Why You Should Listen to Twitter on Two-Factor Authentication

Twitter recently rolled out a major change that will affect the way most people protect their accounts. The company has told non-paying users that they will soon have to stop using a popular security feature: SMS two-factor authentication.

Let me explain why it’s not as bad as you might fear.

Simply put, two-factor authentication requires two security steps to verify that you are who you say you are. The first step asks for a username and password, and the second asks you to either enter a temporary code sent to you or log in to a physical security key. This way, even if someone knows your password, that person will need to complete the second step to log into your account.

Twitter’s announcement of this change was initially confusing and alarming to many. But to be clear, Twitter is pushing users to adopt stronger safeguards — and that’s given us all an opportunity to bite the bullet and improve the security of our online accounts.

Twitter said in a blog post that users who were not subscribed to its Twitter Blue service would no longer be able to use text messages as a form of authentication after March 20. Non-paying users can switch to different verification techniques with enhanced forms of security. Alternatives rely on either using a third-party app to generate a temporary code or connecting an authorized security key to access your account.

“Using free authenticator apps for 2FA will remain free and be much more secure than texting,” said Twitter owner Elon Musk. tweeted.

Twitter was right about flaws in SMS authentication, according to Casey Ellis, chief technology officer of security firm Bugcrowd. “It actually makes sense, but it just wasn’t executed cleanly,” Mr Ellis said.

But there are downsides to Twitter’s approach, he added. Authentication using text messages has been the easiest security tool for a large majority of people to use. Other techniques require additional steps to configure.

(Also confusing: Paid Twitter users will still be able to rely on codes texted to them to log in — an odd choice if that form of authentication is less secure. Twitter didn’t immediately respond to a request for comment. .)

Switching to other security methods isn’t intuitive, so there’s a risk that many non-paying Twitter users will resort to omitting two-factor authentication altogether.

Amidst all this, however, there is a valuable opportunity to learn more about the strongest two-factor authentication methods – and why we should consider using one of them, given that possible, instead of SMS security for all of our online accounts. Here’s what you need to know about each method and its pros and cons.

SMS Authentication

For many years, Twitter and other sites encouraged users to implement two-factor authentication via SMS. This method sends a time-sensitive security code to a user’s phone. This is the most widely used form of two-factor authentication because virtually everyone has a cell phone, so even the most untech savvy person can figure it out.

But over time, security researchers have found SMS authentication to be increasingly problematic.A text message containing a security code could be intercepted by someone who has hacked your phone number – a scam known as SIM swapping. This is how hackers broke into the Twitter account of the company’s former chief executive, Jack Dorsey, in 2019.

There are more problems. A text message is not encrypted, so there may be a security risk of receiving texts over foreign networks in heavily monitored countries like China and Russia. Also, if you are traveling outside of the United States, receiving text messages on a foreign carrier can be expensive.

Security researchers continue to uncover new flaws in SMS authentication, so we can expect more sites and apps to block users from receiving codes via SMS, Ellis said.

Authentication apps

This brings us to authenticator apps, which you download to a phone or computer. They generate temporary security codes (instead of texting them to your phone) that you enter to log into your online accounts and apps.

Let’s take Twitter and the Google Authenticator app as an example.

• First, download the Google Authenticator app on your phone. Then, on Twitter.com on a computer, click More→Security and account access→Two-factor authentication→Authenticator app.

• From there, follow the steps on Twitter. You will be asked to use the Authenticator app to scan a QR code with your phone’s camera, which will link the app to your Twitter account and start generating security codes.

When you log into Twitter, you enter your username and password, then open the Authenticator app to find the temporary code.

The big downside to using authenticators is that if you lose your phone or upgrade to a new one, it can be difficult to regain access to your accounts. Generally, a site or application like Twitter will allow you to regain access to your account with a recovery code. In Twitter’s two-factor authentication settings, a menu titled “backup codes” will generate a code for you to log in again. Be sure to write down this code and store it in a safe place.

This technique takes time and mental bandwidth to set up properly and get used to, but it’s better overall. It’s much harder for someone to hijack your device to see your security codes than to intercept a text message.

Security keys

The third method – using a physical security key in the form of a USB drive that you insert into your computer or phone to log in – is the most secure of all. We probably won’t see this technique widely adopted because the key costs money, and if you lose your key, it can be difficult to regain access to your account.

Take the example of Twitter and Google’s Titan security key.

• First, you need to purchase a security key. Google sells its Titan security key for $30; it includes a pair of keys for different types of computers and phones.

• Then, on Twitter.com on a computer, click More→Security and account access→Two-factor authentication→security key.

• From there, follow Twitter’s instructions, which will walk you through plugging the key into a USB port and pressing a button to verify the key. Twitter will then show a screen with a backup code in case you lose your key. Store it in a safe place.

Kind of a hassle, right? Still, it can be useful for people who work in very sensitive areas, like government agencies and activism.

Conclusion

In conclusion, the authenticator app is the two-factor method which is relatively convenient and very secure to use. I recommend most people choose one app, such as Google Authenticator, Authy, or Microsoft Authenticator, and stick with it. They all work the same way.

Setting up an authenticator app with all of your online accounts can take a while, but you only need to do it once. And in the long run, it could save you time, as connecting to sites with this method can be faster than waiting for text messages to arrive.