X: FIDO sticks must be re-registered

Protecting access to online services with a hardware dongle as a second factor is a good idea from a security perspective. However, anyone who has done this with their Twitter account now has to re-register their FIDO stick; the social network X's security team is now warning.

The service writes: “By November 10th, we ask all accounts using a security key as a two-factor authentication method (2FA) to re-register their key to continue accessing X. You can re-register your existing security key or register a new one.” The service points out that those who register a new FIDO stick will lose access with all other security keys, unless they are also re-registered.

Cause not security problems

However, the necessary measure is not due to any security problems but is related to the change of the offering from “Twitter” to “X”.

Only Yubikeys and Passkeys are affected by this, X further explains. Other two-factor authentication methods, such as those with authenticator apps, continue to work.

X further explains: “Security keys registered as a 2FA method are currently tied to the twitter.com domain. By re-registering your security key, these will be linked to x.com, allowing us to decommission the Twitter domain.”

Affected users will receive a notification that they need to re-register their security key. However, users can also take action themselves and select “Add other key” in the account settings to re-register the FIDO stick.

In mid-2023, Elon Musk took over Twitter and turned it into the service “X,” which was more than a mere rebrand. The work to get rid of the old Twitter domain is apparently still ongoing.

(dmk)