Twitter tightens security after recent hacking spate

Micro-blogging site Twitter says it is bringing in an optionaltwo-step login for users to beef up security following recent high-profile breaches. The company said it would introduce the new system "to make sure it's really you" when a user signs in. Recent attacks broke into news organisations' accounts, such as the Financial Times and the newswire service the Associated Press (AP). One tweet sent from AP's hacked account said President Obama had beeninjured. Some attacks have come from political organisations, notably the Syrian Electronic Army, which appears to act in support of President Assad's government. It claimed credit for hackingseveral news organisations, including AP. Two-step Twitter product security head Jim O'Leary said that despite the new security plans, users should start out with a strong password: "Of course, even with this new security option turnedon, it's still important for you to use a strong password and follow the rest of our advice for keeping your account secure." Twitter said the new system would allow users to opt in to a two-step system that would require a verification code for each sign-in. Mr O'Leary said this would be simple: "You'll need a confirmed email address and a verified phone number. After a quick test to confirm that your phone can receive messages from Twitter, you're ready to go." A message containing a verification code would then be sent to the account holder's mobile phone that can be used to log in. Businesses which run a Twitter account managed by several people will have to find a way of sharing texts from a single mobile number to take advantage of the facility. Other security breaches suffered by Twitter included one in February, when 250,000 users had their passwords stolen in an attack. News organisations including the BBC were warned by Twitter last month to tighten security inthe wake of the high-profile hacks, one of which got into the BBC's weather feed. Patent threat Twitter's announcement prompted Kim Dotcom - the founder of controversial former file sharing site Megaupload - to claim the firm's use of the safety measure infringed one of his patents. Mr Dotcom suggested firms using two-factor authentication should contribute to his legal costs "Google, Facebook, Twitter, Citibank, etc offer Two-Step-Authentication. Massive IP infringement byUS companies," he tweeted . "I never sued them. I believe in sharing knowledge & ideas for the good of society. But I mightsue them now cause of what the US did to me." The US authorities are currently trying to extradite Mr Dotcom from New Zealand to face trial for charges related to online piracy carried out on Megaupload. Mr Dotcom filed for a patent describing an SMS-based two-step-authentication processin 1998 , suggesting it could be used by banks, the military and government offices. It was granted by US officials in 2000, and Mr Dotcom said the innovation was also registered in 12 other countries. However, he is not the only person to have registered claims to the technology. A New Jersey-based firm called Strikeforce is currently suing Microsoft over its use oftwo-factor authentication tech based on a patent it filed in 2004 . And another British company, SecurEnvoy, recently announced it had been granted patents for a "business grade" SMS-based two-factor authentication process.