[danso]

OK, the key newsy takeaway:

> But a glaring flaw in Twitter’s account-security system lets anyone who obtains your password learn whatever mobile-phone number you’ve associated with your Twitter account if you turned on a simple but highly effective security measure

So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff.

Granted, I'm having a hard time thinking why Twitter would feel the need to expose the phone-number at all to a user outside of his/her own account page, so I'm guessing that is some unintended bug. However, consider the situation: The OP gives away his password...Two-factor authentication never, ever meant "hey, it's just as strong as if you give away one of the factors"...I've never designed a security system before, but I'm guessing things would become very convoluted if security designers had to treat giving away your password -- as a public announcement and media figure -- as anything but an edge case. The inconvenience of 2-factor-authentication is meant to offset the problem of total compromise given the relatively frequent chance of getting phished. Twitter's flaw, as described, is likely not a main attack vector for phishers who are sending out thousands and thousands of emails and hoping to get turnkey access to someone's account...even if Twitter gives away the phone-number through some sort of exerted effort...that's unlikely to be the exerted effort used by mass phishers. It's a totally different security game when you're the target of thousands rather than one target among thousands.

(that said, Twitter should fix the flaw, unless there's some other dependency on having the phone number be accessible)

[x1798DE]

>So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff.

The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's not a flaw - if someone got his password from a compromised database they shouldn't be able to leverage that into finding out his phone number or anything else about him, if he's already arranged with Twitter (or any other service) to a protocol which basically says, "Don't believe anyone saying they are me unless they both know my password and have my phone."

Frankly, a well-designed 2FA system shouldn't even reveal whether or not you've successfully authenticated using one of the factors. For TOTP this is possible because you can enter in the username, password and TOTP code all at the same time (though it's rare to see this implementation). Even if TOTP is not enabled for most accounts, you'd still want to show the box and say, "Leave this blank if you don't have TOTP enabled". For this SMS-based second-factor, I'm not sure how to design it so that there are no side-channel attacks other than sending an SMS with an authentication token every single time, whether or not the password was entered correctly (which allows random people with your login to just randomly send you authentication spam).

[danso]

OK, I see that the flaw was that the phone number was revealed to a user when, after installing the Twitter for iPhone app, wanted to specify that the code be sent via text to a phone number...And the Twitter app reminds the user -- who again, has successfully entered the password -- what number the message goes to.

So, if you're thinking, what kind of dumbass would need to be reminded what phone the code was going to?...well, the OP for starters. In fact, he recommends readers to get Google Voice numbers (ooh, another attack vector/dependency, but let's ignore that for now)...so, if you're such a user, who has a phone and some burner numbers, and you tell the Twitter app to send a reminder to your phone number...and nothing comes...that's going to seem like a point of failure.

And IMO, that situation is going to be much more likely than the case of a user telling the world his password and username. Also, it seems more likely than phishers doing something more damaging than getting phone numbers after manually going through the phone app for each password stolen...My impression is that such phishers do not typically rely on manual methods, especially if by doing so, they don't get access to the target account...seems like a low return on investment of effort.

[x1798DE]

The threat model isn't "what if someone tells everyone their username and password", it's "What if someone gets your username and password". I think most of the time people have one number they connect to, and everything else will be fringe cases. If you're worried they'll forget what phone number it's sent to, you can do the same thing you do with other verification/reset loops - "Enter your e-mail address and we'll send you an e-mail with the phone number you used". It might not always be the best authentication method, but at this point almost all authentication falls back to "I control the e-mail address that I controlled when I started the account" at this point anyway.

Plus, at the very least you could just reveal the last 2 digits of the phone number upon request. That's still side-channel data leakage, but at least it's much more contained.

[edent]

The flaw is "Thanks - we've texted your 2FA code to [phone]."

That's primarily to tell the user which phone to check - which isn't a bad thing.

They should probably fix it by saying "we've texted your 2FA code to the phone number ending 171" - or similar.

[mhaymo]

Surely if you're designing a 2-factor authentication system, a compromised password is the exact case you're designing for, not an edge case.

[danso]

Let me clarify...you're designing against complete takeover of an account, which without 2-factor authentication, can be done with just the password.

Now the other part of the equation: a security system has to be designed against real-world practicalities...In this case, where does the main risk come from? Mass-anonymous attacks, such as phishing or a database compromise ...now unless phone-numbers can be mass-acquired via knowing a bunch of passwords (can the installing of the Twitter app for iPhone and clicking the "send to phone" link be automated?)...it now becomes a lot of work to take that extra step...and when you've completed it...you still can't break into the Twitter account...How many phishers are stealing passwords just so they can learn a bunch of people's phone numbers? The ones that have that strategy...well, keep on doing that, because that's way more work than other channels for mass-gathering phone numbers.

Now, if the retort is, "well, there may be someone who an attacker REALLY wants to compromise, and the phone number is one more piece of the puzzle."...Then that's a different ballgame. Now you have an attacker who is not drive-by-random phishing, but is going after one person, and going after that one person hard.

So the situation where a victim gives an antagonist (say, the FBI, or NSA, or whoever you are investigating) their password...again, that is most definitely an edge case. And it requires a different systems design (by design, I mean, the details fallback procedures for cases when a user loses their phone and needs to recover it, and so forth).

I can see advantages for Twitter to show the phone number to someone who knows an email and the actual password: you may be someone with multiple phones, or have forgotten that your 2-factor-auth is assigned to a different phone/Google Voice...showing the phone number mitigates the confusion of the user who's wondering when the hell the code is coming, when in fact, the code may never come to the expected phone number.

So, how frequent is that situation compared to one where a user announces his password to the whole world? I'm guessing, quite frequent.