Twitter introduced yesterday that as of March 20, it can solely permit its customers to safe their accounts with SMS-based two-factor authentication in the event that they pay for a Twitter Blue subscription. Two-factor authentication, or 2FA, requires customers to log in with a username and password after which a further “issue” like a numeric code. Safety specialists have lengthy suggested that folks use a generator app to get these codes. However receiving them in SMS textual content messages is a well-liked different, so eradicating that possibility for unpaid customers has left safety specialists scratching their heads.

Twitter’s two-factor transfer is the newest in a sequence of controversial coverage modifications since Elon Musk acquired the corporate final yr. The paid service Twitter Blue—the one method to get a blue verified checkmark on Twitter accounts now—prices $11 per 30 days on Android and iOS and fewer for a desktop-only subscription. Customers being booted off of SMS-based two-factor authentication may have the choice to change to an authenticator app or a bodily safety key.

“Whereas traditionally a preferred type of 2FA, sadly, we’ve got seen phone-number primarily based 2FA be used—and abused—by unhealthy actors,” Twitter wrote in a weblog submit revealed yesterday night. “So beginning immediately, we’ll now not permit accounts to enroll within the textual content message/SMS technique of 2FA until they’re Twitter Blue subscribers.”

In a July 2022 report about account safety, Twitter mentioned that solely 2.6 p.c of its lively customers have any kind of two-factor authentication enabled. Of these customers, practically 75 p.c have been utilizing the SMS model. Nearly 29 p.c have been utilizing authenticator apps and fewer than 1 p.c had added a bodily authentication key.

SMS-based two-factor authentication is insecure as a result of attackers can hijack targets’ cellphone numbers or use different methods to intercept the texts. However safety specialists have lengthy emphasised that utilizing SMS two-factor is considerably higher than not having a second authentication issue enabled in any respect. 

More and more, tech giants like Apple and Google have eradicated the choice for SMS two-factor and transitioned customers (sometimes over many months or years) to different types of authentication. Researchers fear that Twitter’s coverage change will confuse customers by giving them so little time to finish the transition and making SMS two-factor look like a premium characteristic.

“The Twitter weblog is correct to level out that two-factor authentication that makes use of textual content messages is regularly abused by unhealthy actors. I agree that it’s much less safe than different 2FA strategies,” says Lorrie Cranor, director of Carnegie Mellon’s usable privateness and safety lab. “But when their motivation is safety, would not they wish to preserve paid accounts safe too? It would not make sense to permit the much less safe technique for paid accounts solely.”  

Whereas the corporate says its modifications to two-factor will roll out in mid-March, Twitter customers with SMS two-factor turned on began encountering a pop-up overlay display yesterday that suggested them to take away two-factor solely or change to “the authentication app or safety key strategies.” 

It’s unclear what is going to occur if customers don’t disable SMS two-factor by the brand new deadline. The in-app message to customers implies that individuals who nonetheless have SMS two-factor turned on when the change formally occurs on March 20 will likely be locked out of their accounts. “To keep away from dropping entry to Twitter, take away textual content message two-factor authentication by March 19, 2023,” the notification says. However Twitter’s weblog submit says that two-factor will merely be disabled on March 20 if customers do not modify it earlier than then. “After 20 March 2023, we’ll now not allow non-Twitter Blue subscribers to make use of textual content messages as a 2FA technique,” the corporate wrote. “At the moment, accounts with textual content message 2FA nonetheless enabled may have it disabled.”