Twitter announced in June 2018 that it will now support the use of a Universal Second Factor (U2F) key for two-factor authentication (2FA). This announcement addresses password logging issues that Twitter and other online services have experienced in recent months.

These problems, which can potentially expose customer login details to staff members and external actors, underscore the importance of providing users with the option to implement some form of 2FA.

But even though Twitter has enabled this security feature, not all users have taken advantage of it — and a portion of those that have are not thrilled about the user experience. It’s up to organizations and online services across all industries to make 2FA more approachable to users.

U2F Aims to Squash Password-Leaking Bugs

Twitter unveiled its support of the Fast Identity Online (FIDO) Alliance’s U2F security key for login verifications as part of a broader effort to combat spam and malicious bots.

According to a recent blog post, the social media giant announced plans to:

• Make suspicious accounts less visible in metrics;
• Make it more difficult for cybercriminals to register spam accounts;
• Challenge suspicious accounts to prove their authenticity; and
• Expand its malicious behavior detection capabilities.

In the meantime, Twitter urged users to protect their login information with a physical U2F security key.

The announcement came less than two months after Twitter discovered a bug in its password storage process. As noted in a company blog post, the glitch caused users’ passwords to be written to an internal log before the hashing process completed — meaning the passwords were stored in plaintext. In response, Twitter disclosed the vulnerability and notified its nearly 340 million users that they should change their passwords.

The social networking service isn’t the only company that has accidentally recorded users’ passwords in plaintext. GitHub detected a similar, yet unrelated, error around the time of Twitter’s discovery, as reported by Bleeping Computer.

These types of bugs often arise for companies that manage complex software. System Overlord reported that the change of an environment variable could theoretically produce a similar type of flaw, noting that code review can’t detect 100 percent of these errors because “releases are cut all the time with a handful of changes that were reviewed in isolation and occasionally have strange interactions.”

2FA Is Met With Resistance

Despite the security benefits, not all users see the utility of 2FA, and even those who have adopted the technology frequently bemoan the user experience. In fact, seven out of eight users who participated in a recent survey cited inconvenience as the main reason for disabling 2FA.

According to a recent Duo Labs’ report, State of the Auth: Experiences and Perceptions of Multi-Factor Authentication, just 28 percent of users said they use two-factor authentication, and only about half of those users (54 percent) said they had implemented the control voluntarily. As a result, it’s not surprising that SecureAuth found that 74 percent of IT decisions have received complaints from 2FA users, with 10 percent stating they “hate it.”

Adapting Authentication to User Needs

To strike a proper balance between security and a streamlined customer experience, companies should consider investing in silent identity and access management (IAM) solutions that work in the background to verify users without adding steps to the authentication process. These systems offer features such as single sign-on (SSO) for the one-password logins users expect and user self-service capabilities for password resets, interrupting the user experience only when malicious activity is detected.

For companies that rely on 2FA to verify user identities, security professionals and business executives must lead by example and enable these controls wherever possible, even if the corporate policy doesn’t require it. These and other identity protection measures are crucial to protect enterprise data from fraudsters looking to exploit stolen credentials.