Skip to content
Translate Ideas and Comments
Choose language:
There was an error during translation
← Account Management

How can we improve the account management experience?

Account Management: Security and Privacy Settings

Categories

Stop requiring a phone number to set up 2FA.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

  • It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

  • Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

  • Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)
1,619 votes

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

NinethLions shared this idea  ·   ·  Report…  ·  Admin →
How important is this to you?

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close

We're glad you're here

Please sign in to leave feedback
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • SpawnOfThespis commented  ·   ·  Report

    REQUIRING A MOBILE PHONE FOR 2FA IS DISCRIMINATORY AND SHOULD BE ILLEGAL.

    I am being penalized for my private choice of phone service and/or for being poor; both of which are illegal.

    I am eligible for Affiliate but can't continue because of my phone. I use Republic Wireless because I am extremely poor and it is one of the best deals out there to have a mobile number. It is my only number. I've had it for over 7 years so it is legitimate. I literally don't have a choice for phone number. Republic is a legitimate company so this is literally the same as if someone was being denied for having Verizon, AT&T, T-Mobile, or any other carrier.
    MY CHOICE OF PHONE CARRIER SHOULD NEVER BE A FACTOR.
    I have email verification enabled for security. I use it to log in with a new verification number every day which is more than most security protocols.
  • dirtyjester1 commented  ·   ·  Report

    Another affected user checking in here. I'm holding out hope this was a mistake and gets reversed. If it is intentional and permanent then I'm leaving the platform.
  • PrettzL commented  ·   ·  Report

    Oh boy if this is intentionally being rolled out to small batches of people and doesn't get reverted they will lose everyone.

    There's no reason to have this as anything but an optional feature.
  • ThatCraigBloke commented  ·   ·  Report

    update. I'm reading 'bug' in the comments. Twitch support tells me it's an 'experiment'.

    I will mention that enforcing phone verification is one of the main changes HAPPS rolled out just before that platform's sudden demise. Twitch is too big and too well respected to just die like that but HAPPS' failure to listen to its customers on this subject is at minimum a high-profile example that should be acknowledged internally.

    Noted that support no longer respond to requests like "how long is this 'experiment' going to continue.
  • ogaboogawakanda commented  ·   ·  Report

    Turn off verified accounts only chat. Here’s two accounts with proof where streamers have it set off but twitch forces it on them anyways.

    1) https://twitch.tv/viola_vivace
    Streamer and mod both confirm that verified accounts only chat is turned off but this message appears regardless and won’t let me chat. “A verified phone number is required to chat in this channel. Please verify your phone number in Security & Privacy in Settings.”

    https://clips.twitch.tv/TenderRefinedPorcupinePeoplesChamp-RyFXXkfg_0UZlxdh

    https://files.catbox.moe/yh8zzo.png

    2) https://twitch.tv/moriraine
    Streamer confirms it’s turned off live on stream: https://clips.twitch.tv/CallousObliqueRamenHeyGuys-44Sj4TZaUOMp5pFd

    But twitch decides to force it anyways screenshot proof:
    https://files.catbox.moe/akalkn.png
  • illixion_ commented  ·   ·  Report

    Ironically, keeping 2FA disabled on Twitch is more secure, as you are forced to use EMail login codes instead, and my email provider doesn’t force SMS 2FA. I set up TOTP with no SMS 2FA on all of the services that I use due to SIM swapping, and Twitch is the only website besides my bank that enforces SMS 2FA. Take note of how sites like Twitter handled this issue and consider removing this dangerous restriction.
  • PrettzL commented  ·   ·  Report

    This.

    It's obviously a bug caused by something done in the back end as it has not occurred for everyone but only to some accounts.

    There are several new throwaway accounts I've made that do not have this issue at all, and if it were applied to everyone it would definitely show that it was intentionally done.
  • PDogJunior commented  ·   ·  Report

    My account is 8 years old and I have lost the ability to chat in pretty much every single stream across Twitch. You should leave it up to the individual streamer whether or not to enable phone verification. This isn't right as many of us are now effectively banned site-wide.
  • SneakySpike commented  ·   ·  Report

    Don't lock my account behind VERIFIED ACCOUNT ONLY CHAT. You try to scam people to get their phone numbers.
  • puddingpuppy commented  ·   ·  Report

    This is extremely user hostile and an invasion of privacy for Twitch to suddenly do this to a bunch of people's accounts. If I can't chat anymore I will cancel my subs and might as well just watch Youtube.
  • argobargsoup commented  ·   ·  Report

    This also badly effects users who may not actually have a mobile phone number.
  • ThatCraigBloke commented  ·   ·  Report

    The twitch experiment setting my entire account to require a phone number to be verified is flawed. Phones are not secure. I lost my Microsoft account because auth was sent to a phone so I don't trust it now. Some streamers set it, most don't. Don't force false security on us .
  • KiffJRocka commented  ·   ·  Report

    I also never give out my phone number and never needed to, they just ask it on certain channels where the streamer puts in the option to verify a phone number before using their chat, I don't care about chatting because viewers are just a number and streamers don't look at the names of the people saying things. Besides Twitch I never use any website asking for phone number, they just want to sell your number to 100s of companies, the internet and companies like Twitch Amazon are disgusting and destroying privacy, our grandkids will never learn about the word privacy as it won't exist in any form anymore, in meanwhile all governments have leaders aged 70 that have no clue about technology so laws are coming in very late.

  • budgetteen commented  ·   ·  Report

    This is not a good idea as the OP mentioned. You should provide 2fa with TOTP without a phone number? what is the reason you have to ask for my phone number?
  • Miszka commented  ·   ·  Report

    Agreed. I don't even get the reasons for requiring a phone number to set up a 2FA method that does not even depend on it (TOTP).
  • windsunh2o commented  ·   ·  Report

    Yup, thanks to all my fellow Republic Wireless users here who helped me confirm why I cannot verify my Twitch account. Guess I'm currently SOL.
  • SuperSmoofer commented  ·   ·  Report

    I absolutely agree! My phone has been deactivated and I can't afford to reactivate it, even temporarily. This means even though I can apply for twitch affiliate, I can't go past the 2FA at all because of the phone number requirement.
  • chucklefuffle commented  ·   ·  Report

    Why am I given the option to create an account without using a phone number only to find later a phone number is mandatory in order to do most things on this technological abomination of a website. It makes me really not want to give you that information simply because you're willing to be deceptive to get it. Frankly, I don't believe you people couldn't get that information within a half of a day anyway, so why make me jump through all of these unnecessary hoops?
1 2 … 6 7 9