How to Secure Your Twitter Without Giving Elon Musk Money • TechCrunch

Late FridayTwitter has announced a new policy that will remove two-factor authentication (2FA) from text messages from any account that won’t pay for it.

In a blog post, Twitter said it would only allow accounts that subscribe to its premium Twitter Blue feature to use text message-based 2FA. Twitter users who don’t switch to another type of two-factor authentication will have the feature removed from their accounts by March 20.

This means that anyone who relies on Twitter to send a text message code to their phone to log in will have their 2FA disabled, allowing anyone to access their account with a simple password. If you have an easily guessable Twitter password or are using that same password on another site or service, you need to act as soon as possible.

Twitter says it is “committed to keeping people safe on Twitter”. It’s not true. Instead, you’re watching one of the dumbest security decisions a company makes unfolding in real time.

It’s unclear why this new 2FA policy, first revealed by Zoë Schiffer from the platform and later confirmed by Twitter, was instituted. Since Elon Musk’s $44 billion buyout, Twitter has been haemorrhaging cash and employees. It’s likely that the decision to eliminate 2FA SMS was to save the company money, given that texting isn’t cheap. We’d ask Twitter for comment, but Musk fired his entire communications team.

Twitter justified the decision by his blog post, saying that SMS 2FA can be abused by bad actors. These can include SIM swapping attacks, where a hacker convinces your mobile provider to assign a victim’s phone number to a device controlled by the hacker. By taking control of a person’s phone number, the hacker can impersonate the victim, as well as receive text message codes that can allow the hacker to gain access to a victim’s online accounts. But making SMS 2FA available only to Twitter Blue subscribers doesn’t further protect paying users from SIM-swapping attacks. On the contrary, by encouraging paid users to rely on SMS 2FA, their Twitter accounts are more likely to be hacked if their phone number is hacked.

That being said – and this is important – SMS 2FA still offers much better protection for your accounts than not using 2FA at all. But Twitter’s new policy is not the way to encourage users to use a more secure 2FA. In fact, companies like Mailchimp are taking the opposite (but correct) approach by encouraging users to enable 2FA by reducing monthly customer bills.

The silver lining — if we can call it that — is that Twitter isn’t removing 2FA completely. You can still protect your account with a solid 2FA without paying Elon Musk a penny.

Whether or not you’ve ditched your Twitter account in favor of alternative, decentralized services like Mastodon and others, you’ll still want to take action before March 20 to secure your account in case someone breaks in and starts tweeting. in your name. .

Instead of using 2FA codes sent via SMS, you need an app-based 2FA, which is much more secure and as fast as receiving an SMS. (Many online sites, services, and apps also offer app-based 2FA.) Instead of having a code sent to your phone via text message, you can generate a code through an authenticator app on your phone, such as Duo, Authy or Google Authenticator. to name a few. It’s all the more secure because the code never leaves your device.

To set this up, first make sure you have your authenticator app installed on your phone. Go to your Twitter account, then go to Settings and privacySO Security and account accessSO Security. Once you’re on the Two-factor authentication settings, then select Authenticator app. Follow the prompts carefully – you may need to enter your account password to get started. Once you’re done, you’ll be able to sign in using your password and then a code generated from your authenticator app.

Remember that this is a much more secure way to access your Twitter account, which means that if you lose your phone it can be very difficult to get back into your account. That’s why you should keep track of your backup codes, which allow you to access your account if you get locked out, stored securely in your password manager. You can find your backup codes in the same place where you set up your app-based 2FA.