5 ms·

Twitter has had support for proper TOTP based 2FA ever since Jack Dorsey got SIM Swapped in 2019[1]. This was also the time when they added support for hardware

Twitter has had support for proper TOTP based 2FA ever since Jack Dorsey got SIM Swapped in 2019[1]. This was also the time when they added support for hardware tokens like Yubikeys. Of course, one needs to enable it. [1]: https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-dorsey-hack.html https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-...

rgrmrts 3y ago
Just having a phone number added to Twitter means your account is at risk of being taken over with a sim-swap. This was not 2FA related AFAICT. Twitter also requires you to add a phone number, even on old accounts you can get locked out unless you add one.
- sschueller 3y ago
  Doesn't Twitter force you to add a phone number now?
  - lxgr 3y ago
    As far as I remember they only use it for spam protection (i.e. the phone number serves as a moderate-level "proof of humanity"), but not for 2FA purposes (unless you pay for their premium service).
  - throwaway290 3y ago
    Yes and they plan to require ID verification next, losing privacy-conscious users is clearly not a big issue for Musk.
    - yomlica8 3y ago
      [dead]
- ssl232 3y ago
  I've got an account from 2009 and have never had to enter my phone number (if I ever get asked, that'll be the time when I stop using it).
  - eddtests 3y ago
    Nowadays if you create a new account it’ll get briefly banned while they do additional checks to ensure you’re human, which is fixed by giving a phone number. Id almost appreciate just asking for one on signup then the charade
    - fossislife 3y ago
      That's not always the case. Sometimes it asked me for a phone number, but most of the time not when not using a VPN or something similar. But last year I managed to create two Twitter accounts with the Tor browser and some sketchy email address and never got asked for a number, just had to do some captcha after a few minutes.
      - eddtests 3y ago
        I created a few twitter accounts this year for various reasons and all of them had the same number requirement after around 24 hours!
    - callalex 3y ago
      The various Meta properties do this too, except instead of phone numbers they require government ID and headshots. It’s all a scummy dark pattern relying on the sunk cost fallacy.
  - littlestymaar 3y ago
    I've used Twitter from 2013 to 2021, and have eventually been locked-out by Twitter requesting a phone number with no way to work around.
    - ssl232 3y ago
wslh 3y ago
It is good to know that hardware wallets such as Trezor and Ledger supports 2FA protocols so if you have one there is no need to use another device.
- smeej 3y ago
  If you're actually using them for their intended use (storing your crypto), the less you connect them to your computer, the better. Check them 2-4x a year to make sure they're updated, but I wouldn't want to carry my cold storage device on my keychain like I do my YubiKey.
hospitalJail 3y ago
I'm a bit paranoid about 2FA ever since my charging port got damaged and I literally couldn't charge my phone to get to authentication. Scary stuff, had to give sooo much personal information over the course of months to recover a single account. Not sure a solution, maybe have a wifi only phone that I only turn on for Auth?
- theblazehen 3y ago
  Have a paper backup of the codes?
  - simiones 3y ago
    And carry it with you at all times, of course.
    - justsomehnguy 3y ago
      All those proponents of a 'proper security with a strict 2FA' never been out of country, mugged, in an accident or in any combination of these. Hell, if I just lose my wallet and would be forced to reissue the IDs and SIM (retaining the number!) it would take weeks to be back 'online'.
- TheDong 3y ago
  Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks. You did write them down like the site told you to, right? Even if a site doesn't offer backup codes, you can extract the TOTP secret from the QR code, or most authenticator apps, quite easily, and then write it down. It's more secure to only save the backup codes though since they have a limited number of uses, while the TOTP secret has unlimited uses.
  - twothamendment 3y ago
    I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code! Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!
lhl 3y ago
The big problem is that apparently if you have a phone number linked to your account, it can be used to reset your password even with TOTP 2FA enabled which to me, is bonkers: https://twitter.com/TimBeiko/status/1700659107764785336 https://twitter.com/TimBeiko/status/1700659107764785336 Twitter was requiring phone numbers for a while for account verification and I had mine attached from pre-history, but have obviously removed it after people have been pointing this out as an attack vector.

rgrmrts 3y ago

Just having a phone number added to Twitter means your account is at risk of being taken over with a sim-swap. This was not 2FA related AFAICT. Twitter also requires you to add a phone number, even on old accounts you can get locked out unless you add one.

sschueller 3y ago
Doesn't Twitter force you to add a phone number now?
- lxgr 3y ago
  As far as I remember they only use it for spam protection (i.e. the phone number serves as a moderate-level "proof of humanity"), but not for 2FA purposes (unless you pay for their premium service).
- throwaway290 3y ago
  Yes and they plan to require ID verification next, losing privacy-conscious users is clearly not a big issue for Musk.
  - yomlica8 3y ago
    [dead]
ssl232 3y ago
I've got an account from 2009 and have never had to enter my phone number (if I ever get asked, that'll be the time when I stop using it).
- eddtests 3y ago
  Nowadays if you create a new account it’ll get briefly banned while they do additional checks to ensure you’re human, which is fixed by giving a phone number. Id almost appreciate just asking for one on signup then the charade
  - fossislife 3y ago
    That's not always the case. Sometimes it asked me for a phone number, but most of the time not when not using a VPN or something similar. But last year I managed to create two Twitter accounts with the Tor browser and some sketchy email address and never got asked for a number, just had to do some captcha after a few minutes.
    - eddtests 3y ago
      I created a few twitter accounts this year for various reasons and all of them had the same number requirement after around 24 hours!
  - callalex 3y ago
    The various Meta properties do this too, except instead of phone numbers they require government ID and headshots. It’s all a scummy dark pattern relying on the sunk cost fallacy.
- littlestymaar 3y ago
  I've used Twitter from 2013 to 2021, and have eventually been locked-out by Twitter requesting a phone number with no way to work around.
  - ssl232 3y ago

wslh 3y ago

It is good to know that hardware wallets such as Trezor and Ledger supports 2FA protocols so if you have one there is no need to use another device.

smeej 3y ago
If you're actually using them for their intended use (storing your crypto), the less you connect them to your computer, the better. Check them 2-4x a year to make sure they're updated, but I wouldn't want to carry my cold storage device on my keychain like I do my YubiKey.

hospitalJail 3y ago

I'm a bit paranoid about 2FA ever since my charging port got damaged and I literally couldn't charge my phone to get to authentication. Scary stuff, had to give sooo much personal information over the course of months to recover a single account. Not sure a solution, maybe have a wifi only phone that I only turn on for Auth?

theblazehen 3y ago
Have a paper backup of the codes?
- simiones 3y ago
  And carry it with you at all times, of course.
  - justsomehnguy 3y ago
    All those proponents of a 'proper security with a strict 2FA' never been out of country, mugged, in an accident or in any combination of these. Hell, if I just lose my wallet and would be forced to reissue the IDs and SIM (retaining the number!) it would take weeks to be back 'online'.
TheDong 3y ago
Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks. You did write them down like the site told you to, right? Even if a site doesn't offer backup codes, you can extract the TOTP secret from the QR code, or most authenticator apps, quite easily, and then write it down. It's more secure to only save the backup codes though since they have a limited number of uses, while the TOTP secret has unlimited uses.
- twothamendment 3y ago
  I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code! Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!

lhl 3y ago

The big problem is that apparently if you have a phone number linked to your account, it can be used to reset your password even with TOTP 2FA enabled which to me, is bonkers: https://twitter.com/TimBeiko/status/1700659107764785336 https://twitter.com/TimBeiko/status/1700659107764785336 Twitter was requiring phone numbers for a while for account verification and I had mine attached from pre-history, but have obviously removed it after people have been pointing this out as an attack vector.