Skip to content
Translate Ideas and Comments
Choose language:
There was an error during translation
← Account Management

How can we improve the account management experience?

Account Management: Security and Privacy Settings

Categories

Stop requiring a phone number to set up 2FA.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

  • It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

  • Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

  • Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)
1,619 votes

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

NinethLions shared this idea  ·   ·  Report…  ·  Admin →
How important is this to you?

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Jack_the_Dipper commented  ·   ·  Report

    SMS has two major problems.

    1. Not everyone can use SMS
    2. Sms-swapping is out there and that can hijack your account
  • TastelessGeorg commented  ·   ·  Report

    sms 2fa is incredibly insecure, requiring it as a prerequisite for ACTUALLY GOOD 2fa is terrible. Thus users are less inclined to use good 2fa and more account breaches happen.

  • TalviTheFox commented  ·   ·  Report

    I completely agree with your points! Requiring phone numbers for 2FA can be problematic for numerous reasons:

    Security: SMS 2FA is weaker than other methods like TOTP apps, exposing users to SIM swapping and interception risks.
    Privacy: Not everyone wants their phone number linked to their Twitch account for various reasons.
    Accessibility: Phone access isn't universal, leaving some users locked out of stronger 2FA options.
    A flexible 2FA setup like you suggest, with various options and no mandatory phone requirement, would significantly improve security and inclusivity. So, yeah, ditch the phone number requirement, Twitch!
  • RedCyberDragon29 commented  ·   ·  Report

    The post is right. SMS is insecure and should not be required but an option or it defeats the purpose.
  • wanderluststory12 commented  ·   ·  Report

    With the amount of large profile streamers and how easy it is to sms attack, a 2FA without requiring a phone number would help limit the amount of stolen accounts on twitch

  • nidoking138 commented  ·   ·  Report

    Spoofing is much too easy for SMS setup for 2FA. This puts tons of end users at risk.
  • FlightyFerret commented  ·   ·  Report

    not everyone has access to a personal mobile phone number, but 2 factor identification is important for everyone.

  • Mackapoot commented  ·   ·  Report

    There is absolutely no reason to lock 2fa behind having an sms. That seems like a small change that can improve the security for many of your users.

  • Toastee0 commented  ·   ·  Report

    SMS is a terribly insecure way to do 2FA. Can we please have better 2fa options?
  • dgw_ commented  ·   ·  Report

    @DaftMav You don't want to give up your phone number, but you'll give up a *fingerprint* instead? 🤔

    Many Discord servers are restricted to phone-verified users, too. These large platforms don't seem to realize that *not everyone has a personal phone number*. Having phone service is expensive, especially since phone-verification systems do their absolute best to screen out anyone using a free or cheap VoIP alternative (like Google Voice).

    In Twitch's case, using SMS for 2FA also makes SIM swapping attacks viable as part of taking over popular streamers' accounts… in addition to the issues with (optionally) requiring phone verification just to participate in chats.
  • DaftMav commented  ·   ·  Report

    I'm one of those who will not give my phone number to Twitch. Now some streamers have their chat restricted to verified-by-phone-only (probably to reduce bots and weirdos spamming) but that means I can't ever participate in their chat unless I give up my phone number.
    I think that system is very restrictive and is also tied to this 2FA issue as well. Please at least for 2FA find a different way than demanding a phone number, and then maybe also implement this as a better way to "verify" without a phone number. Perhaps a one-time fingerprint verification through the twitch app could work as one of several options.
  • Astro_Alphard commented  ·   ·  Report

    Phone based 2FA doesn't work for all users. For example I need to have multiple emergency numbers on speed dial. Due to the nature of work on a safety team the 1 second that a phone will take for password authentication could be the difference between life and death for me or my team. It was the difference between life and death for another team. As such my phone isn't password protected and routinely gets hacked, I don't keep any sensitive information on it and routinely factory reset it so I'm not too concerned. Any sensitive info I have is ALWAYS on my home computer in a secure drive under multiple layers of encryption, or just stored in my mind. Using phone based 2FA is just begging to have my account hacked.

  • RandomRed38 commented  ·   ·  Report

    I'm watching PirateSoftware stream, and he says this method is ****, and I trust him more than he trusts your 2FA

  • its_numpty commented  ·   ·  Report

    I work in banking fraud prevention and I cannot state enough how insecure SMS 2FA is. So glad this is being proposed and I truly hope changes come through. Twitch is a way of life for many creators and the potential risk associated with SMS 2FA is troubling.
  • PirateSoftware commented  ·   ·  Report

    As a security professional with 20 years of experience it's disturbing to see that SMS 2FA is being required in this setting. As streamers we are very high value targets and more vulnerable to sim swapping. Our major donators are in a similar situation and this doesn't help them either. It's time to do away with SMS 2FA as a requirement for other forms of 2FA.
  • andOlga commented  ·   ·  Report

    Not only is the SMS "backup" option *still* impossible to turn off, which makes any app you add worthless -- an attacker can just choose to use the SMS option... but now they have also linked the password reset flow to the phone number as well! Here is a very simple attack scenario that requires NOTHING other than having access to my phone number:

    - An attacker somehow intercepts texts sent to my phone number. There's tons of ways to do it, "sim jacking" being by far the simplest. I won't go into an overly long explanation here, your security staff should know what that is.
    - They plug this phone number into the password reset flow and choose "I don't know my username".
    - They get the username, and now go back into the password reset flow and choose to reset the password using the phone number. By the way: the password reset flow completely bypasses 2FA! It doesn't ask for the code.
    - The attacker navigates to the login flow and chooses to use the SMS option instead of the app.
    - Now they can log into my account using the password that they've just reset and the 2FA code that is sent to the VERY SAME phone number that was used to reset the password in the first place.

    By forcing the SMS options to be on for both password reset and 2FA (if it is enabled) you have created an incredibly vulnerable service, and anyone who does enable 2FA or verify the phone number is effectively on a ticking time bomb until their account gets hijacked -- once they grow large enough.

    Now, you *do* have a proper 2FA option: the e-mail one, which is on by default. Assuming my e-mail account is properly secured (which it is!), there are zero issues with the e-mail 2FA flow itself. However, there are two issues that surround it:
    1. The e-mail 2FA is not only presented as "less secure" than the phone-based flow, it's actually not even mentioned as an option (even though, again, it's just on by default).
    2. Certain Twitch features (e.g. chatting in specific channels, Stream Together or access to the dev portal) are locked behind phone verification, which forcibly exposes the password-reset vulnerability I have described above.

    You must give users an option to disable phone-based password reset and 2FA flows if you really wish for accounts to be secure. Asking for a phone number for additional verification is in itself not the main issue here -- the issue is forcibly making the account more vulnerable when it is added.
  • noobtf2 commented  ·   ·  Report

    I wanted to enable 2FA on my account but it asked for a phone number. Sorry, no.
  • SmoothTaggster commented  ·   ·  Report

    We cant let people like myself not be able to protect ourselves with 2fa bc a bunch of people cant afford cellular myself included as previously stated also you could supplement phone verified chat mode for two factor authentication enabled mode which allows both users and people who cant afford cellular to use all chats and still help against raids and chat issues
1 2 … 5 7 9 10