Two Factor Authentication on Twitter is Broken

Your online security is more at risk now now than it’s ever been. Many people use the same username and password across most, if not all their online accounts.

When two factor authentication was launched it became a saviour for these people. You would need physical hardware to generate or receive a one time code, as well as your username and password.

Twitter implemented this initially as SMS only one time code sending. You added your mobile number to your Twitter account and it would start sending codes at the point of login and requiring the code to login successfully.

The first version would only allow your mobile number to be connected to a single account, so if you wanted to secure multiple account, you were out of luck.

There is also a flaw in the SMS system though which can allow hackers to redirect the security code to any number they choose. It’s not widely used, but still exists.

More recently Twitter added the ability to use other methods of two factor authentication. Apps like Last Pass, 1Password and Authy allow you to store all your access details behind a single master password.

The trouble is, that to use a password manager with Twitter, you first have to add your mobile number to your Twitter account. You then have to manually disable the SMS option to stop Twitter always sending the SMS codes.

The kicker here is that if you remove your mobile phone number from your Twitter account, it also removes any other two factor authentication you’ve set up.

You cannot have two factor authentication on your Twitter account if you don’t have a mobile phone linked to the account.

This is an astonishing requirement, and one many security experts are calling short-sighted and even a dark pattern.

You would hope that Twitter would put security before all else, but in this case that doesn’t seem to be so.


You can find me on twitter via @HarryBailey

Leave a Reply

Your email address will not be published. Required fields are marked *