Twitter faces FTC probe, likely fine over use of phone numbers for ads

Re:Twitter faces FTC probe, likely fine over use of phone nu... by noscrewstoyous on Tuesday August 04, 2020 @05:31PM (#24054714)

You shouldn’t use a phone number for 2fa to begin with, you’d be better off without 2fa if that’s the only option IMO (assuming you’re using a strong unique password). This is just more fuel on that fire.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by diabeetusman on Tuesday August 04, 2020 @05:37PM (#24054759)

2FA with SMS protects against password reuse or leaks. It's my understanding that SMS is weak against attacks targeted at particular people while being sufficiently strong for the majority of cases.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by thephyber on Tuesday August 04, 2020 @06:18PM (#24055100)

SS7 attacks scale better. SIM cloning is a lot of effort just to compromise a single SMS number.

In general, SMS is better than no 2FA, but it's weaker than OTP/OTH or a token like YubiKey or Titan.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by geofft on Tuesday August 04, 2020 @07:09PM (#24055496)

Not sure I follow "You'd be better off without 2FA" (unless you're counting the use of the number for advertising) - it's weak, but it doesn't introduce additional vulnerabilities.

And IIRC at the time Twitter didn't offer any other 2FA mechanisms.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by noscrewstoyous on Sunday August 16, 2020 @10:53AM (#24178275)

it’s a false sense of security

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by VibrantClarity on Tuesday August 04, 2020 @07:32PM (#24055637)

Twitter didn't give me a choice when I made an account, it forced me to give them an email and a phone number.

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by t-writescode on Tuesday August 04, 2020 @07:02PM (#24055432)

Wouldn’t a phone-based 2FA also give you the knowledge that someone’s trying to log in? Can the SMS message somehow not be sent to all users on the network with your phone number?

[ Parent | on HN ]

Re:Twitter faces FTC probe, likely fine over use of phone nu... by moscovium on Tuesday August 04, 2020 @06:12PM (#24055049)

Remember when Jack Dorsey had his SIM attacked for the 2fa?

[ Parent | on HN ]