I think 2FA is to guard against someone gaming their "lost my password" process as much as against someone brute-forcing your pw.

Yes, but that would actually be less secure because my phone number is quite public and I'd be a SIM swap attack away from someone being able to compromise this account in a way that I would not be able to easily recover from (and to lose my long time phone number in the process).

AFAICT you can configure TOTP / Security Key based MFA for Twitter and disable text messages, but I don't recall if they force you to give them your phone number first: https://twitter.com/settings/account/login_verification

Regardless that still wouldn't protect you against somebody social engineering their support team. The account security page at https://twitter.com/settings/security has an "Additional password protection" but that seems to inhibit automated password reset requests, not support-related ones.

You don't have to use SMS for 2FA on twitter.

Have you checked: https://twitter.com/settings/apps_and_sessions

That brings up a page where Twitter wants my phone number, which they can't have.

You're assuming at this point they want your number.

It is not unreasonable to assume that this has been changed to the attackers number.

True, but they are still asking for it even now and they prefix it with the NL country code.

Easy enough to figure out NL, your phone number is in your HN profile.

Then, the hacker just gets a local number, which should be easy enough these days.

True, but I would assume this is because Twitter has geolocated my IP to NL.

Oddly enough I was able to select between [ Text message, Authentication app, Security key ]. I chose Authentication app, and I was not asked for my phone number. Though your account may now be in a "special state" due to these circumstances.

EDIT: Ah I see elsewhere you said you don't use a smart phone (thus, no authentication app.)

Your account being compromised doesn't necessarily mean your password was compromised. Attackers are constantly developing new ways of accessing people's accounts. There's no valid reason to assume that there was an "elaborate hack of Twitter." Even people who are very careful, as it sounds like you are, can be successfully targeted. I don't know if turning on 2FA would have prevented this, but it sure wouldn't have hurt.

Then I'm super interested in the mechanism used because I was under the impression that as long as my password is secure my account is secure barring a hack of Twitter at an entirely different level.

2FA the way Twitter uses it (using SMS to phone number) would in my opinion be less secure rather than more secure because it opens up a whole slew of possible attacks that would then also involve my phone.

Twitter also supports WebAuthn security keys as 2FA, much stronger than SMS/TOTP.

FYI, Twitter supports Google Authenticator as well.

That might be worth setting up, thank you.

I'm not saying this is what happened, but compromising your e-mail is also a possibility.

Also, I'm not sure how you can say "there is _no way_" your account password was compromised. Can you know for certain that you haven't ever executed code which couldn't potentially be malicious or have security issues? Hell, if you use a web browser there's a non-zero chance that some website you visited was compromised to serve you some javascript which exploits a zero-day in whatever browser you use. You can say that's unlikely, but there's a lot of possible scenarios like that, and you're worryingly willing to just dismiss them all and say there's _no way_ this could be anything other than a vulnerability on Twitter's side.

That is true, my email could be compromised.

But: my browser - which I use to access my email - is locked down to the point that a normal user probably wouldn't find it much fun, between umatrix and adblock plus there isn't a whole lot of javascript that runs before I authorize it.

Agreed that it is possible. But still unlikely.

Or you just accidentally typed your password into the wrong site, perhaps via phishing?

Believing you weren't/couldn't be phished is a great way to get phished again...

No, this is not possible. This password was generated by Firefox and apart from the test earlier to see whether or not it was changed I have never used it elsewhere much less copied it. It would have to be a session hijack or something like that.

or you have a keylogger on your computer, or were phished yourself

Not a chance. Seriously, I'm if anything utterly paranoid about this sort of thing and this box is as secure as it ever was.

Paranoid would imply that you set up Authenticator app based 2FA and a Security key. ;-)

https://twitter.com/settings/account/login_verification

I don't have a smart phone and don't want to give Twitter my phone number because I see that as a risk rather than a solution.

Wow, TIL that you don't have a smart phone, so interesting!

Anyway, twitter has had app based 2FA since the end of 2017...

https://techcrunch.com/2017/12/20/twitter-adds-support-for-a...

A year ago, they added security key support:

https://9to5mac.com/2021/06/30/twitter-users-can-now-add-sec...

You don't need a phone to have security.

I don't have a smartphone specifically because I believe they are insecure by design, at least one company and a whole raft of employees there have access to it and that's before we get into automatic updates of the software on those devices and so on.

When I say I'm pretty sure that this machine wasn't compromised that is because I'm utterly paranoid when it comes to stuff like this. Possibly not paranoid enough - given the evidence just obtained...

Where do you back up your passwords?

(don't answer that, just something to think about)

These days, you can never be too paranoid. I religiously 2FA all my accounts the moment I create them.

> Where do you back up your passwords?

That's a good one: on a server with an asymmetric encryption system (different decryption key than encryption key) the decryption key is not stored in any automated system, the back up is 'pull' from that one server inbound to this machine.

I guess it is theoretically possible that someone broke into the backup server but it too is locked down pretty good, to the point that if I want access I'll have to get into the car and go there in person. Call me paranoid :)