4 ms·
He did not use phone/SMS as his 2FA it seems, because he knew it's insecure, per his tweet. But nevertheless Twitter requires a phone number for verified accoun
by trompetenaccoun 3y ago
He did not use phone/SMS as his 2FA it seems, because he knew it's insecure, per his tweet. But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. There is nothing the user can do. Since these incompetent telecom employees get social engineered again and again, it's simply bad practice to have anything phone number related for security. Twitter and other companies need to change this, it's not safe.
- mr_mitm 3y ago> But nevertheless Twitter requires a phone number for verified accounts and that phone number can be used to reset the Twitter account password. Sure, but that is not 2FA. It's 1FA. They could have used e-mail as the recovery mechanism to send a password reset link, then it still would have been SMS 2FA if they then required the SMS factor upon authentication and it would have been secure. This wasn't a problem of SMS 2FA, it was a problem of SMS based account recovery.