X (formerly Twitter) Requires Security Key Re-registration for 2FA Users by Nov. 10

Social media platform X (formerly Twitter) is strongly urging users who utilize security keys for two-factor authentication (2FA) to re-register them by November 10. This measure is a consequence of the deprecation of the old Twitter domain (twitter.com) and the complete transition to the current X domain (x.com). Failure to comply may result in account lockout.

According to an announcement from X, affected accounts are those that use physical security keys (such as USB devices) or passkeys as 2FA during login. These users must re-register their security keys to be compatible with the new domain (x.com) by November 10.

Conversely, users who do not use two-factor authentication at all, or who have set up 2FA using other methods such as authenticator apps or SMS authentication, are not subject to this re-registration requirement. As many users rely on these other authentication methods, numerous voices expressed relief, saying, "This doesn't concern me." However, some users commented that it prompted them to reconsider their security practices, asking, "Given the security key's safety, perhaps I should set one up?"

Security keys are considered to offer stronger protection against phishing attacks and account hijacking compared to traditional passwords or SMS authentication. While this re-registration request is an temporary measure due to system migration and is not a security flaw, users are urged to take appropriate action by the deadline.

Should an account become locked due to forgotten re-registration, remedies are reportedly available. However, to ensure continued smooth use of X, affected users are recommended to verify and take action promptly.

The Context

X, formerly known as Twitter, is a popular social media platform. The company, acquired by Elon Musk, underwent a major rebranding in July 2023, transitioning its name, logo, and primary domain from "twitter.com" to "x.com". This ongoing migration impacts various aspects of the platform's infrastructure, including how security features like two-factor authentication (2FA) are handled.

Two-factor authentication (2FA) is a security process that requires users to provide two different authentication factors to verify themselves, adding an extra layer of security beyond just a password. Common 2FA methods include codes sent via SMS, authenticator apps (like Google Authenticator), or physical security keys.

Security keys are hardware devices (often USB-based) that provide a high level of security by using cryptographic protocols. Unlike passwords or SMS codes, they are resistant to phishing because they verify the website's legitimate domain before authenticating. This specific re-registration requirement by X is a technical adjustment necessitated by the domain change from twitter.com to x.com, ensuring that the security keys, which are domain-specific, correctly recognize the new X platform as legitimate for authentication purposes.