Twitter faces FTC probe, likely fine over use of phone numbers for ads

Re:Twitter faces FTC probe, likely fine over use of phone nu... by jeremynixon on Tuesday August 04, 2020 @05:03PM (#24054471)

This is a deep violation that makes every user of 2fa _unsafe_. A mere $250 million? This needs to be the kind of violation that endangers the company. It's not a mistake or honest error when 2fa phone numbers are used for advertising. This is malicious. Should be scaled to 100X the amount the company gained in advertising for the violation.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by 1vuio0pswjnm7 on Tuesday August 04, 2020 @06:59PM (#24055416)

I don't have the citation but I recall a researcher who was studying this practice. He suggests that these requests for "factors" will continue to escalate to the point of absurdity. The sales pitch to the user is essentially "The more we know about you, the more we can protect you." However, if the user is seeking protection from others who are trying to discover her personal details, then this continual "full disclosure" to each tech company is counterproductive.

This sort of nonsensical reasoning has also used by individuals portraying themselves as "whitehats" who try to profit from large leaks of personal data. Users are asked to provide personal data to the whitehat in order to confirm whether their personal data has been leaked.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by vmception on Tuesday August 04, 2020 @09:57PM (#24056542)

I report every social media company that only offers SMS 2FA.

They obviously have enough engineers and awareness to do software based OTP, and clearly only want SMS for their phone number social graph and data brokering operation.

So, LOL FTC.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by Silhouette on Tuesday August 04, 2020 @06:18PM (#24055095)

This is a deep violation that makes every user of 2fa _unsafe_.

It's certainly a violation of trust that could make people less likely to volunteer extra information for 2FA that could be used against them, even if it might also make them safer. For that alone, wilful violations ought to be treated as a serious breach under data protection laws.

The number of important financial services I use that now insist on phone numbers for 2FA is getting irritating, too. Apparently in some cases it's been prompted by the changes in EU rules under PSD2, but as with almost everything else I've come across so far under PSD2, I'm not sure how much safer it will really make anyone. At least those financial services -- and my government, which is the other organisation I see doing this routinely now -- probably aren't going to use the contact information for anything other than the 2FA they claim, though.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by m-p-3 on Thursday August 06, 2020 @10:04AM (#24070966)

On another note, SMS 2FA needs to stop being a thing. Telcos and their systems can't be trusted if all it takes is someone to hijack or intercept your phone number and texts.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by noscrewstoyous on Tuesday August 04, 2020 @05:31PM (#24054714)

You shouldn’t use a phone number for 2fa to begin with, you’d be better off without 2fa if that’s the only option IMO (assuming you’re using a strong unique password). This is just more fuel on that fire.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by diabeetusman on Tuesday August 04, 2020 @05:37PM (#24054759)

2FA with SMS protects against password reuse or leaks. It's my understanding that SMS is weak against attacks targeted at particular people while being sufficiently strong for the majority of cases.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by thephyber on Tuesday August 04, 2020 @06:18PM (#24055100)

SS7 attacks scale better. SIM cloning is a lot of effort just to compromise a single SMS number.

In general, SMS is better than no 2FA, but it's weaker than OTP/OTH or a token like YubiKey or Titan.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by geofft on Tuesday August 04, 2020 @07:09PM (#24055496)

Not sure I follow "You'd be better off without 2FA" (unless you're counting the use of the number for advertising) - it's weak, but it doesn't introduce additional vulnerabilities.

And IIRC at the time Twitter didn't offer any other 2FA mechanisms.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by noscrewstoyous on Sunday August 16, 2020 @10:53AM (#24178275)

it’s a false sense of security

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by VibrantClarity on Tuesday August 04, 2020 @07:32PM (#24055637)

Twitter didn't give me a choice when I made an account, it forced me to give them an email and a phone number.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by t-writescode on Tuesday August 04, 2020 @07:02PM (#24055432)

Wouldn’t a phone-based 2FA also give you the knowledge that someone’s trying to log in? Can the SMS message somehow not be sent to all users on the network with your phone number?

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by moscovium on Tuesday August 04, 2020 @06:12PM (#24055049)

Remember when Jack Dorsey had his SIM attacked for the 2fa?

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by WrtCdEvrydy on Tuesday August 04, 2020 @06:33PM (#24055222)

Should be 1 million per user per text message sent out.

Trust me, if our agencies had teeth, and executed a corporation for shit like this, we'd have a better technology ecosystem.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by edmundsauto on Tuesday August 04, 2020 @06:41PM (#24055287)

Similarly, if we executed every criminal who is convicted of a violent crime, we would have far fewer violent criminals.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by WrtCdEvrydy on Tuesday August 04, 2020 @08:59PM (#24056165)

I'd argue if you take data and misuse it for profit, you should get a higher danger than a slap on the wrist.

[ Parent | on HN ]