So Twitter announced today that come March 20th, if you want to keep using text-message two-factor authentication on your account, you're going to need to pay for it. SMS-based 2FA is getting locked behind Twitter Blue, which is the $8-a-month-on-web, $11-a-month-on-iPhone subscription that also gets you the blue checkmark now (or used to mean something different, depending on how cynical you're feeling this week). Everyone else gets 20 days to either switch to an authenticator app or turn 2FA off entirely, and Twitter is very clearly betting a lot of people will just do the second thing out of laziness.
I want to be annoyed about this and I sort of am, but I also can't fully argue with the reasoning, which is the most irritating kind of corporate decision to sit with. SMS 2FA has been the weak link in account security for years. SIM-swapping is a real and growing problem, telecom customer service reps get social-engineered constantly, and a text message code was never as secure as people assumed it was just because it felt more "real" than an app generating six digits out of thin air. Security people have been telling everyone to move off SMS 2FA since at least 2016. So on the merits, pushing people toward TOTP apps is probably a net good for the internet.
But that's not really why this is happening, and everybody knows it. This is a subscriber number that needs to go up, dressed in a safety argument. If Twitter actually cared about phishing-resistant auth as a principle they'd have led with hardware key support or passkeys getting more prominent, not "pay us $96 a year or lose the security feature you already had." I set up 2FA on my account back in 2017, long before the current ownership, using my actual phone number, and now the deal has quietly changed underneath me. That's the part that bugs me more than the fee itself.
Anyway, I moved my account over to an authenticator app this afternoon rather than wait until closer to the deadline and forget. Took maybe four minutes, mostly because I had to dig up my backup codes first (please, if you take one thing from this post, go find your backup codes right now, before you need them at 11pm locked out of an account). I'm using Authy for this one because I've already got half my accounts on it, though I know plenty of people who'll tell you Authy's cloud backup is itself a small security tradeoff and you should use something local like Aegis if you're on Android. Fair point, and not one I feel like litigating tonight.
The other thing worth saying is how normal this kind of thing has started to feel. A platform ships a security feature for free, gets people to rely on it, then a few years later turns it into a line item. It happened with a bunch of free VPN and password manager tiers over the past couple years, it's happening with cloud storage constantly, and now it's happening with authentication itself, which feels like a slightly different category to me because 2FA isn't really a "feature" in the product sense, it's closer to basic account hygiene. Charging for the blue checkmark is one thing, I don't especially care who has a checkmark. Charging for the thing that keeps someone from taking over your account is a different flavor of annoying.
I'll say this too, since it's been a loud couple of weeks in tech generally between the AI chatbot stuff and the shot-down objects over Alaska and Lake Huron that nobody seems to have a straight answer on yet. It's a little funny that the SMS 2FA news barely made a ripple by comparison. A security policy change affecting a couple hundred million accounts, and it's basically a footnote next to a chatbot telling a reporter something weird. Priorities, I guess, or maybe just fatigue, since there's only so much attention to go around in any given week and this month has not been short on things demanding it.
If you're still on SMS 2FA anywhere, not just Twitter, this is as good a nudge as any to switch. Do it before the deadline creates a reason to do it in a panic.