Hacker News Reader

Comment by woadwarrior01 | Hacker News Reader

Twitter has had support for proper TOTP based 2FA ever since Jack Dorsey got SIM Swapped in 2019[1]. This was also the time when they added support for hardware tokens like Yubikeys. Of course, one needs to enable it.

[1]: https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-...

View on HN

Just having a phone number added to Twitter means your account is at risk of being taken over with a sim-swap. This was not 2FA related AFAICT. Twitter also requires you to add a phone number, even on old accounts you can get locked out unless you add one.

I've got an account from 2009 and have never had to enter my phone number (if I ever get asked, that'll be the time when I stop using it).

Nowadays if you create a new account it’ll get briefly banned while they do additional checks to ensure you’re human, which is fixed by giving a phone number. Id almost appreciate just asking for one on signup then the charade

That's not always the case. Sometimes it asked me for a phone number, but most of the time not when not using a VPN or something similar. But last year I managed to create two Twitter accounts with the Tor browser and some sketchy email address and never got asked for a number, just had to do some captcha after a few minutes.

I created a few twitter accounts this year for various reasons and all of them had the same number requirement after around 24 hours!

The various Meta properties do this too, except instead of phone numbers they require government ID and headshots. It’s all a scummy dark pattern relying on the sunk cost fallacy.

I've used Twitter from 2013 to 2021, and have eventually been locked-out by Twitter requesting a phone number with no way to work around.

It'll be a shame if that happens to my account, as I lurk on Twitter every day (but never tweet or like), but I value privacy of my phone number more than I value the enjoyment I get from it.

That's when I ended up using nitter. Before stopping altogether when Elmo broke it.

Doesn't Twitter force you to add a phone number now?

As far as I remember they only use it for spam protection (i.e. the phone number serves as a moderate-level "proof of humanity"), but not for 2FA purposes (unless you pay for their premium service).

Yes and they plan to require ID verification next, losing privacy-conscious users is clearly not a big issue for Musk.

The big problem is that apparently if you have a phone number linked to your account, it can be used to reset your password even with TOTP 2FA enabled which to me, is bonkers: https://twitter.com/TimBeiko/status/1700659107764785336

Twitter was requiring phone numbers for a while for account verification and I had mine attached from pre-history, but have obviously removed it after people have been pointing this out as an attack vector.

I'm a bit paranoid about 2FA ever since my charging port got damaged and I literally couldn't charge my phone to get to authentication.

Scary stuff, had to give sooo much personal information over the course of months to recover a single account.

Not sure a solution, maybe have a wifi only phone that I only turn on for Auth?

Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks.

You did write them down like the site told you to, right?

Even if a site doesn't offer backup codes, you can extract the TOTP secret from the QR code, or most authenticator apps, quite easily, and then write it down.

It's more secure to only save the backup codes though since they have a limited number of uses, while the TOTP secret has unlimited uses.

I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code!

Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!

Damn, you're lucky it's not something important. Especially with accounts for things like Google or Facebook/Instagram where they boast about not having any human support and you are totally shit-out-of-luck if you can't get in.

Except Google. Google backup codes are near useless because a Google backup code will let you log in, but won't allow you to disable 2 factor or add a new 2 factor device - meaning if you ever lose a 2 factor device and have to use a backup code, there is no way to recover your account.

Really? I'd imagine you'd need two codes (one for the login, one for access to your 2FA settings), but not being able to recover at all using them seems horrible!

It just gives some error like "this login method is not allowed for this action" or similar.

Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubikey, and it worked flawlessly. It probably helped that I used the same machine as always. Google does a lot of undocumented heuristics in the background, and you either get additional verification or not.

Yes, same machine helped, it's definitely one of the factors it uses.

I have a near-20-year Google account I can't access because I lost the 2FA number. I have the username, password and recovery email. But that isn't enough, apparently.

This is why it’s good to also enroll a hardware key or two if the site/service offers the option. One could for example have a “rescue” YubiKey stuck away in their closet that could be added. MacBooks with Touch ID can also work if you have one of those handy — some sites allow enrolling it via Safari and IIRC Chrome and its myriad clones present Touch ID as a generic key that can be enrolled anywhere WebAuthN is supported.

For extra assurance get a hardware key that supports NFC so it can be used with your phone (and some laptops) even if it can’t be plugged in for some reason.

Multi-pronged 2FA also enables things like being able to remove a key from your account without issue if for example one turns up missing while traveling.

You can enroll multiple devices using the same TOTP QR code, just scan it more than once. They will generate the same code sequence and the site won’t know the difference.

You can even save the QR code and enroll a new device later if you want.

> You can enroll multiple devices using the same

You could even save it in an application like KeepassXC. Then you turn on the TOTP mode and presto, you have another TOTP device

bitwarden has TOTP built in as well. Apple has it built into their platform, but its tougher to use and only works with Chrome if you use windows too.....

QRcode TOTP, and print the QRcode out and store it in a safe/offline.

That way you can easily re add the 2fa token to a replacement device.

Authy solves this by putting all the TOTP keys behind a master password and then backing it up online, so you can get up and running on a different device quickly. It's the same trade-off as a password manager, where your eggs are all in one basket but hopefully it's a secure basket.

Have a paper backup of the codes?

And carry it with you at all times, of course.

All those proponents of a 'proper security with a strict 2FA' never been out of country, mugged, in an accident or in any combination of these.

Hell, if I just lose my wallet and would be forced to reissue the IDs and SIM (retaining the number!) it would take weeks to be back 'online'.

It is good to know that hardware wallets such as Trezor and Ledger supports 2FA protocols so if you have one there is no need to use another device.

If you're actually using them for their intended use (storing your crypto), the less you connect them to your computer, the better. Check them 2-4x a year to make sure they're updated, but I wouldn't want to carry my cold storage device on my keychain like I do my YubiKey.

Reply on news.ycombinator.com