5 ms·

Users Stuck in YubiKey Re-Enrollment Loop on X (Twitter)

57 points by nake13 11mo ago

ransam124 11mo ago
I don't even know what a Yubikey is and I'm stuck in this loop
nake13 11mo ago
The post is gaining traction as more than a dozen users, including me, report the same issue.
almog 11mo ago
Got here after finding myself stuck in that exact loop (which initially I assumed was a phishing attempt from a webview ad link I thought I accidentally clicked). Looks like some users who have never used or heard of Yubikey report being locked out and stuck in the same loop.
sfsylvester 11mo ago
Yep, this is me as well.
HaasOnSaas 11mo ago
Stuck in this loop also. Even re-enrolling with different Yubikeys didn't seem to solve this. It's persisting across different devices as well, happening both on iOS and on desktop.
dan_pixelflow 11mo ago
Same here - simply cannot fix it, and it's somewhat annoying that it talks about Yubikeys when I'm only using on-device security keys instead. Must be very confusing for many others!
- k_sze 11mo ago
  I was very confused, too. I mean, I do have a YubiKey but Twitter/X has never (or for a very very very long time not) asked me to use my YubiKey to authenticate. As far as I could remember, I only need to use OTP from Authy as 2FA to login. So the whole thing smelled really fishy.
arvidkahl 11mo ago
Same here, been reporting the broken flow to customer support. An interesting part is the "we'll send you an email to confirm you're you", followed by a "enter validation code here" screen that immediately gets forwarded to the re-enrollment message. Also, no confirmation emails are being sent. Very surprised to see this being deployed to prod.
- derpaderp12 11mo ago
  my exact same experience... you knew they would fuck it up... and they have!
  - arvidkahl 11mo ago
    If "we need to have this done by Nov 12th" is the milestone they were going for, and not a functional flow, then it was a great success.
- zkms 11mo ago
  >An interesting part is the "we'll send you an email to confirm you're you", followed by a "enter validation code here" screen that immediately gets forwarded to the re-enrollment message. Also, no confirmation emails are being sent. That is _exactly_ what happens to me.
- rebane2001 11mo ago
  on android and browser i get that behavior, on ios it just says "something went wrong" after the email confirm part
  - smileybarry 11mo ago
    Same on iOS, with the fun bonus of the "something went wrong" modal looping as well! (Without retrying, you're just stuck in modal hell)
- dragonis41 11mo ago
  Same for me, I cannot do anything. Looks like someone did not test its code before deployment
mbaril010fi 11mo ago
I'm stuck .... how can this go to prod.
blanker 11mo ago
Same here, tried 3 times and it seemed to be endless.
AmmarT 11mo ago
Same here stuck in the Loop myself Added Iphone passkey tried loggin in but nothing
dindoodestroyer 11mo ago
This might never be fixed.
- dan_pixelflow 11mo ago
  thats a bit weird from you edit: OP originally said 'This is what happens when you hire Indian engineers'
dindoodestroyer 11mo ago
Same problem here. Got logged out 30 min ago, can’t get back in. This is what happens when you hire Indians.
deleted 11mo ago
[deleted]
derpaderp12 11mo ago
me too
deleted 11mo ago
[deleted]
robbiet480 11mo ago
Also happening here across two accounts.
sunaookami 11mo ago
Yeah same for me, re-registering the Passkey in Bitwarden worked but it just loops after that with the same message. "Testing in prod" I guess. EDIT: they fixed it now
derpaderp12 11mo ago
one of the reasons i waited so long to do it is bc i knew twitter would fuck it up... and lo and behold they now force you to... anddddd they fucked it up
smashah 11mo ago
I take solace in the fact that for this one time i'm not the only one stuck in a bs purgatory. Is it too much to ask of a roman-saluting trillionaire to not break basic things?
noname120 11mo ago
What happened to phased rollouts in production?
rohukas 11mo ago
locked as well rip
stevyhacker 11mo ago
What a shitty UX, the only account I could sign in into was an old unused one
mholt 11mo ago
I am stuck in this loop as well. All devices, all attempts to clear cookies, log out and back in, etc, don't work.
- jcglz 11mo ago
  twitter login is trash. The captchas, the loops, the verifications. It has always been clunky as hell.
web3nomad 11mo ago
stuck but I've never used any hardware security keys on my account
gamekathu 11mo ago
Same - this should be a major SEV
snaveen 11mo ago
Looks like they only test in `prod`. Probably they used grok to generate the tests code ;)
dansoto 11mo ago
"Get a YubiKey," they said. "It'll be fun!," they said. Grrrrr.....stuck like Chuck.
- organizedwalrus 11mo ago
  What gets me is that I re-enrolled weeks ago and still got stuck in this loop. Sigh.
  - terrywang 11mo ago
    Uh-oh, looks like the only way out is to unenroll security key completely (if it was enrolled when DNS rebrand was not done).
0xdecker 11mo ago
same
dotnet00 11mo ago
Kind of crazy this made it into production, one would think the geniuses at the everything app would be using security keys themselves and would have more interest than usual in making sure the enrollment process is flawless...
RichHickson 11mo ago
FFS. Me to.
ukroger 11mo ago
good to know I'm not alone, can't figure out how to get out of the re-enroll deadlock.
ike0790 11mo ago
smh. who pushed this nonsense to prod. I'm locked out too lol
mikehuntherz 11mo ago
Woke up thinking this was a bug with my device. Then I saw the email code thing, and figured I had misconfigured my domain DNS or forgotten to renew it. Who would've thought it was just x.com being x.com. Hopefully they fix it soon, this is ridiculous.
animegolem 11mo ago
nice to know i'm not specifically fucked here i guess
kphan3499 11mo ago
im not alone. i have all same problem. Anyone know what happened?
kschrader 11mo ago
Also stuck in this endless loop.
derpaderp12 11mo ago
they just fixed it for me (well I'm not stuck in the loop anymore idk if they "fixed" fixed it yet)
- organizedwalrus 11mo ago
  Did you have to relog in or complete the flow one more time or?
omoikane 11mo ago
See also: https://www.reddit.com/r/Twitter/comments/1ovd3wz/im_not_able_to_login_because_xcom_asks_me_to/ https://www.reddit.com/r/Twitter/comments/1ovd3wz/im_not_abl... https://www.windowscentral.com/software-apps/live/x-goes-down-hard-with-a-security-yubikey-error-affecting-millions-of-twitter-users https://www.windowscentral.com/software-apps/live/x-goes-dow...
jcglz 11mo ago
Glad to hear I'm not alone. Just made an account on this website to type this lol. The twitter login loops are somehow WORSE than the Microsoft login page, which is crazy to believe. I have tried to save the passkey using Bitwarden and that also doesn't work, they clearly broke something.
jelled 11mo ago
Happened to me as well. Side note, why isn't this on the front page? The points to recency ratio seems high enough.
ninjastahr 11mo ago
I've been trying to re-enroll mine when they prompted me previously and it didn't work then, I have no idea why they decided to force it when enrollment wasn't working already.
smileybarry 11mo ago
Same here, I've re-enrolled my Yubikeys 3 times so far, to the point that trying a full re-login asks "what do you want to use for 2FA?" and the list is 6+ generic named "Security Key".
jcglz 11mo ago
My account seems to be back, I didn't do anything. Just went to X and now it loads. Now to see what configuration is set for 2fa on my account... Looks like my traditional 2fa method was removed and only the security key is left.
- organizedwalrus 11mo ago
  They forced turning off authenticator in the re-enroll flow for me originally. Now just stuck in a loop of authenticating. Hopefully mine comes back soon. This is frustrating.
  - jcglz 11mo ago
    Please explain to me how deactivating the "normal" 2fa is a good idea, they are so lost. And idk man, I simply clicked on an article on Google and it loaded right up lol. Looks like they are reverting, try refreshing.
    - organizedwalrus 11mo ago
      They are indeed very, very lost. I don't understand it either. Ideally, you want multiple methods of authentication! Sigh. If I do get back in I might just try re-adding it lol. Thank you for your insight.
      - jcglz 11mo ago
        Looks like it's fully reverted now, try again.
ClintGA 11mo ago
Grok says they are reverting the changes now, should be fixed soon. Funny I can still get in to Gork.
ninjastahr 11mo ago
Looks like they reverted the changes, I was able to get back in.
- almog 11mo ago
  And looks like in the process any drafts users may have had are all gone now.
sebow 11mo ago
Same here on 2 accounts, both having 2fa through a HW key(yubikey; though passkeys have the same behavior). At some point today(few hours ago) both my desktop and phone got reditected to x.com/account/access, where the loop started. Frustratingly enough, i had already done the "re-enrollment" a long time ago(basically when they announced it was mandatory), but it seems like that was pointless(hopefully not). I saw some prompts about birdhouse, re-did the enrollment, and badly enough (I think i dug my own hole with this one) it asked to remove the other 2FA option (SMS), to which I clicked yes. This might sound bad but I sincerely hope X fixes it somehow, and all the keys enrolled/re-(re-[etc])-enrolled are not lost, especially those that were not added today. It might be a good idea (in practice, bad for security) to disable this new "https://x.com/account/access?flow=two-factor-security-key-policy-enforcement https://x.com/account/access?flow=two-factor-security-key-po..." garbage fully, as I don't see myself contacting X support anytime soon(for obvious reasons).
- sebow 11mo ago
  (replying instead of editing for timestamp purposes) I clicked "enroll" randomly again > an "error has occurred" message appeared > the page randomly refreshed and everything works now.
terrywang 11mo ago
Prompted a couple of times only on the mobile device. I have a YibiKey 4 so it's inconvenient to do it with a USB-C to USB-A adapter. Ignored it for a while and eventually I wasn't able to use X without "re-enroll". So I did it on a laptop. The process seemed legit, the entire flow was weird and not intuitive, I had to stop and read twice before proceeding (e.g. "Where to store passkey", disable all other MFA ans only use Security Key, a backup recovery code was given...). After going through all that, find myself locked out of X because of the infinite re-enroll loop, OMG. Contacted support, let's see how long it takes. After this, I don't think I'll continue to use Security Key with X...
- terrywang 11mo ago
  Great idea to let the bullets fly. After taking a nap, the issue was fixed by X Text message and Authenticator were disabled, two Yubikeys present in Security Keys. I don't get the idea of this process.
lilinyu 11mo ago
me too, first time I heard about this Yubikey and they said that I needed to re-enroll to unlock... This just shows how weak we are in the social network era.
denysvitali 11mo ago
Oh wow, here's the thread I was looking for. I'm stuck in the same loop and effectively locked out of my account. I wanted to complain about this on X and of course I can't do that. I also wanted to see if I was the only one affected or it was more widespread, but of course being logged out it's impossible. Thankfully there's still HN :)
- ClintGA 11mo ago
  I'm still locked out too.. No clue what to do. I just did a support ticket.
sebst 11mo ago
Same for me. I've seen many people being back to normal though. I re-enrolled on mobile using a Yubikey NFC with the iOS app back in October when prompted. Force logged-out today from a session on Desktop Chrome. Stuck in the loop. Force logged-out on iOS app. Burnt recovery code in further attempts. Tried again when support asked me to by email. Got a "suspicious login attempt prevented" message. That's 2 hours ago. Silence from support since. Tried again, back to the loop (the "suspicious login attempt" message is gone), but I'm still not able to re-enroll the key. Anyone can describe their setup that managed to login again?
- sebst 11mo ago
  Update: back to normal. I can login
betobetico 11mo ago
Now it works, at least for me. Try now!
ushuz 11mo ago
This fixes it for me: - Open incognito - Go to https://x.com/settings/security_and_account_access https://x.com/settings/security_and_account_access - Log in, somehow this won't trigger that re-enroll loop - Disable two-factor auth in the settings - Log back in your regular browser tab

57 points by nake13 11mo ago

ransam124 11mo ago

I don't even know what a Yubikey is and I'm stuck in this loop

nake13 11mo ago

The post is gaining traction as more than a dozen users, including me, report the same issue.

almog 11mo ago

Got here after finding myself stuck in that exact loop (which initially I assumed was a phishing attempt from a webview ad link I thought I accidentally clicked). Looks like some users who have never used or heard of Yubikey report being locked out and stuck in the same loop.

sfsylvester 11mo ago

Yep, this is me as well.

HaasOnSaas 11mo ago

Stuck in this loop also. Even re-enrolling with different Yubikeys didn't seem to solve this. It's persisting across different devices as well, happening both on iOS and on desktop.

dan_pixelflow 11mo ago

Same here - simply cannot fix it, and it's somewhat annoying that it talks about Yubikeys when I'm only using on-device security keys instead. Must be very confusing for many others!

k_sze 11mo ago
I was very confused, too. I mean, I do have a YubiKey but Twitter/X has never (or for a very very very long time not) asked me to use my YubiKey to authenticate. As far as I could remember, I only need to use OTP from Authy as 2FA to login. So the whole thing smelled really fishy.

arvidkahl 11mo ago

Same here, been reporting the broken flow to customer support. An interesting part is the "we'll send you an email to confirm you're you", followed by a "enter validation code here" screen that immediately gets forwarded to the re-enrollment message. Also, no confirmation emails are being sent. Very surprised to see this being deployed to prod.

derpaderp12 11mo ago
my exact same experience... you knew they would fuck it up... and they have!
- arvidkahl 11mo ago
  If "we need to have this done by Nov 12th" is the milestone they were going for, and not a functional flow, then it was a great success.
zkms 11mo ago
>An interesting part is the "we'll send you an email to confirm you're you", followed by a "enter validation code here" screen that immediately gets forwarded to the re-enrollment message. Also, no confirmation emails are being sent. That is _exactly_ what happens to me.
rebane2001 11mo ago
on android and browser i get that behavior, on ios it just says "something went wrong" after the email confirm part
- smileybarry 11mo ago
  Same on iOS, with the fun bonus of the "something went wrong" modal looping as well! (Without retrying, you're just stuck in modal hell)
dragonis41 11mo ago
Same for me, I cannot do anything. Looks like someone did not test its code before deployment

mbaril010fi 11mo ago

I'm stuck .... how can this go to prod.

blanker 11mo ago

Same here, tried 3 times and it seemed to be endless.

AmmarT 11mo ago

Same here stuck in the Loop myself Added Iphone passkey tried loggin in but nothing

dindoodestroyer 11mo ago

This might never be fixed.

dan_pixelflow 11mo ago
thats a bit weird from you edit: OP originally said 'This is what happens when you hire Indian engineers'

dindoodestroyer 11mo ago

Same problem here. Got logged out 30 min ago, can’t get back in. This is what happens when you hire Indians.

deleted 11mo ago

[deleted]

derpaderp12 11mo ago

me too

deleted 11mo ago

[deleted]

robbiet480 11mo ago

Also happening here across two accounts.

sunaookami 11mo ago

Yeah same for me, re-registering the Passkey in Bitwarden worked but it just loops after that with the same message. "Testing in prod" I guess. EDIT: they fixed it now

derpaderp12 11mo ago

one of the reasons i waited so long to do it is bc i knew twitter would fuck it up... and lo and behold they now force you to... anddddd they fucked it up

smashah 11mo ago

I take solace in the fact that for this one time i'm not the only one stuck in a bs purgatory. Is it too much to ask of a roman-saluting trillionaire to not break basic things?

noname120 11mo ago

What happened to phased rollouts in production?

rohukas 11mo ago

locked as well rip

stevyhacker 11mo ago

What a shitty UX, the only account I could sign in into was an old unused one

mholt 11mo ago

I am stuck in this loop as well. All devices, all attempts to clear cookies, log out and back in, etc, don't work.

jcglz 11mo ago
twitter login is trash. The captchas, the loops, the verifications. It has always been clunky as hell.

web3nomad 11mo ago

stuck but I've never used any hardware security keys on my account

gamekathu 11mo ago

Same - this should be a major SEV

snaveen 11mo ago

Looks like they only test in `prod`. Probably they used grok to generate the tests code ;)

dansoto 11mo ago

"Get a YubiKey," they said. "It'll be fun!," they said. Grrrrr.....stuck like Chuck.

organizedwalrus 11mo ago
What gets me is that I re-enrolled weeks ago and still got stuck in this loop. Sigh.
- terrywang 11mo ago
  Uh-oh, looks like the only way out is to unenroll security key completely (if it was enrolled when DNS rebrand was not done).

0xdecker 11mo ago

same

dotnet00 11mo ago

Kind of crazy this made it into production, one would think the geniuses at the everything app would be using security keys themselves and would have more interest than usual in making sure the enrollment process is flawless...

RichHickson 11mo ago

FFS. Me to.

ukroger 11mo ago

good to know I'm not alone, can't figure out how to get out of the re-enroll deadlock.

ike0790 11mo ago

smh. who pushed this nonsense to prod. I'm locked out too lol

mikehuntherz 11mo ago

Woke up thinking this was a bug with my device. Then I saw the email code thing, and figured I had misconfigured my domain DNS or forgotten to renew it. Who would've thought it was just x.com being x.com. Hopefully they fix it soon, this is ridiculous.

animegolem 11mo ago

nice to know i'm not specifically fucked here i guess

kphan3499 11mo ago

im not alone. i have all same problem. Anyone know what happened?

kschrader 11mo ago

Also stuck in this endless loop.

derpaderp12 11mo ago

they just fixed it for me (well I'm not stuck in the loop anymore idk if they "fixed" fixed it yet)

organizedwalrus 11mo ago
Did you have to relog in or complete the flow one more time or?

omoikane 11mo ago

See also: https://www.reddit.com/r/Twitter/comments/1ovd3wz/im_not_able_to_login_because_xcom_asks_me_to/ https://www.reddit.com/r/Twitter/comments/1ovd3wz/im_not_abl... https://www.windowscentral.com/software-apps/live/x-goes-down-hard-with-a-security-yubikey-error-affecting-millions-of-twitter-users https://www.windowscentral.com/software-apps/live/x-goes-dow...

jcglz 11mo ago

Glad to hear I'm not alone. Just made an account on this website to type this lol. The twitter login loops are somehow WORSE than the Microsoft login page, which is crazy to believe. I have tried to save the passkey using Bitwarden and that also doesn't work, they clearly broke something.

jelled 11mo ago

Happened to me as well. Side note, why isn't this on the front page? The points to recency ratio seems high enough.

ninjastahr 11mo ago

I've been trying to re-enroll mine when they prompted me previously and it didn't work then, I have no idea why they decided to force it when enrollment wasn't working already.

smileybarry 11mo ago

Same here, I've re-enrolled my Yubikeys 3 times so far, to the point that trying a full re-login asks "what do you want to use for 2FA?" and the list is 6+ generic named "Security Key".

jcglz 11mo ago

My account seems to be back, I didn't do anything. Just went to X and now it loads. Now to see what configuration is set for 2fa on my account... Looks like my traditional 2fa method was removed and only the security key is left.

organizedwalrus 11mo ago
They forced turning off authenticator in the re-enroll flow for me originally. Now just stuck in a loop of authenticating. Hopefully mine comes back soon. This is frustrating.
- jcglz 11mo ago
  Please explain to me how deactivating the "normal" 2fa is a good idea, they are so lost. And idk man, I simply clicked on an article on Google and it loaded right up lol. Looks like they are reverting, try refreshing.
  - organizedwalrus 11mo ago
    They are indeed very, very lost. I don't understand it either. Ideally, you want multiple methods of authentication! Sigh. If I do get back in I might just try re-adding it lol. Thank you for your insight.
    - jcglz 11mo ago
      Looks like it's fully reverted now, try again.

ClintGA 11mo ago

Grok says they are reverting the changes now, should be fixed soon. Funny I can still get in to Gork.

ninjastahr 11mo ago

Looks like they reverted the changes, I was able to get back in.

almog 11mo ago
And looks like in the process any drafts users may have had are all gone now.

sebow 11mo ago

Same here on 2 accounts, both having 2fa through a HW key(yubikey; though passkeys have the same behavior). At some point today(few hours ago) both my desktop and phone got reditected to x.com/account/access, where the loop started. Frustratingly enough, i had already done the "re-enrollment" a long time ago(basically when they announced it was mandatory), but it seems like that was pointless(hopefully not). I saw some prompts about birdhouse, re-did the enrollment, and badly enough (I think i dug my own hole with this one) it asked to remove the other 2FA option (SMS), to which I clicked yes. This might sound bad but I sincerely hope X fixes it somehow, and all the keys enrolled/re-(re-[etc])-enrolled are not lost, especially those that were not added today. It might be a good idea (in practice, bad for security) to disable this new "https://x.com/account/access?flow=two-factor-security-key-policy-enforcement https://x.com/account/access?flow=two-factor-security-key-po..." garbage fully, as I don't see myself contacting X support anytime soon(for obvious reasons).

sebow 11mo ago
(replying instead of editing for timestamp purposes) I clicked "enroll" randomly again > an "error has occurred" message appeared > the page randomly refreshed and everything works now.

terrywang 11mo ago

Prompted a couple of times only on the mobile device. I have a YibiKey 4 so it's inconvenient to do it with a USB-C to USB-A adapter. Ignored it for a while and eventually I wasn't able to use X without "re-enroll". So I did it on a laptop. The process seemed legit, the entire flow was weird and not intuitive, I had to stop and read twice before proceeding (e.g. "Where to store passkey", disable all other MFA ans only use Security Key, a backup recovery code was given...). After going through all that, find myself locked out of X because of the infinite re-enroll loop, OMG. Contacted support, let's see how long it takes. After this, I don't think I'll continue to use Security Key with X...

terrywang 11mo ago
Great idea to let the bullets fly. After taking a nap, the issue was fixed by X Text message and Authenticator were disabled, two Yubikeys present in Security Keys. I don't get the idea of this process.

lilinyu 11mo ago

me too, first time I heard about this Yubikey and they said that I needed to re-enroll to unlock... This just shows how weak we are in the social network era.

denysvitali 11mo ago

Oh wow, here's the thread I was looking for. I'm stuck in the same loop and effectively locked out of my account. I wanted to complain about this on X and of course I can't do that. I also wanted to see if I was the only one affected or it was more widespread, but of course being logged out it's impossible. Thankfully there's still HN :)

ClintGA 11mo ago
I'm still locked out too.. No clue what to do. I just did a support ticket.

sebst 11mo ago

Same for me. I've seen many people being back to normal though. I re-enrolled on mobile using a Yubikey NFC with the iOS app back in October when prompted. Force logged-out today from a session on Desktop Chrome. Stuck in the loop. Force logged-out on iOS app. Burnt recovery code in further attempts. Tried again when support asked me to by email. Got a "suspicious login attempt prevented" message. That's 2 hours ago. Silence from support since. Tried again, back to the loop (the "suspicious login attempt" message is gone), but I'm still not able to re-enroll the key. Anyone can describe their setup that managed to login again?

sebst 11mo ago
Update: back to normal. I can login

betobetico 11mo ago

Now it works, at least for me. Try now!

ushuz 11mo ago

This fixes it for me: - Open incognito - Go to https://x.com/settings/security_and_account_access https://x.com/settings/security_and_account_access - Log in, somehow this won't trigger that re-enroll loop - Disable two-factor auth in the settings - Log back in your regular browser tab