Skip to content
Translate Ideas and Comments
Choose language:
There was an error during translation
← Account Management

How can we improve the account management experience?

Account Management: Security and Privacy Settings

Categories

JUMP TO ANOTHER FORUM

(thinking…)

Stop requiring a phone number to set up 2FA.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

  • It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

  • Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

  • Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)
709 votes

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

NinethLions shared this idea  ·   ·  Report…  ·  Admin →
How important is this to you?

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • KiffJRocka commented  ·   ·  Report

    I also never give out my phone number and never needed to, they just ask it on certain channels where the streamer puts in the option to verify a phone number before using their chat, I don't care about chatting because viewers are just a number and streamers don't look at the names of the people saying things. Besides Twitch I never use any website asking for phone number, they just want to sell your number to 100s of companies, the internet and companies like Twitch Amazon are disgusting and destroying privacy, our grandkids will never learn about the word privacy as it won't exist in any form anymore, in meanwhile all governments have leaders aged 70 that have no clue about technology so laws are coming in very late.

  • budgetteen commented  ·   ·  Report

    This is not a good idea as the OP mentioned. You should provide 2fa with TOTP without a phone number? what is the reason you have to ask for my phone number?
  • Miszka commented  ·   ·  Report

    Agreed. I don't even get the reasons for requiring a phone number to set up a 2FA method that does not even depend on it (TOTP).
  • windsunh2o commented  ·   ·  Report

    Yup, thanks to all my fellow Republic Wireless users here who helped me confirm why I cannot verify my Twitch account. Guess I'm currently SOL.
  • SuperSmoofer commented  ·   ·  Report

    I absolutely agree! My phone has been deactivated and I can't afford to reactivate it, even temporarily. This means even though I can apply for twitch affiliate, I can't go past the 2FA at all because of the phone number requirement.
  • chucklefuffle commented  ·   ·  Report

    Why am I given the option to create an account without using a phone number only to find later a phone number is mandatory in order to do most things on this technological abomination of a website. It makes me really not want to give you that information simply because you're willing to be deceptive to get it. Frankly, I don't believe you people couldn't get that information within a half of a day anyway, so why make me jump through all of these unnecessary hoops?
  • paradeoflaughter commented  ·   ·  Report

    Another Republic Wireless user over here who now can't chat in some streams because Twitch won't let me verify my account. More and more of the streamers I follow are implementing this and it's really frustrating when I can't interact. Please give us an alternative method.
  • wilde_oscar commented  ·   ·  Report

    Everyone here is absolutely correct and we're getting shafted for having Republic Wireless
  • Crymscar commented  ·   ·  Report

    Rather than requiring text messaging on a cell phone to verify accounts (which are already verified by email), have an option for land lines as well. I currently am locked out of being able to chat in some streamers chats because I can't verify with a cell phone because I can't afford a cell phone and I have a land line. Many people don't have cell phones because they can't afford them and to lock us out of chat simply because we can't afford to spend hundreds of dollars on a cell phone just isn't fair. Banks have a method to call whatever phone number you supply and give you a code to put in on the web site as an option for when texting isn't possible. Why can't Twitch do that? As it is, requiring verification of an account in good standing by 2 different methods is overkill anyway.
  • rubbertoebooks commented  ·   ·  Report

    I can't stream on pc now thanks to Twitch's recent hack scandal that made OBS disconnect from Twitch automatically, so ran into an issue where I couldn't reconnect OBS to Twitch because when I try to login I'm prompted for the 2fa token which I cannot receive because my phone is currently disconnected and can't use the authy app because I also need a 2fa code sent through sms to activate that :)
  • BryBreadmin commented  ·   ·  Report

    This^

    I have an alternate carrier that Twitch doesn't consider legitimate. This is a huge roadblock for me to use the twitch API.
  • xxlooped_melodyxx commented  ·   ·  Report

    I want to speak in chat with my favorite streamer and i cant because i dont have a phone therefor no phone verification
  • nerdinbr commented  ·   ·  Report

    This. 1,000,000x this. Phone number shoud NOT be required. Let us just have that and download our backup codes. Done and done. this is just an information grab and is disgusting.
  • LordMulgar commented  ·   ·  Report

    Hello Twitch? Since you won't allow my Republic Wireless number. Same phone number I have had for 20 years. Let us use an authenticator app. Perhaps hire a better security team too. You have so much egg on your face right now.
  • senortres commented  ·   ·  Report

    With today's news it's probably a good idea to revisit this, Twitch. Way more people have no access to a non-VOIP SMS-capable number than "would seem".
  • 68267a commented  ·   ·  Report

    Things like this are a clear indicator of management making decisions they do not understand (or worse they do understand it and are selling our data), and it has been extremely effective at keeping me off the platform entirely.

    2FA with zero SMS requirement, or nothing.
  • AccelToWin commented  ·   ·  Report

    Wait, Twitch doesn't allow the use of Google Voice for 2 FA? That makes sense now.
  • Stunseed commented  ·   ·  Report

    i lost my phone and needed to make a new authy account. idk my old number but i do know my email adress. so i changed the number hooked it up to my email adress thinking everything is fine. when i go to twitch to try to change the place it sends authy number codes for verification it wants to go straight to an sms number to the other phone i dont have.
    also when it tells me to connect a new account (twitch) using the authy app
    all it does is tell me to scan a qr code or use the code given to me , i didnt recieve either of these things. now im stuck with 2fa enabled and nothing i can do about it. theres gotta be a way to just get an email to undo this mess
  • letmeseeyourcakeface commented  ·   ·  Report

    This. There are plenty of people who don't have a phone or cannot install Authy for some reason or other. Twitch's own advice is to use Authy when "abroad" rather than SMS. If someone cannot install or use Authy, then they have no way to secure their account with 2FA.
1 3