Twitter introduces 'two-factor authentication' to stop password hacking

Company introduces mobile phone-based system to stop hackers from capturing control of Twitter accounts

Twitter on a mobile phone: will offer two-factor authentication soon. Photograph: Sarah Lee

Twitter is introducing "two-factor authentication" using mobile phone verification on the social network, after a number of high-profile cases in which passwords were stolen by hackers.

The worst case occurred in April when the Associated Press's feed was hacked by a group calling itself the Syrian Electronic Army, which put out a false tweet claiming President Obama had been injured in a bomb attack - briefly causing a dip in US stock markets. Organisations including the Guardian, FT, and BBC have also been hacked by the group.

With "2FA" enabled, any attempt to log in from a new device requires a code that is sent to a pre-designated mobile phone. Even with the correct password, the login will fail without the code.

As first reported by the Guardian in February, the company has made the move in the face of a growing number of such attacks over the past year, and the increasing importance of Twitter to organisations and individuals who can command huge followings.

The company says in a blog post that the introduction is the first step as it adds greater security that is being added to the service: "much of the server-side engineering work required to ship this feature has cleared the way for us to deliver more account security enhancements in the future," it says.

The setting is being rolled out gradually.

Two-factor authentication uses a combination of a password and a code sent to a mobile phone to verify a login. It is offered as an option by email services including Google's Gmail, Microsoft's Outlook (formerly Hotmail), Yahoo mail, Apple's iCloud, Facebook and cloud storage service Dropbox.

The hacks by the Syrian Electronic Army and others occurred after they hacked into email accounts using phishing - to capture the email address and password of the user - and then using that to gain access to their Twitter account. That attack only works for users who have not enabled two-factor authentication for their email - but many have not. That leaves associated accounts, including Twitter, open to hacking.

With "2FA" enabled, the SEA's hacks would not have worked because although they would have had the password for the account - or a reset code - they wouldn't have had the code sent to the mobile phone required when a new device.