Thread by @jsrailton

Twitter about to give hackers a huge gift....

... by *REMOVING text message authentication* for non paying accounts.

Yes, there are better forms of #2FA.

But this is blackmail.

Expect waves of takeovers as hackers run through password dumps. 1/ blog.twitter.com/en_us/topics/p…

2/ Twitter is basically saying "hey the locks on your home aren't the most secure [true]... so we're just removing them at the end of the month [insane]"

Text message authentication isn't great.

And it needs to be evolved away from.

But this is reckless.

3/ You don't make users more secure by unilaterally *degrading* their security, then hoping they do better.

Security is a ratcheting process.

If Twitter goes ahead with this, they absolutely deserve regulatory & Congressional scrutiny.

4/ Here's how to secure your Twitter account with the free Google Authenticator App.*

Step 1: Get the Appp

iOS: apps.apple.com/us/app/google-…

Android: play.google.com/store/apps/det…

Step 2: Follow these instructions (easiest is on desktop): help.twitter.com/en/managing-yo…

5/Moreover, #Twitter's instructions for #TwoFactorAuthentication for mobile-only users = lame.

Like not explaining that it may not be possible to scan a QR code on your phone...with your phone.

(Hint: not possible on all apps, you may need an app that can scan a screenshot).

6/ I'm confident this isn't part of a grand plan to make users more secure ... because the advice Twitter gives on other #TwoFactorAuthentication methods is so bad.

And barely useable.

7/ Platforms know (including Twitter...they fired the experts?)... that getting users to take new security steps is hard.

And takes time.

And really good messaging & user education.

Plus nudges that work.

This has none of that.

8/ Whenever there's a breach, hacking groups try the passwords against *all* accounts they can link to you.

Twitter users with #TwoFactorAuthentication have been protected.

By design.

Turning it off will breathe new life into old breaches.

It will be bad.

9/ My hope:

An ambitious prosecutor / regulator / congressperson compels Twitter to provide the communications that went into the decision to yank SMS #TwoFactorAuthentication from free accounts... against all industry practices & norms.

There's no way that it looks good.

10/ "unfortunately we have seen phone-number based 2FA be used - and abused - by bad actors" - Twitter

Sure. But Twitter probably sees 10,000x more attacks that can be stopped by SMS-2FA. Daily.

And I'm probably massively lowballing.

11/ I've researched & published on #2FA adoption by platforms.

SMS-based 2FA has costs. They pay Twilio et. al. to send those messages.

This, alongside the security issues with SMS-2FA is a great reason to move to better.

But not to move backwards.
computer.org/csdl/magazine/…

12/ He couldn't fix the bot problem ... so decided to make millions of users less secure to save some money?