Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

Even if it’s because they’re broke, it’s a good move to drop SMS as an auth factor.

https://www.coinbase.com/blog/authentication-matters-coinbas...

https://images.ctfassets.net/c5bd0wqjc7v0/3Ku5foxu1kUTXa3l5x... (ato = account takeover)

Cannot have it both ways, either it is unsecure and Twitter dropping it is a security improvement, or it is secure, and they're charging for a security feature.

But you cannot argue them dropping it is a good thing while ignoring that they're charging money for people to continue to use it.

For users it's probably a security improvement.

For Twitters owner it's probably a matter of saving a few bucks on SMS fees (but that can't be much).

Twitter Blue still makes very little sense for most people unless Twitter becomes fully paywalled.

For any twitter user that goes from only-SMS-2FA to no 2FA, it isn't a "security improvement"

You can’t fix lazy users and Twitter is not so valuable (being social media) to mandate 2FA. Twitter still offers 2FA options, just not the low effort low security one (per NIST and CISA) for non paying subscribers. If you’re an unpaid user, you shouldn’t be surprised when the burden is being shifted to you (as SMS has a cost; TOTP and passkeys do not). With that said, they should implement passkeys and eliminate SMS auth entirely. 2FA is then a moot point, and everyone can move on to complaining about passkey edge cases.

https://csrc.nist.gov/csrc/media/Presentations/2022/multi-fa...

https://www.cisa.gov/sites/default/files/publications/fact-s...

You‘d be surprised how much SMS to some countries cost!

They‘re only (almost) free in the US and a few other places.

Is it? Non-SMS authentication requires a smartphone and not just a cell phone.

And they still allow it. They just make you pay for it. So it isn't a decision based on security, even though they chalk it up as such.

Is anyone using Twitter from a non smart mobile device? And if you’re using a desktop/laptop, you can use TOTP (via password managers or similar apps) or secure authenticators (hardware or passkey), no?

What are the odds you’re using Twitter without a smartphone or a desktop/laptop? Twitter deprecated tweet via sms long ago.

Anyway! I stand by the assertion. Less users using SMS for 2FA is a good thing, even if a much, much smaller paid cohort still can (~300k Blue subscribers vs ~237M daily active users).

I include CISA and NIST factsheet links on the topic in another comment in the thread, so I won’t duplicate them here.

https://www.theverge.com/2019/9/4/20849865/twitter-disables-...

https://www.theverge.com/2020/4/27/21238131/twitter-sms-noti...

Are there any cell phones left that can connect to modern cell networks but cannot run a TOTP authentication app? There are even authenticator apps for Java ME!

I was thinking of users who might have phones that have a Twitter app or capability (didn't realize at the time of my comment that SMS tweeting is no longer allowed) but no authentication method other than SMS, presumably also without a computer or reliable access to one. Maybe this is inaccurate. However, it still stands that Twitter is pushing people towards the paid subscription by using poor security arguments.

>Non-SMS authentication requires a smartphone and not just a cell phone.

Not accurate. There are applications for totp for Windows, Mac and Linux.

People love to say this, and I used to agree with them, but I don't believe this any more:

1. Governments and phone companies have "stepped up their game" a bit to greatly reduce SIM swapping attacks.

2. For the vast majority of people, SMS 2FA is better than nothing, and if you don't allow SMS people won't do anything - they don't use authenticator apps and keys can (currently) be cumbersome to use, especially across different device types.

Until we have good solutions to get off passwords altogether, SMS is a good solution for a lot of users.

It is, but having SMS MFA enabled on an account is better than no MFA.

That chart might be misleading. In the blog post they say that 95% of their users use SMS auth. 95% of people getting hacked also use SMS auth.

Reply on news.ycombinator.com