Elon Musk Reserves Two-Factor Authentication For Twitter Blue Subscribers: Why Is 2FA Being Restricted?

Twitter has pulled back access to Two-Factor Authentication (or 2FA), a critical sercurity feature, for all its users. The feature will now be available only to Twitter Blue subscribers, so users not subscribed to the Twitter Blue subscription will not be able to use 2FA.

Twitter Pulls Back 2FA For Free Users

Last week, Twitter announced via a blog post that it was pulling back access to Two-Factor Authentication. The micro-blogging website said that the text-messaging-based 2FA feature would be available only to Twitter Blue subscribers next month onwards. Explaining the reasoning behind this decision, Twitter said,

"While historically a popular form of 2FA, unfortunately, we have seen phone-number-based 2FA be used and abused by bad actors. So starting (February 15th), we will no longer allow accounts to enroll in the text message/SMS method or 2FA unless they are Twitter Blue subscribers. The availability of text message 2FA for Twitter Blue may vary by country and carrier."

"After 20 March 2023, we will no longer permit non-Twitter Blue subscribers to use text messages as a 2FA method. At that time, accounts with text message 2FA still enabled will have it disabled. Disabling text message 2FA does not automatically disassociate your phone number from your Twitter account,"

Twitter further added that non-Twitter Blue subscribers who had already enrolled for the 2FA feature via text message authentication "will have 30 days to disable this method and enroll in another."

Why Is Twitter Restricting Access To 2FA?

Two-Factor Authentication essentially mandates login attempts to be authenticated by a secondary method in addition to the standard username and password combination. Twitter has indicated that it won't send a text message or SMS to users attempting to login into their accounts with SMS-based 2FA activated.

As mentioned in its blog post, Twitter claims that the phone-number based 2FA feature was being abused. However, the platform did not elaborate on the issue.

Users who haven't subscribed to the Twitter Blue subscription and still wish to have an extra layer of security can do so by using an authentication app such as Authy, Google Authenticator or Microsoft Authenticator. This pretty much works the same way, except that instead of Twitter sending you an OTP, you will be asked to enter a code sent by the authentication app on your phone.