Intellectual Property
Twitter's two-factor authentication change "doesn't make sense"
Warning: Undefined array key "FocusKeyphrase" in /var/www/vhosts/lawyersinamerica.com/httpdocs/app/views/singleBlog/singleBlogView.php on line 59">
Biz & IT
Feb 2023
Twitter announced Friday that as of March 20, it will only allow its users to secure their accounts with SMS-based two-factor authentication if they pay for a Twitter Blue subscription. Two-factor authentication, or 2FA, requires users to log in with a username and password and then an additional "factor" such as a numeric code. Security experts have long advised that people use a generator app to get these codes. But receiving them in SMS text messages is a popular alternative, so removing that option for unpaid users has left security experts scratching their heads.
Twitter's two-factor move is the latest in a series of controversial policy changes since Elon Musk acquired the company last year. The paid service Twitter Blue--the only way to get a blue verified checkmark on Twitter accounts now--costs $11 per month on Android and iOS and less for a desktop-only subscription. Users being booted off of SMS-based two-factor authentication will have the option to switch to an authenticator app or a physical security key.
SANKUU Yoga Strap, Multi-Loop Strap, 12 Loops Yoga Stretch Strap, Nonelastic Stretch Strap for Physical Therapy, Pilates, Dance and Gymnastics with Ca...
$9.98
CHICECO Travel Yoga Gym Bag for Women, work tote bag,2 x Separate shoe bag,Wet Dry Storage Pockets,Carryall Sports Duffle Bag, Black(Yoga Mat Not Incl...
$33.99
HeyNuts Wherever Crop Top Workout Tank Tops No Padding
$19.99
NAVISKIN Women's UPF 50+ Sun Protection Hiking Capri Pants Lightweight Quick Dry Running Jogger Capri
$19.99
In a July 2022 report about account security, Twitter said that only 2.6 percent of its active users have any type of two-factor authentication enabled. Of those users, nearly 75 percent were using the SMS version. Almost 29 percent were using authenticator apps, and less than 1 percent had added a physical authentication key.
SMS-based two-factor authentication is insecure because attackers can hijack targets' phone numbers or use other techniques to intercept the texts. But security experts have long emphasized that using SMS two-factor is significantly better than having no second authentication factor enabled.
Increasingly, tech giants like Apple and Google have eliminated the option for SMS two-factor and transitioned users (typically over many months or years) to other forms of authentication. Researchers worry that Twitter's policy change will confuse users by giving them so little time to complete the transition and making SMS two-factor seem like a premium feature.
"The Twitter blog is right to point out that two-factor authentication that uses text messages is frequently abused by bad actors. I agree that it is less secure than other 2FA methods," says Lorrie Cranor, director of Carnegie Mellon's usable privacy and security lab. "But if their motivation is security, wouldn't they want to keep paid accounts secure too? It doesn't make sense to allow the less secure method for paid accounts only."
