One interesting effect of Twitter’s onion address: your 2FA options are limited. Any WebAuthn/FIDO/U2F keys you have registered with your Twitter account won’t work, because the key registration is tied to the domain name. I have the same problem on Facebook. I can only use these onion sites if I log in with TOTP.
One would think you could re‐register the keys while logged in to the onion site, but I’ve never succeeded with this on Facebook or Twitter. I don’t know if there is a technical limitation preventing WebAuthn from being used over onion sites, or just a problem with these particular sites’ implementations. Tor itself is not the problem—you can use a registered WebAuthn key over Tor if the domains you’re visiting are facebook.com or twitter.com.