Twitter introduced two-step verification in May 2013 after a hacking incident the previous February. The original verification used a SMS-based system that sent a text message with an access code. With this new method, you no longer need a phone number or texts. This also lets people access two-step verification if they don’t use one of the supported mobile carriers.
We’ll show you how to set up and access this improved security feature.
Note: if you have SMS verification enabled, you must revoke its permission in the web app for the app-based verification to work correctly.
Setup Login Verification in the mobile app
In the iOS app, select the “Me” tab, tap on the gear icon to open options, select “Settings,” and tap on “Security.” Android users will need to select your account name in “Settings” and scroll down to see the “Security” option.
Hit the check box on the right to turn on Login Verification.
Using Login Verification
Head to Twitter.com and log in with your account and password. Now when you attempt to sign in, a verification request will be sent to your phone.
Return to your device and select “Login requests.” Here you can revoke or allow any web login requests.
The backup code
If you somehow lose your phone or don’t have access to it at the moment, the Twitter app will generate a random code that you can use to get into Twitter.com. Unlike you might expect, this code isn’t temporary, so you might want to write it down just in case.
Select “backup code” and enter your code. Twitter will remind that you will need to return to your phone to change the backup code.
Is it really secure?
The backup code doesn’t expire with one use, this means two-step verification isn’t nearly as secure as you’d expect. If your phone is stolen or someone learns your backup code they can still get into your Twitter account.
Until Twitter updates this function it may be better to stick with SMS text Login Verification. If you’re not interested in the new app-based verification, you can disable it by toggling off the check box.
