How to proceed after successful authentication?

Why doesn't Twitter offer two-factor authentication?

• Google, Facebook and Twitter are widely used to authenticate users on a large number of other websites, which means if they are compromised any site that uses them for authentication may be compromised. Both Google and Facebook offer some form of multi-factor authentication--which goes a long way in protecting accounts even when the username and passwords are compromised. Twitter does not. Update: Apr 23, 2013, Wired confirms that Twitter now has two-factor authentication that is currently undergoing internal testing. http://www.wired.com/threatlevel/2013/04/twitter-authentication/?cid=7401184 Update: Apr 23, 2013, the Associated Press (AP) Twitter account was hijacked and used to report explosions at the White House and that the President had been injured, which subsequently led to 150-point drop in the Dow. TechCrunch reports that the hack was preceded by a phishing attempt. Needless to say, multi-factor authentication would have prevented yet another major hack. Update: In light of recent high-profile hijackings of Burger King and Jeep (and this follows a growing list of similar incidents that include NBC News, USA Today, and Fox News), Twitter's advice is to simply use better passwords--no talk of multi-factor authentication that would put an end to these hacks. Story here: http://arstechnica.com/security/2013/02/il0vethewhopper-doesn-cut-it-twitter-calls-for-tougher-passwords Update: Twitter was recently hacked and the company says that up to 250,000 user accounts may have been accessed with usernames, email addresses, session tokens, and password hashes stolen. It seems Twitter could substantially reduce the risk to user accounts in circumstances like this by simply offering two-factor authentication. Story here: http://www.wired.com/threatlevel/2013/02/twitter-hacked/

• Answer:

  Because it would cause great confusion across their user base It implies that Twitter is insecure - very bad for PR Social login is probably a poison chalice issue with Twitter's Managment To implent you own 2FA on Twitter: Use HootSuite Open GMail account Implement 2FA with Google's Authenicator - https://support.google.com/accounts/bin/answer.py?hl=en&topic=1056283&answer=180744&rd=1 Change your Twitter password to something you cannot remember Open a Hootsuite account with your GMail account Bind your Twitter to your Hootsuite account Change your Twitter password on a weekly/monthly basis