What I Learned After I Published My Twitter Password
blogs.wsj.com
What I Learned After I Published My Twitter Password
1–10 of 39 posts
Re: What I Learned After I Published My Twitter Password
#2I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.
Re: What I Learned After I Published My Twitter Password
#3I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.
Re: What I Learned After I Published My Twitter Password
#4OK, the key newsy takeaway:
> But a glaring flaw in Twitter’s account-security system lets anyone who obtains your password learn whatever mobile-phone number you’ve associated with your Twitter account if you turned on a simple but highly effective security measure
So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff.
Granted, I'm having a hard time thinking why Twitter would feel the need to expose the phone-number at all to a user outside of his/her own account page, so I'm guessing that is some unintended bug. However, consider the situation: The OP gives away his password...Two-factor authentication never, ever meant "hey, it's just as strong as if you give away one of the factors"...I've never designed a security system before, but I'm guessing things would become very convoluted if security designers had to treat giving away your password -- as a public announcement and media figure -- as anything but an edge case. The inconvenience of 2-factor-authentication is meant to offset the problem of total compromise given the relatively frequent chance of getting phished. Twitter's flaw, as described, is likely not a main attack vector for phishers who are sending out thousands and thousands of emails and hoping to get turnkey access to someone's account...even if Twitter gives away the phone-number through some sort of exerted effort...that's unlikely to be the exerted effort used by mass phishers. It's a totally different security game when you're the target of thousands rather than one target among thousands.
(that said, Twitter should fix the flaw, unless there's some other dependency on having the phone number be accessible)
Re: What I Learned After I Published My Twitter Password
#5The article mentions using Google Authenticator but I'd recommend Duo (Duo Mobile on Android) as it lets you reorganize your accounts, assign icons to various accounts, and only shows the token you care about via expanding with a much larger font. Once I passed around 6 two-factor accounts Google Authenticator became too hard to use.
Re: What I Learned After I Published My Twitter Password
#6I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline…
> So if your Twitter password happens to be the same as your ATT password, you're out of luck.
Why would you have both passwords be the same? That makes no sense. All passwords should be different.
> I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.
TOTP based two-factor auth (e.g. Google Authenticator) is my preferred method as well though I'll still set up an alternative method if it's not available. For example Namecheap offers 2FA via SMS. While not preferred, it's better than nothing.
Re: What I Learned After I Published My Twitter Password
#7I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you, and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than that, because who knows what security policies are in place for most services - having half of a two-factor pair here has clearly been interpreted as being someone "more authenticated" than having NONE of a single factor).
That said, I would love it if the default single factor authentication method were public keys rather than passwords. I get how impractical that is with people constantly trying to access things in some device-independent way, but I fantasize about a world where everyone carries around a cheap hardware authentication module that just negotiates the cryptographic part of SSL handshakes as the primary authentication factor (with passwords and biometrics as secondary and tertiary factors as desired). Sure would be nice if the only thing that could be leaked after a data breach was your public key.
Re: What I Learned After I Published My Twitter Password
#8Good article. In both this and the previous articles, the author seemed to know what he was talking about, gave actual security advice, and ran an interesting experiment.
Re: What I Learned After I Published My Twitter Password
#9I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.
As long as his Twitter account was isolated[1], the only risk was losing control of his twitter account for a few days. And given the fact that he published an article previously saying that he was going to give away his password, I don't think that he would run into much trouble even if they used his twitter account for malicious purposes.
[1]This is, the twitter account wasn't being used to log into other services.
Re: What I Learned After I Published My Twitter Password
#10I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline…
> So if your Twitter password happens to be the same as your ATT password, you're out of luck. Why would you have both passwords be the same? That makes no sense. All passwords should be different. > I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure. TOTP based two-factor auth ( e.g. Google Authent…
> Why would you have both passwords be the same? That makes no sense. All passwords should be different.
I'd put good money on the percentage of AT&T customers who use the same password for all their web services being sizable enough to make that a valid concern.