A phone number is sufficient to password reset a Twitter account even if not used as 2FA" This sucks because Twitter will sometimes force you to link a phone number to the account if it doesn't like your VPN or whatever

ttyyzz 3y ago
Cool, a wild vector appeared.
woadwarrior01 3y ago
I just tried it on my now account. It asks for the account's username, phone number, email and then sends an email to the email address. Perhaps he didn't add an email address to his Twitter account?
- simiones 3y ago
  I also experimented a bit. I was able to reset my own password only with phone access when 2FA was not enabled: in the reset password flow, I started with my phone number, was then asked for my username and email, and then I was presented with an option to send the reset code either to my email or to my phone number. But, I then enabled 2FA (with an authentication app), and now when I try the flow again, I get to the screen for sending the reset code and I only have the email option left (but the screen still shows up as an extra step). So, it's possible that when you have 2FA enabled you can no longer do it. Or, it's possible I've triggered some internal rules by resetting my password twice in a short span of time (and enabling 2FA as well) and they've bumped me to some kind of "extra verification" flow that disabled phone-based password reset.
thaumasiotes 3y ago
> "A phone number is sufficient to password reset a Twitter account even if not used as 2FA" In other words, they don't have a 2FA system. They have a 1FA system, and the only factor is your phone number. This is a weird choice, since people are much more likely to know your phone number than they are to know your password.
- simiones 3y ago
  If you have 2FA enabled, they can deny you access to your account, but they can't actually access it either (unless they also compromise your 2FA of course). That is, they can reset and change your password with only a phone number, but will still require a 2FA token to actually access the account.

ttyyzz 3y ago

Cool, a wild vector appeared.

woadwarrior01 3y ago

I just tried it on my now account. It asks for the account's username, phone number, email and then sends an email to the email address. Perhaps he didn't add an email address to his Twitter account?

simiones 3y ago
I also experimented a bit. I was able to reset my own password only with phone access when 2FA was not enabled: in the reset password flow, I started with my phone number, was then asked for my username and email, and then I was presented with an option to send the reset code either to my email or to my phone number. But, I then enabled 2FA (with an authentication app), and now when I try the flow again, I get to the screen for sending the reset code and I only have the email option left (but the screen still shows up as an extra step). So, it's possible that when you have 2FA enabled you can no longer do it. Or, it's possible I've triggered some internal rules by resetting my password twice in a short span of time (and enabling 2FA as well) and they've bumped me to some kind of "extra verification" flow that disabled phone-based password reset.

thaumasiotes 3y ago

> "A phone number is sufficient to password reset a Twitter account even if not used as 2FA" In other words, they don't have a 2FA system. They have a 1FA system, and the only factor is your phone number. This is a weird choice, since people are much more likely to know your phone number than they are to know your password.

simiones 3y ago
If you have 2FA enabled, they can deny you access to your account, but they can't actually access it either (unless they also compromise your 2FA of course). That is, they can reset and change your password with only a phone number, but will still require a 2FA token to actually access the account.