Twitter will force users to pay £8 a month for two-factor authentication, which helps to protect accounts from hackers, opening up cyber security fears for millions.
The tech giant announced that only paid subscribers would be able to use text messages as a method to secure their accounts.
One Twitter user described it as “reckless”, while another accused owner Elon Musk of putting basic security measures “behind a paywall”.
The changes will come into effect on March 20, the company said. A tweet posted by Twitter support said: “Only Twitter Blue subscribers will be able to use text messages as their two-factor authentication method.”
Twitter Blue allows any user to effectively purchase a “blue tick”, which was previously free for verified accounts of politicians, celebrities, journalists and other public figures.
Two-factor authentication (2FA) requires a user to log in to the app by identifying themselves with more than just a password. Twitter users can use a text message, an authentication app and a security key.
However, the company said it believes text-based 2FA is being taken advantage of by “bad actors”. In a blog post, the company said: “While historically a popular form of 2FA, unfortunately, we have seen phone-number-based 2FA be used – and abused – by bad actors.
“So starting today, we will no longer allow accounts to enrol in the text message/SMS method of 2FA unless they are Twitter Blue subscribers. The availability of text message 2FA for Twitter Blue may vary by country and carrier.”
Those using text-based 2FA who are not subscribed to Twitter Blue, which costs £8.40 a month, “will have 30 days to disable this method and enrol in another,” the company added in a blog post.
Users with 2FA already enabled will have it disabled if they are not subscribed after March 20. The company said: “We encourage non-Twitter Blue subscribers to consider using an authentication app or security key method instead.
“These methods require you to have physical possession of the authentication method and are a great way to ensure your account is secure.”
The move has prompted outcry from users. Naimish Keswani tweeted: “Twitter is now putting the most random features behind a paywall.”
John Scott-Railton, a researcher at Citizen Lab at the University of Toronto, said the move “blackmailed” users. He tweeted: “Yes, there are better forms of 2FA. But this is blackmail.
“Expect waves of takeovers as hackers run through password dumps. Text message authentication isn’t great and it needs to be evolved away from. But this is reckless.”
Mr Musk appeared to confirm that the company was changing policy as a cost-saving measure. He tweeted it was “because Telcos used bot accounts to pump 2FA SMS,” and Twitter was haemorrhaging “$60m a year on scam SMS”.
How to protect your Twitter account
Twitter users who still wish to use 2FA can still do so without paying for Twitter Blue.
Google’s Authenticator app, available to iOS and Android users, can be linked to Twitter, is free and more secure than using SMS, experts argue. This method also protects against SIM card cloning.
Source: telegraph.co.uk