5 ms·

Twitter said to be testing two-step security in wake of AP hack

54 points by greyman 14y ago

shaydoc 14y ago
I had thought that they would most definitely be thinking of 2 factor authentication. Couldn't they even achieve this quickly using Twilio to send SMS token codes to users who opt to have 2 factor auth?
chops 14y ago
Two-step authentication, especially for something as prominent as twitter, is always a good thing. So, kudos to them.
- jug6ernaut 14y ago
  > kudos to them. Kudos for being horribly late and reactive instead of proactive? This should have been implemented long long ago imo. Though i do give them more slack than with all of our banking institutions that still don't offer two-factor. But these recent events show how importing two-factor(or security in general) for even things like social media are.
InclinedPlane 14y ago
Good news! Your service is now so popular, well liked, and extensively used that important organizations use it and trust it. Bad news: Now you have to go the extra mile to make sure it isn't misused. I think this still falls into the category of problems that it's good to have, barely.
citricsquid 14y ago
A few years ago there was a strange byline on a few tweets from @spam, it said "by {username}" indicating that there was some sort of system allowing specific users to send tweets from a different account, here is a screenshot from January 2010: http://i.imgur.com/o0iVS.png http://i.imgur.com/o0iVS.png Does anyone have any insight on why Twitter haven't implemented that sort of system (nominated accounts able to tweet from a corporate account) and seemingly abandoned the idea in 2010? One of our Twitter accounts has ~30,000 followers and we have to share the password amongst the company in a spreadsheet, that sort of poor security is encouraged by a single login model, with all the previous high profile account compromises it seems strange Twitter hasn't addressed this before. Maybe someone knows why, or can speculate why?
- nchlswu 14y ago
  Is that at all mitigated by tools like HootSuite or other corporate Twitter clients that allow multiple people to manage an account? I'm not saying that it's acceptable that Twitter leaves that in the hands of vendors/users, I'm genuinely curious and wondering why the idea was parked in the first place. I'd guess that it is part of a future offering from Twitter, but who knows.
- smackfu 14y ago
  Depends... Which is a worse attack vector: a single account with a shared password, or a shared account where each person has their own personal account password? Twitter really needs shared accounts + required two-factor for the personal accounts.
  - benmccann 14y ago
    At the very least it's better for auditing. If one of your employee's accounts is hacked to send a fake tweet you immediately know which one instead of potentially having no way to know.
- bcherry 14y ago
  This is the "Contributors" feature, which has been tested internally and with a few partners, but has never been widely enabled. It's in the public API, but still disabled for all but internal accounts and those few partners. https://dev.twitter.com/docs/api/1/get/users/contributors https://dev.twitter.com/docs/api/1/get/users/contributors I don't have any current insight into the status of Contributors, and won't speculate, but the feature has been stagnant for almost 3 years now (just like Lists).
tedchs 14y ago
Two factor authentication is a funny thing in 2013. All computer users understand passwords (and the basics of password complexity/secrecy) at this point. That covers the "something you know" factor. Many users conceptually understand a "something you have/are" factor in the form of biometric scans or smartcards. Unfortunately, those approaches are not practical to deploy outside a controlled enterprise setting. On the Web, the only approach that isn't a non-starter today is TOTP, what Google Authenticator uses. Unfortunately, basically zero users understand this, creating a large education issue, and frankly it's a pain in the neck for users ("why do I need to go find my phone to log in??"). The upside is it's easy for Web app developers to integrate TOTP, and it adds significantly to account security if used correctly. Facebook and Google have offered this as an option for quite some time, and with Twitter's current prominence as part of corporate advertising, I am surprised they are this late to the party.
- grimman 14y ago
  I really, really wish you were right when you said "All computer users understand passwords [...]". I frequently end up doing a lot of support stuff for my father, and he's not really that old. His line of work has him dealing with some pretty sensitive material, and a two-factor authentication is required for it... something that, when introduced, was a source for many calls and angry shouting. I could have deferred this to their tech people, but I'd much rather spare them the anguish. ;) Bottom line: It's getting better, but you are still, unfortunately for us all, way too optimistic.
- betterunix 14y ago
  How are smartcards not practical outside of a controlled enterprise? The biggest issue I see is that most people do not have smartcard readers, but that could be fixed pretty quickly.
  - zokier 14y ago
    In finland there was an serious attempt to use smart cards for general populace. It didn't pan out mostly because nobody had card readers and it had to compete with OTP based solutions which didn't require extra hardware.
marcuspovey 14y ago
Any service that acts as an oauth provider but which doesn't use 2 factor is being grossly negligent, and should be avoided.
zokier 14y ago
I just hope they will use the same standard mechanism that Google and now MS use.
fnordfnordfnord 14y ago
Maybe accounts for clients like the AP need not a two-factor system, but perhaps messages should only originate from a whitelisted set of IP addresses.
- justin 14y ago
  This isn't really a good solution for mobile phones which change IP address frequently.
  - fnordfnordfnord 14y ago
    Of course it isn't. But I can't imagine why the AP would want anyone to send tweets on their behalf from a mobile phone. Maybe there isn't a single solution that meets the needs of every user.
    - xxpor 14y ago
      >But I can't imagine why the AP would want anyone to send tweets on their behalf from a mobile phone. Reporters in the field? Especially in a breaking news situation where they want to be first.
      - fnordfnordfnord 14y ago
        Are you suggesting that there may be many AP reporters who are authorized to tweet on AP's behalf from the field, implying a total lack of editorial control (and probably a total lack of coordination as well)? I think that is very unlikely. I'd find it very hard to believe that there isn't a very well defined system in place to control all official correspondence. They have a news desk that is staffed 24hrs per day. Surely a person there could monitor tweets or communications from reporters in the field. I'd even expect there to be a different individual with the keys to the Twittermachine.
herge 14y ago
I am surprised that Twitter has not used features for bigger customers like this as a monitizing strategy. When they used to have a user cap, they could have just charged companies or people to go over that cap. Same thing here, charge for two factor authentication. Maybe even charge for verified accounts.
awold 14y ago
Imagine logging in to services only using Google Glass. When prompted to log in, a temporary passcode pops up on Glass. I think it would make two-factor authentication much more streamlined and unobtrusive compared to having your phone beside you and opening an app just to log in.
uses 14y ago
Make it a publicly visible badge so we know how serious account holders are about their security.

54 points by greyman 14y ago

I had thought that they would most definitely be thinking of 2 factor authentication. Couldn't they even achieve this quickly using Twilio to send SMS token codes to users who opt to have 2 factor auth?

chops 14y ago

Two-step authentication, especially for something as prominent as twitter, is always a good thing. So, kudos to them.

jug6ernaut 14y ago
> kudos to them. Kudos for being horribly late and reactive instead of proactive? This should have been implemented long long ago imo. Though i do give them more slack than with all of our banking institutions that still don't offer two-factor. But these recent events show how importing two-factor(or security in general) for even things like social media are.

InclinedPlane 14y ago

Good news! Your service is now so popular, well liked, and extensively used that important organizations use it and trust it. Bad news: Now you have to go the extra mile to make sure it isn't misused. I think this still falls into the category of problems that it's good to have, barely.

citricsquid 14y ago

A few years ago there was a strange byline on a few tweets from @spam, it said "by {username}" indicating that there was some sort of system allowing specific users to send tweets from a different account, here is a screenshot from January 2010: http://i.imgur.com/o0iVS.png http://i.imgur.com/o0iVS.png Does anyone have any insight on why Twitter haven't implemented that sort of system (nominated accounts able to tweet from a corporate account) and seemingly abandoned the idea in 2010? One of our Twitter accounts has ~30,000 followers and we have to share the password amongst the company in a spreadsheet, that sort of poor security is encouraged by a single login model, with all the previous high profile account compromises it seems strange Twitter hasn't addressed this before. Maybe someone knows why, or can speculate why?

nchlswu 14y ago
Is that at all mitigated by tools like HootSuite or other corporate Twitter clients that allow multiple people to manage an account? I'm not saying that it's acceptable that Twitter leaves that in the hands of vendors/users, I'm genuinely curious and wondering why the idea was parked in the first place. I'd guess that it is part of a future offering from Twitter, but who knows.
smackfu 14y ago
Depends... Which is a worse attack vector: a single account with a shared password, or a shared account where each person has their own personal account password? Twitter really needs shared accounts + required two-factor for the personal accounts.
- benmccann 14y ago
  At the very least it's better for auditing. If one of your employee's accounts is hacked to send a fake tweet you immediately know which one instead of potentially having no way to know.
bcherry 14y ago
This is the "Contributors" feature, which has been tested internally and with a few partners, but has never been widely enabled. It's in the public API, but still disabled for all but internal accounts and those few partners. https://dev.twitter.com/docs/api/1/get/users/contributors https://dev.twitter.com/docs/api/1/get/users/contributors I don't have any current insight into the status of Contributors, and won't speculate, but the feature has been stagnant for almost 3 years now (just like Lists).

tedchs 14y ago

Two factor authentication is a funny thing in 2013. All computer users understand passwords (and the basics of password complexity/secrecy) at this point. That covers the "something you know" factor. Many users conceptually understand a "something you have/are" factor in the form of biometric scans or smartcards. Unfortunately, those approaches are not practical to deploy outside a controlled enterprise setting. On the Web, the only approach that isn't a non-starter today is TOTP, what Google Authenticator uses. Unfortunately, basically zero users understand this, creating a large education issue, and frankly it's a pain in the neck for users ("why do I need to go find my phone to log in??"). The upside is it's easy for Web app developers to integrate TOTP, and it adds significantly to account security if used correctly. Facebook and Google have offered this as an option for quite some time, and with Twitter's current prominence as part of corporate advertising, I am surprised they are this late to the party.

grimman 14y ago
I really, really wish you were right when you said "All computer users understand passwords [...]". I frequently end up doing a lot of support stuff for my father, and he's not really that old. His line of work has him dealing with some pretty sensitive material, and a two-factor authentication is required for it... something that, when introduced, was a source for many calls and angry shouting. I could have deferred this to their tech people, but I'd much rather spare them the anguish. ;) Bottom line: It's getting better, but you are still, unfortunately for us all, way too optimistic.
betterunix 14y ago
How are smartcards not practical outside of a controlled enterprise? The biggest issue I see is that most people do not have smartcard readers, but that could be fixed pretty quickly.
- zokier 14y ago
  In finland there was an serious attempt to use smart cards for general populace. It didn't pan out mostly because nobody had card readers and it had to compete with OTP based solutions which didn't require extra hardware.

marcuspovey 14y ago

Any service that acts as an oauth provider but which doesn't use 2 factor is being grossly negligent, and should be avoided.

zokier 14y ago

I just hope they will use the same standard mechanism that Google and now MS use.

fnordfnordfnord 14y ago

Maybe accounts for clients like the AP need not a two-factor system, but perhaps messages should only originate from a whitelisted set of IP addresses.

justin 14y ago
This isn't really a good solution for mobile phones which change IP address frequently.
- fnordfnordfnord 14y ago
  Of course it isn't. But I can't imagine why the AP would want anyone to send tweets on their behalf from a mobile phone. Maybe there isn't a single solution that meets the needs of every user.
  - xxpor 14y ago
    >But I can't imagine why the AP would want anyone to send tweets on their behalf from a mobile phone. Reporters in the field? Especially in a breaking news situation where they want to be first.
    - fnordfnordfnord 14y ago
      Are you suggesting that there may be many AP reporters who are authorized to tweet on AP's behalf from the field, implying a total lack of editorial control (and probably a total lack of coordination as well)? I think that is very unlikely. I'd find it very hard to believe that there isn't a very well defined system in place to control all official correspondence. They have a news desk that is staffed 24hrs per day. Surely a person there could monitor tweets or communications from reporters in the field. I'd even expect there to be a different individual with the keys to the Twittermachine.

herge 14y ago

I am surprised that Twitter has not used features for bigger customers like this as a monitizing strategy. When they used to have a user cap, they could have just charged companies or people to go over that cap. Same thing here, charge for two factor authentication. Maybe even charge for verified accounts.

awold 14y ago

Imagine logging in to services only using Google Glass. When prompted to log in, a temporary passcode pops up on Glass. I think it would make two-factor authentication much more streamlined and unobtrusive compared to having your phone beside you and opening an app just to log in.

uses 14y ago

Make it a publicly visible badge so we know how serious account holders are about their security.