Hacker News Reader

Comment by ineptech | Hacker News Reader

I think 2FA is to guard against someone gaming their "lost my password" process as much as against someone brute-forcing your pw.

View on HN

Yes, but that would actually be less secure because my phone number is quite public and I'd be a SIM swap attack away from someone being able to compromise this account in a way that I would not be able to easily recover from (and to lose my long time phone number in the process).

You don't have to use SMS for 2FA on twitter.

Have you checked: https://twitter.com/settings/apps_and_sessions

That brings up a page where Twitter wants my phone number, which they can't have.

You're assuming at this point they want your number.

It is not unreasonable to assume that this has been changed to the attackers number.

True, but they are still asking for it even now and they prefix it with the NL country code.

Easy enough to figure out NL, your phone number is in your HN profile.

Then, the hacker just gets a local number, which should be easy enough these days.

True, but I would assume this is because Twitter has geolocated my IP to NL.

Oddly enough I was able to select between [ Text message, Authentication app, Security key ]. I chose Authentication app, and I was not asked for my phone number. Though your account may now be in a "special state" due to these circumstances.

EDIT: Ah I see elsewhere you said you don't use a smart phone (thus, no authentication app.)

AFAICT you can configure TOTP / Security Key based MFA for Twitter and disable text messages, but I don't recall if they force you to give them your phone number first: https://twitter.com/settings/account/login_verification

Regardless that still wouldn't protect you against somebody social engineering their support team. The account security page at https://twitter.com/settings/security has an "Additional password protection" but that seems to inhibit automated password reset requests, not support-related ones.

Reply on news.ycombinator.com