Situatie

Twitter in February 2023 announced that text message two-factor authentication (2FA) is set to become a premium feature for Twitter Blue accounts.

Twitter has said that it will soon be removing text message-based 2FA from non-paying accounts and turning it into a feature that will only be available to subscribers of its premium Twitter Blue offering, which costs $8 per month. This means that any users who don’t pay for a Blue subscription and rely on Twitter to send them an SMS text message code to complete the login process will have the feature turned off and removed from their accounts by March 20. Their account password will become the only barrier to access.

Aside from purely financial reasons (presumably it costs Twitter to send you a text), making text-based 2FA a paid-for perk is an odd decision on Twitter’s part.

Twitter has justified the policy change by saying, rightly, that SMS 2FA can be abused by bad actors. And there have indeed been “SIM swap attacks” where hackers convinced cell providers to assign a victim’s phone number to a device they control, and by taking control of a person’s phone number, the hacker can impersonate the victim, as well as receive text message codes to their account. But making SMS 2FA available only to Twitter Blue subscribers simply makes them more susceptible to attacks of this nature.

Twitter says that it is “committed to keeping people safe and secure on Twitter,” and it’s true that SMS 2FA is better than no 2FA at all, but its policy does nothing to encourage users to switch to a more secure form of 2FA – perhaps because doing so means paying Twitter absolutely nothing.

Switching to App-Based 2FA is the Solution.

Solutie

Pasi de urmat

Tip solutie

Permanent