Analysts Slam Twitters Decision to Disable SMS-Based 2FA

Making the option available only to paid subscribers — while also claiming SMS authentication is broken — doesnt make sense, some say. Is it a cash grab?

Twitters sudden decision to disable SMS-based two-factor authentication (2FA) for all users except subscribers of its paid Twitter Blue service has infuriated security experts and further tarnished the social media giants already somewhat dubious reputation for protecting users of its services.
Twitter, on Feb. 15, announced
that in 30 days it would disable text-message based — or SMS-based — 2FA for all but paying Twitter Blue subscribers. After 20 March 2023, we will no longer permit non-Twitter Blue subscribers to use text messages as a 2FA method, the company said. At that time, accounts with text message 2FA still enabled will have it disabled.
Several analysts view the move as ill-conceived and weakening protections for the millions of users that currently use the two-factor option when accessing their Twitter accounts. Even those who agree with Twitters view about text message-based authentication mechanisms being somewhat susceptible to attack still perceive it as offering magnitudes more protection than not having a second factor at all.
The optics are certainly bad, says Richard Stiennon, chief research analyst at IT-Harvest. This move seems to put a price on better security for Twitter which is the poster child for account takeover attacks dating back to 2008 when a script kiddie in California ran John the Ripper against celebrity accounts to guess their passwords.
The company urged users that still want to enable 2FA for their Twitter accounts to consider using an authentication app or security key/token as their second factor. Authentication apps are mobile apps that generate a one-time password or key that users can use in addition to their password when accessing an account on which they have enabled two-factor authentication. Examples include Google Authenticator, Microsoft Authenticator, and LastPass Authenticator.
Security keys are usually a physical device — like a USB dongle — that users can use to verify their identity when logging in to an account. These methods require you to have physical possession of the authentication method and are a great way to ensure your account is secure, Twitter said.
Using an authenticator app is better [than text-based 2FA], Steinnon notes, but there will never be a large number of users unless Twitter makes such an app a requirement and makes it available for free.
The social media companys brief statement announcing its decision to stop SMS authentication alluded to concerns over the security of the process as the main motivation: While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used — and abused — by bad actors.
The widespread use of mobile devices for SMS-based 2FA authentication, for instance, has driven an increase in
so called SIM-swapping attacks
, where a threat actor transfers another individuals phone number to their SIM card so they can intercept the SMS authentication messages used for 2FA. Concerns over weaknesses in mobile networks allowing attackers to intercept SMS messages and use it to break into 2FA protected accounts have
persisted for years
, as have calls to replace it with stronger token and app based token generators.
Nonetheless, Stiennon and others dismiss that explanation as not being enough reason to disable the option for anyone that wants to use it. For highly targeted attacks, it is true that SMS can be intercepted by determined attackers, he says, noting that such attacks are rare.
John Pescatore, director of emerging security trends at the SANS Institute, says Twitters move is somewhat akin to a bank insisting that users of a free checking account only enter their PIN — and not their ATM card as well — to use an ATM machine. While SMS messaging as 2FA is less secure than tokens, trusted apps, or other phishing-resistant forms, it is still so much more secure than reusable passwords, he says.
The only justification for what they are doing is an attempt to raise revenue, Pesactore tells Dark Reading. Otherwise, why would they allow a supposedly less secure authentication only be available to their paid subscribers, he points out.
A
transparency report
that Twitter released in December 2021 showed at that time that some 2.4% of active Twitter accounts had enabled 2FA. Of that, 74.4% used SMS authentication, 28.9% used an authentication app, and 0.5% had a security key. Based on those numbers (the most recent), only a relatively small proportion of Twitters active accounts would appear directly impacted by Twitters recent decision — though, of course, adoption could have increased since 2021. Still, some see it as another indication of what they perceive as Twitters cavalier attitude toward user security. Earlier this year, after all, an apparent API endpoint compromise at Twitter allowed an attacker to
steal data on some 200 million Twitter users
and put it up for sale on an underground forum.
Twitter has a consistently poor record around security, Pescatore notes. Last year, for instance, the
Federal Trade Commission assessed a $150 million civil penalty
over the company not taking steps required of them to fix problems that caused privacy violations dating back years, he says. Those violations had to do with Twitter using phone numbers and email addresses that it collects for 2FA to deliver targeted advertising instead.
Under new ownership, this year they first tried to increase revenue by giving verified identity status to anyone willing to pay $8, Pescatore adds.
As if the companys security challenges were not bad enough, Elon Musks controversial leadership of Twitter has also put the companys every move under the microscope.
As with anything to do with Twitter nowadays, the broader context for their decisions invites a lot of controversy from all over the political spectrum, says Fernando Montenegro, an analyst with Omdia.
With the latest move, theres a general understanding that SMS 2FA is less resistant to some attacks than the authenticator apps or security keys. So getting users to move towards better MFA is a good thing for potentially improving resilience against these attacks, he adds. Its also a decision that saves Twitter money, as they will no longer be sending MFA SMS messages to accounts that are not subscribers, Montenegro says.
The key question here is whether people use SMS because its easier to set it up or just because they dont know about alternatives, he points out. If the former, and Twitter doesnt make the process easier, then security is likely to suffer. If the latter, then their decision can actually result in more people knowing about other options for MFA and turning those on.

Last News
▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Analysts Slam Twitters Decision to Disable SMS-Based 2FA