Skip to content
Translate Ideas and Comments
Choose language:
There was an error during translation
← Account Management

How can we improve the account management experience?

Account Management: Security and Privacy Settings

Categories

Stop requiring a phone number to set up 2FA.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

  • It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

  • Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

  • Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)
1,619 votes

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

NinethLions shared this idea  ·   ·  Report…  ·  Admin →
How important is this to you?

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • femizysilver commented  ·   ·  Report

    this is great i have even been trying to verify my account with my phone number for the past two weeks it is not going through, because they are not sending the verification code to my number
  • running_zebra commented  ·   ·  Report

    yup, that doesn't surprise me. they've used apple logic on us, that's for sure. next they'll say that u2f keys do no exist either.
  • ThatCraigBloke commented  ·   ·  Report

    ( @verniceguy888 .. yes this is normal.)

    They even merged all the privacy concerns into a security thread to hide what I feel is likely the real issue. They want to tie every account to a phone number because in the vast majority of cases that personally identifies each customer. That's illegal or contentious in some countries and certainly obnoxious to anyone with a privacy or safety concern so they pretend it's for 2fa.

  • veryniceguy888 commented  ·   ·  Report

    ive submitted 3 tickets regarding this and they havent responded to a single one, is this normal?
  • aaron888_ commented  ·   ·  Report

    I didn't get a single SMS even a delayed one
  • BenathonGames commented  ·   ·  Report

    With more and more tech experts these days recommending to everyone "Do NOT use SMS as a 2FA method because it is not a secure method anymore." As well with recent evidence of how easy it is for SMS to be hijacked and why it is possible. I find it a major concern how nothing is being done to change this forced requirement. I don't even understand the reasoning for alternate 2FA methods being locked behind the SMS requirement, nor why removing SMS 2FA from your account also disables the alternative methods. This is a really baffling way of handling account security.
  • Avoimuus commented  ·   ·  Report

    If I want to set up 2FA to my account, it's mandatory that I enter a phone number first. It shouldn't be necessary to do that, since sending a code via SMS can be considered a security risk because is not reliable at all.
  • tgwdeaken commented  ·   ·  Report

    At least let me disable SMS 2FA after setting up a different kind of 2FA. Warn me about the downsides of that action, but let me do it
  • thatmidwestdullahan commented  ·   ·  Report

    many of the accounts that i use 2factor with a password iv never had them broken in to or attempted those accounts also use phone number verification

  • TwilitWave commented  ·   ·  Report

    I consider this a massive security risk. Especially after this recent expose on how easy it is to hijack SMS:
    https://www.youtube.com/watch?v=wVyu7NB7W6Y

    Plus, with modern authentication devices - you should be provided backup/recovery codes to cover instances where SMS is often used to recover accounts where a user has lost access to their authentication app/device.

    Please remove the SMS requirement ASAP. Thank you.
  • julianj1304 commented  ·   ·  Report

    Ich bin auch Jahrelanger Twitch User und fand das Konzept, das man überall mit chatten kann sehr gut. Mittlerweile ist echt unschön geworden es gibt Chat nur für Follower oder Abonnenten, dass find ich auch schon immer sehr kritisch. Was aber jetzt mega stört ist Chat nur für Authentifizierte User die eine Telefonnummer eingeben müssen. Erstens es soll eine Sicherheit darstellen, aber gleichzeitig gebe ich meine Private Handynummer an ein Konzern damit Ich SMS bekommen kann? Gut ist ne Sicherheit das ich kein Bot bin, aber dadurch entsteht bei mir die Gefahr das Ich dubiose Anrufe als auch SMS dann bekomme schönen Dank. Zweitens In mein Konto steht definitiv nicht drin das Ich meine Telefonnummer verschenke oder verkaufe, dass ist aus Erfahrung und Datenschutz Gründen unzuverlässig. Mittlerweile bekomme ich ja auch durch raids zu Anderen Streamern oder durch bekannte Streamern es sehr heftig mit, mit dieser Chat nur für Verifizierte Benutzer. Momentan banne ich jeden der diese Einstellung hat was mich traurig macht;( Für mich ist ja der Chat das was Twitch ausmacht, aber den Chat zu sperren mit so einer kleinen Mauer ist echt unschön. Mein Wunsch “Chat nur für verifizierte Benutzer” sollte einfach abgeschaltet werden, denn es schafft nur Probleme. Ein weiteres Problem sehe ich halt auch wenn man seine Telefonnummer angibt und Die Nummer wechseln muss oder man schließt einen neuen Mobilvertrag ab, wie soll denn dann die Verifizierung möglich sein?
  • mrsimon003 commented  ·   ·  Report

    We regularly update our content to ensure that you have access to the latest packages, deals, and industry trends. We’re committed to keeping you informed with fresh and accurate information. https://thepackageslist.com/
  • pxelpro commented  ·   ·  Report

    Well, I have the similar problem. I tried the "Add phone number" menu and tried the "Setup 2FA" on Twitch settings menu but it didn't work because I didn't receive any verification code on my SMS, even I tried to change SIM card to another phone it didn't work, and please I don't have any phone numbers blocked, my device has sufficient signal and receiving SMS from other services, and never used “Do Not Disturb” mode, as Twitch Support said. I'm not sure this is Twitch problem or maybe region problem, and please once again, STOP promoting Authy because I don't want it.
  • AJCxZ0 commented  ·   ·  Report

    In every "Your Twitch Account - Successful Log-in" email:

    > We also encourage you to opt-in to receive your security codes via the Authy app.

    On the "Contact Us" page:

    > We recommend that you install the Authy mobile app...

    On the "Setting up Two-Factor Authentication (2FA)" page:

    > Note: On March 19th, 2024, the Authy desktop app will be shut down

    As a bonus on the "Contact Us" page:

    > Email address to send a response to
    > [ my.Twitch@email.address ]
    > Your entry does not match the allowed pattern.
  • DevAnima commented  ·   ·  Report

    I'm locked out of my twitch account because Twitch refuses to send me the 2FA SMS. Their support suggested I contact Authy and/or install the app and use that to log in. I installed Authy on my phone and it just says "This device does not meet minimum integrity requirements" and refuses to work, but I have Google Authenticator on it which works perfectly. I contacted Authy support, and they are suggesting I install the app or contact twitch for help. They have created a nice cycle of actually not doing ****. I used Authy to even change my phone number which they did and had to identify me which required them to send me an SMS code to my previous phone number that was registered on Twitch but on which Twitch was somehow failing to send the same kind of SMS code to let me log in, and even with this new number I still can't log in because again Twitch is not sending the SMS codes. I have asked Authy support to delete my Authy account and if deleting it will remove the 2FA requirement from Twitch and allow me to log in without the need of an SMS code, and they said they aren't sure. Then WHO THE **** ELSE should know this if not the side that handles the 2FA for Twitch? And all twitch support does is it recommends me install Authy or contact them for support. This system was designed by morons.
  • deathau commented  ·   ·  Report

    > Known 2FA SMS issue
    > We are aware of the current 2FA SMS delivery issue that is affecting some users, and are already working on a fix. In the meantime, If you have 2FA enabled on your account and cannot sign in, we recommend installing the Authy app for a temporary fix.

    Hah. I can't even sign up for 2FA right now because of the SMS being a requirement and that service is down. If I could just set up a TOTP without needing an SMS, I wouldn't have an issue.
  • SorennicX commented  ·   ·  Report

    yea 2fa from phone sms messages as being the 1st of step of setting up 2fa is not a good implementation of 2fa in general. Additionally, authy recently was compromised again

  • YoshiRulz commented  ·   ·  Report

    Anyone who still has Authy's online* 2FA set up (which used to be mandatory for streamers) is now the victim of a data leak, opening the door for targeted SMS spoofing attacks.
    https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS
    Now can we get any kind of response to this thread? Or will we have to wait until streamers start getting locked out?

    * Apparently Authy has or had an offline/interoperable mode too, but of course Twitch never allowed it.
1 2 4 6 … 9 10