What I Learned After I Published My Twitter Password

The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's not a flaw - if someone got his password from a compromised database they shouldn't be able to leverage that into finding out his phone number or anything else about him, if he's already arranged with Twitter (or any other service) to a protocol which basically says, "Don't believe anyone saying they are me unless they both know my password and have my phone."

Frankly, a well-designed 2FA system shouldn't even reveal whether or not you've successfully authenticated using one of the factors. For TOTP this is possible because you can enter in the username, password and TOTP code all at the same time (though it's rare to see this implementation). Even if TOTP is not enabled for most accounts, you'd still want to show the box and say, "Leave this blank if you don't have TOTP enabled". For this SMS-based second-factor, I'm not sure how to design it so that there are no side-channel attacks other than sending an SMS with an authentication token every single time, whether or not the password was entered correctly (which allows random people with your login to just randomly send you authentication spam).

There are moves towards such a future with U2F / UAF (Fido) and Yubikeys (a U2F version is meant to be released this year). I know it won't roll out exactly as planned, but I'm still excited by the tech.

OP's Twitter account is only as secure at his cell phone service account.

Now the other part of the equation: a security system has to be designed against real-world practicalities...In this case, where does the main risk come from? Mass-anonymous attacks, such as phishing or a database compromise ...now unless phone-numbers can be mass-acquired via knowing a bunch of passwords (can the installing of the Twitter app for iPhone and clicking the "send to phone" link be automated?)...it now becomes a lot of work to take that extra step...and when you've completed it...you still can't break into the Twitter account...How many phishers are stealing passwords just so they can learn a bunch of people's phone numbers? The ones that have that strategy...well, keep on doing that, because that's way more work than other channels for mass-gathering phone numbers.

Now, if the retort is, "well, there may be someone who an attacker REALLY wants to compromise, and the phone number is one more piece of the puzzle."...Then that's a different ballgame. Now you have an attacker who is not drive-by-random phishing, but is going after one person, and going after that one person hard.

So the situation where a victim gives an antagonist (say, the FBI, or NSA, or whoever you are investigating) their password...again, that is most definitely an edge case. And it requires a different systems design (by design, I mean, the details fallback procedures for cases when a user loses their phone and needs to recover it, and so forth).

I can see advantages for Twitter to show the phone number to someone who knows an email and the actual password: you may be someone with multiple phones, or have forgotten that your 2-factor-auth is assigned to a different phone/Google Voice...showing the phone number mitigates the confusion of the user who's wondering when the hell the code is coming, when in fact, the code may never come to the expected phone number.

So, how frequent is that situation compared to one where a user announces his password to the whole world? I'm guessing, quite frequent.