> “My phone fell in the ocean!”: Backup codes generated in the application can be written down, stored in a safe place, and used to access your account on twitt

> “My phone fell in the ocean!”: Backup codes generated in the application can be written down, stored in a safe place, and used to access your account on twitter.com even if you lose your phone. You should probably take a look at Twitters official blog post which has a bit more explanation[1]. I hear what you're saying about the "Well what if i lose my private keys" because we had the same issue with CACs. Every private key was escrowed somewhere, but you have to remember that this system is optional, not mandatory. This is security measure is designed to help prevent future AP incidents[2]. As far as phone compromise, that's a valid concern. Any large company should policy in place to regulate devices for validating logins (which don't happen that often). As far as individual users, we'll have to see. Since Android is the dominant mobile platform, I'm guessing that malware will be more prevalent on those devices. [1] - https://blog.twitter.com/2013/improvements-to-login-verification-photos-and-more https://blog.twitter.com/2013/improvements-to-login-verifica... [2] - http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n_3140277.html http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n...