July 5, 2018 By David Bisson 3 min read

Twitter announced in June 2018 that it will now support the use of a Universal Second Factor (U2F) key for two-factor authentication (2FA). This announcement addresses password logging issues that Twitter and other online services have experienced in recent months.

These problems, which can potentially expose customer login details to staff members and external actors, underscore the importance of providing users with the option to implement some form of 2FA.

But even though Twitter has enabled this security feature, not all users have taken advantage of it — and a portion of those that have are not thrilled about the user experience. It’s up to organizations and online services across all industries to make 2FA more approachable to users.

U2F Aims to Squash Password-Leaking Bugs

Twitter unveiled its support of the Fast Identity Online (FIDO) Alliance’s U2F security key for login verifications as part of a broader effort to combat spam and malicious bots.

According to a recent blog post, the social media giant announced plans to:

  • Make suspicious accounts less visible in metrics;
  • Make it more difficult for cybercriminals to register spam accounts;
  • Challenge suspicious accounts to prove their authenticity; and
  • Expand its malicious behavior detection capabilities.

In the meantime, Twitter urged users to protect their login information with a physical U2F security key.

The announcement came less than two months after Twitter discovered a bug in its password storage process. As noted in a company blog post, the glitch caused users’ passwords to be written to an internal log before the hashing process completed — meaning the passwords were stored in plaintext. In response, Twitter disclosed the vulnerability and notified its nearly 340 million users that they should change their passwords.

The social networking service isn’t the only company that has accidentally recorded users’ passwords in plaintext. GitHub detected a similar, yet unrelated, error around the time of Twitter’s discovery, as reported by Bleeping Computer.

These types of bugs often arise for companies that manage complex software. System Overlord reported that the change of an environment variable could theoretically produce a similar type of flaw, noting that code review can’t detect 100 percent of these errors because “releases are cut all the time with a handful of changes that were reviewed in isolation and occasionally have strange interactions.”

2FA Is Met With Resistance

Despite the security benefits, not all users see the utility of 2FA, and even those who have adopted the technology frequently bemoan the user experience. In fact, seven out of eight users who participated in a recent survey cited inconvenience as the main reason for disabling 2FA.

According to a recent Duo Labs’ report, State of the Auth: Experiences and Perceptions of Multi-Factor Authentication, just 28 percent of users said they use two-factor authentication, and only about half of those users (54 percent) said they had implemented the control voluntarily. As a result, it’s not surprising that SecureAuth found that 74 percent of IT decisions have received complaints from 2FA users, with 10 percent stating they “hate it.”

Adapting Authentication to User Needs

To strike a proper balance between security and a streamlined customer experience, companies should consider investing in silent identity and access management (IAM) solutions that work in the background to verify users without adding steps to the authentication process. These systems offer features such as single sign-on (SSO) for the one-password logins users expect and user self-service capabilities for password resets, interrupting the user experience only when malicious activity is detected.

For companies that rely on 2FA to verify user identities, security professionals and business executives must lead by example and enable these controls wherever possible, even if the corporate policy doesn’t require it. These and other identity protection measures are crucial to protect enterprise data from fraudsters looking to exploit stolen credentials.

More from

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today