The online security of you and your friends and family is more at risk now than it’s ever been. People are still regularly using the same username and password across most, if not all their online accounts. Any leak of one set of access details is a leak of all their access details.
When two factor authentication was launched it became a saviour for these people. You would need physical hardware to generate or receive a one time code, as well as your username and password.
Twitter implemented this initially as SMS only one time code sending. You added your mobile number to your Twitter account and it would start sending codes at the point of login and requiring the code to login successfully.
The first version would only allow your mobile number to be connected to a single account, so if you wanted to secure multiple accounts you were out of luck.
There is also a flaw in the SMS system though which can allow hackers to redirect the security code to any number they choose. It’s not widely used, but still exists.
More recently Twitter added the ability to use other methods of two factor authentication. Apps like Last Pass, 1Password and Authy allow you to store all your access details behind a single master password.
Sounds great right? No more relying on mobile phones. Well, no. The trouble is, that to use a password manager with Twitter, you first have to add your mobile number to your Twitter account. You then have to manually disable the SMS option to stop Twitter always sending the SMS codes.
The kicker here is that if you remove your mobile phone number from your Twitter account, it also removes any other two factor authentication you’ve set up.
You cannot have two factor authentication on your Twitter account if you don’t have a mobile phone linked to the account.
This is an astonishing requirement, and one many security experts are calling short-sighted and even a dark pattern.
You would hope that Twitter would put security before all else, but in this case that doesn’t seem to be so.
You can find me on twitter via @HarryBailey