Twitter Limits SMS-Based 2-Factor Authentication to Blue Subscribers Only

Feb 18, 2023Ravie LakshmananAuthentication / Online Security

Twitter has announced that it’s limiting the use of SMS-based
two-factor authentication (2FA) to its Blue subscribers.

“While historically a popular form of 2FA, unfortunately we have
seen phone-number based 2FA be used – and abused – by bad actors,”
the company said^[1].

“We will no longer allow accounts to enroll in the text
message/SMS method of 2FA unless they are Twitter Blue
subscribers.”

Twitter users who have not subscribed to Blue that have enrolled
for SMS-based 2FA have time till March 20, 2023, to switch to an
alternative method such as an authenticator app or a hardware
security key.

After this cutoff date, non-Twitter Blue subscribers will have
their option disabled.

The alternative methods “require you to have physical possession
of the authentication method and are a great way to ensure your
account is secure,” Twitter noted.

Given that SMS has been the least secure form of 2FA^[2], the latest enforcement
is likely to force people to move towards secure forms of
authentication.

According to Twitter’s own data^[3], only 2.6% of all active
accounts have enabled at least one form of 2FA. SMS accounts for
74.4%, followed by authenticator apps (28.9%) and security keys
(0.5%).