How Twitter’s New 2FA Option Could Make Your Account More Secure

Physical security keys are ultra-secure, but they come with tradeoffs

Key Takeaways

  • Cybercrime has been on the rise for nearly half a decade, with phishing attacks being especially problematic in the past year.
  • Since 2016, Twitter has experienced several high-profile cyberattacks and is now offering users the option of physical security keys.
  • The company claims the method is one of the strongest ways to secure an account.
Closeup of a smart phone with the Twitter blue screen and logo displayed on it.

Joshua Hoehne / Unsplash

After nearly half a decade of rising cybercrime and a year marred by high-profile breaches, Twitter is offering a new security feature that could help mitigate the risk of targeted attacks on user accounts.

According to a blog post published on June 30, the social media giant is now offering users the option of making physical security keys their sole method of two-factor authentication (2FA)—a move that could help make accounts more secure while eliminating the previous requirement for weaker backup methods. 

Still, experts warn that every method of 2FA comes with tradeoffs.

"The problem is that none of these [authentication methods] are really as absolute as people think they are," Joseph Steinberg, a 25-year cybersecurity expert and author of several books including Cybersecurity for Dummies, told Lifewire by phone.

Physical Security Keys, Explained

According to Steinberg, there are several types of multi-factor authentication—each with its own benefits and shortcomings.

Physical security keys, like the ones offered by Twitter, are small devices that users have to physically plug into, or sync with, their personal devices in order to log into their accounts—much like car keys. This offers the benefit of preventing hackers from remotely accessing accounts through phishing attacks or malware.

"...It’s unlikely that someone is going to switch now when there are easier mechanisms that are considered to be good enough."

According to Twitter’s blog post, the keys "can differentiate legitimate sites from malicious ones and block phishing attempts that SMS or verification codes would not."

Theoretically, the keys offer the strongest security solution for users—but they are also one of the least convenient solutions for everyday users.

"The major disadvantage is that you now have to carry the key in addition to your phone," Steinberg explained. "So if you want to tweet from the beach, you’re carrying your phone and the security key."

Steinberg also cautioned that physical security keys carry the risk of being lost, which could result in a user being locked out of their own account.

Balancing the Tradeoffs

Less secure authentication methods, like having a login code texted to your cell phone, are often more convenient for users than physical security keys—but they can carry a higher risk. 

Steinberg said hackers can intercept SMS codes through methods like SIM swaps, where thieves steal a user’s phone number and receive the codes on their own device. 

"If you’re relying on text messages and somebody somehow steals your phone number and starts getting your text messages, you’ve got a problem because they’re going to get your codes and they’re going to be able to reset your passwords," Steinberg said.

Closeup of an iPhone with the notification screen showing a Twitter notification.

Jamie Street / Unsplash

Authenticator apps that generate a one-time login code are another popular method of 2FA, but they still carry the risk of being accessed by hackers.

"If a user is logging into a phishing site and they enter that code, the phisher then has that code and can transmit it to the real site immediately," Steinberg explained, adding that there is also a risk of losing the phone and therefore losing access to the app.

Even more complex methods, like biometric fingerprint authentication, can carry risks.

"Your fingerprints are all over the phone from touching it," Steinberg said, explaining that sophisticated thieves can lift your prints and use them to log in to a device. "The fingerprint sensor doesn’t have a way of determining whether it’s an actual human putting their finger there, versus somebody putting an image of a fingerprint that was lifted from the phone."

Weighing the Benefits

Due to the inconvenience of carrying around an extra physical security key, Steinberg said he doesn’t see most everyday users making the switch being offered by Twitter. 

"The problem is that none of these [authentication methods] are really as absolute as people think they are."

"My experience has been that even things that are a small hassle when it comes to security—unless somebody has been breached and suffered serious consequences—it’s unlikely that someone is going to switch now when there are easier mechanisms that are considered to be good enough," Steinberg said.

Still, Steinberg said specific groups of users, like businesses and high-profile individuals, could benefit from physical security keys.

While there’s no perfect solution to securing a user's social media account, Steinberg stressed that any form of multi-factor authentication is better than none, due to the fact that social accounts are often used to log into other connected accounts across platforms.

"If you’re not using two-factor authentication today for your social media accounts—turn it on," Steinberg said.

Was this page helpful?