I'm watching PirateSoftware stream, and he says this method is ****, and I trust him more than he trusts your 2FA

I work in banking fraud prevention and I cannot state enough how insecure SMS 2FA is. So glad this is being proposed and I truly hope changes come through. Twitch is a way of life for many creators and the potential risk associated with SMS 2FA is troubling.

As a security professional with 20 years of experience it's disturbing to see that SMS 2FA is being required in this setting. As streamers we are very high value targets and more vulnerable to sim swapping. Our major donators are in a similar situation and this doesn't help them either. It's time to do away with SMS 2FA as a requirement for other forms of 2FA.

Not only is the SMS "backup" option *still* impossible to turn off, which makes any app you add worthless -- an attacker can just choose to use the SMS option... but now they have also linked the password reset flow to the phone number as well! Here is a very simple attack scenario that requires NOTHING other than having access to my phone number:

- An attacker somehow intercepts texts sent to my phone number. There's tons of ways to do it, "sim jacking" being by far the simplest. I won't go into an overly long explanation here, your security staff should know what that is.
- They plug this phone number into the password reset flow and choose "I don't know my username".
- They get the username, and now go back into the password reset flow and choose to reset the password using the phone number. By the way: the password reset flow completely bypasses 2FA! It doesn't ask for the code.
- The attacker navigates to the login flow and chooses to use the SMS option instead of the app.
- Now they can log into my account using the password that they've just reset and the 2FA code that is sent to the VERY SAME phone number that was used to reset the password in the first place.

By forcing the SMS options to be on for both password reset and 2FA (if it is enabled) you have created an incredibly vulnerable service, and anyone who does enable 2FA or verify the phone number is effectively on a ticking time bomb until their account gets hijacked -- once they grow large enough.

Now, you *do* have a proper 2FA option: the e-mail one, which is on by default. Assuming my e-mail account is properly secured (which it is!), there are zero issues with the e-mail 2FA flow itself. However, there are two issues that surround it:
1. The e-mail 2FA is not only presented as "less secure" than the phone-based flow, it's actually not even mentioned as an option (even though, again, it's just on by default).
2. Certain Twitch features (e.g. chatting in specific channels, Stream Together or access to the dev portal) are locked behind phone verification, which forcibly exposes the password-reset vulnerability I have described above.

You must give users an option to disable phone-based password reset and 2FA flows if you really wish for accounts to be secure. Asking for a phone number for additional verification is in itself not the main issue here -- the issue is forcibly making the account more vulnerable when it is added.

I wanted to enable 2FA on my account but it asked for a phone number. Sorry, no.

We cant let people like myself not be able to protect ourselves with 2fa bc a bunch of people cant afford cellular myself included as previously stated also you could supplement phone verified chat mode for two factor authentication enabled mode which allows both users and people who cant afford cellular to use all chats and still help against raids and chat issues

Giving out a phone number to get 2FA (or in general) is a no-no.

Aside from that SMS-TAN is considered broken since at least 2016 by NIST [1], going back till 2005 [2]

to [1]:

"Due to the risk that SMS messages may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out of band verification is to be made using a SMS message on a public mobile telephone network, the verifier SHALL verify that the pre-registered telephone number being used is actually associated with a mobile network and not with a VoIP (or other software-based) service."

It's a GDPR privacy concern, you DO NOT NEED to know a phone number to authenticate a person.

You already have a way to communicate, send a one time code via eMail. But even that is isn't a required, because setting up the 2FA is easily done via a scanable QR code that's issued for the user once - i.e. changes on repeat - when the user enables the 2FA on a dedicated - i.e. not constant part of the user profile - page.

You don't like the eMail OTP solution because interception or plain text, well then set up a public PGP key dedicated to the 2FA setup, freely available on your site and on a PGP key server. Still can do a challenge-answer implementation before accepting users public key into your system.

[1] https://pages.nist.gov/800-63-3/sp800-63b.html
[2] https://www.schneier.com/crypto-gram/archives/2005/0515.html#16
"Comments from Readers" - "Subject: Two-Channel Authentication with Cell Phones and SMS"

Come on Twitch. Stop collecting unnecessary user data!

Everyone before me who stated requiring SMS validation for setting up 2FA TOTP is horse dung is 110% right.

Especially since you keep nagging users to secure their accounts, which I'm absolutely willing to do, you should make it as painless as possible. That means not bothering users for their private phone number. For my part you will not get it. TOTP, WebAuthn or nothing.

It's unbelievable that a company as big as Twitch, right in the middle of big tech fails to understand basic privacy and security concerns of their users.

Strongly agree with you! SMS is only an option, not a requirement.

Almost 2 years and no change. WebAuthn is the way, and a company as big as Amazon should be offering it everywhere.

Requiring a phone number to set up a TOTP app makes no sense. Stop this.

SMS verification has been frowned upon for many years now in security circles and should be completely disabled.
TOTP two factor verification is something you should just be able to enable without giving Twitch any additional information.

I agree. I was trying to write a Twitch chat bot, but now I need to give away my phone number to set up 2FA. This will not happen. As a result Twitch is more unattractive. My channel will remain plain without any advantages or custom chat functionality. It will not be able to separate itself from other channels, to stand out.

Youtube is a more interesting platform for streaming because of that.

To add onto the point issues:
If you get a new number and someone has already connected it to their account (meaning you got a previously used number), Twitch won't give your the number that is now yours.

Meaning anything they roll out that requires a phone number? You're SOL.

I still have to log in to my account every single time with an email 6 digit code. Seems a lil counter intuitive how 2FA can't do this. How is it good enough to get an email for this code but can't use 2fa for this same system. When I say Everytime I mean literally every single time I log in to twitch I have to authorize..this works great! Now only if 2fa could do it too.

I agree with this idea. It's very boring to just receive SMS messages with a code. It could make not only the possibility of 2FA, but also the possibility of scanning a barcode when logging in, as is the case with Discord login.

Given the proliferation of SIM hacking, you'd think OTP would be the default and SMS would be optional, even discouraged! I'm probably just going to close my Twitch account until OTP-only support is added.

I need to stop following this thread.

The thread about not using phone numbers as a privacy requirement was merged with the unrelated thread about not using phone numbers for (additional) authentication.

There's a school of thought that phone numbers are secure, that phone numbers are unique over extended time periods, and that every person has secure access to a private number. All of these are demonstrably incorrect but it appears the vendors are intentionally ignoring that. You'd assume this is to avoid spending on alternative implementations.

Best of luck y'all

It is still crazy that twitch still requires a phone number to enable 2FA. Even if you are doing that allow people to disable SMS based verification after adding a TOTP app. I am not comfortable with using Authy and you forcefully create an Authy account once I enable 2FA. I just want to use a TOTP app alone without SMS and I am okay with losing acccess if lose access to my TOTP app since that is the whole point.

The fact that twitch merged their identity grab where they tried to force users to verify with a phone number, with this job, that is about 2FA, shows that whoever is managing it doesn't even understand the problem.

I am about to loose myself, I can't use my phone number that I always used on this twitch account to verify my account. for some reason it has removed my number from my twitch account and now no matter how many times i tried to add my number back it always gives an error '' error is : Unable to send SMS because phone number is disabled for reuse, please use a different phone number option '' . I have no other phone number to use but i tried my wife;s and still could not verify it. I am an affiliated Twitch streamer but now i can't text on some of my fellow streamers chat because they have two factor phone verification requirements on their channel's and it is so annoying. i need help asap please !!!