• Twitter says SMS-based authentication is prone to being abused by bad actors and isn’t as secure as other methods.
• As such, the feature is being locked behind Twitter Blue’s paywall.
• While 2FA isn’t popular on Twitter, of those that do use it 74.4 percent make use of SMS 2FA.

Two factor authentication (2FA) should be a default security measure for all users where available. Yes it creates friction in the log-in process, but it’s a good way to secure your account.

While having some form of additional verification is always best, many in the information security sector are of the opinion that SMS-based 2FA is inherently less secure than other forms of verification thanks to the ease with which mobile phone numbers can be hijacked.

It’s odd then that rather than phasing out SMS-based 2FA on Twitter, the platform is making the feature part of Twitter Blue.

The reason 2FA is no longer a free feature comes down to it being abused. At least, that’s according to a blog post.

“While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used – and abused – by bad actors,” writes Twitter.

“So starting today, we will no longer allow accounts to enroll in the text message/SMS method of 2FA unless they are Twitter Blue subscribers. The availability of text message 2FA for Twitter Blue may vary by country and carrier,” the platform added.

Users who currently have SMS-based 2FA now have until 20th March 2023 to switch to a new form of authentication. Whether users do this or not, the feature will be disabled in March.

This is problematic as SMS is the most popular form of 2FA on Twitter with 74.4 percent of the 2.6 percent of users who have 2FA turned on, opting to use SMS over an authentication app or Security key.

This is not even taking into account that Twitter Blue isn’t available in every country so even if users wanted to continue using SMS 2FA, say in South Africa, they wouldn’t be able to.

As for which 2FA app one should use, the platform says users may use “any time based one time password (TOTP) authentication app like Google Authenticator, Authy, Duo Mobile, 1Password, etc.”

You can find instructions on how to set up 2FA on Twitter using an app here.