PSA: Re-register your hardware 2FA key for X before Nov. 10 to avoid getting locked out

X, the social media platform formerly known as Twitter, has announced a significant change regarding its authentication system. Over the weekend, the company declared its intention to phase out the twitter.com URL for two-factor authentication (2FA). This shift means that users who utilize hardware keys, such as YubiKeys, must re-register these keys by November 10 to maintain access to their accounts. In a message posted on its safety account, X emphasized the importance of this action: "By November 10, we’re asking all accounts that use a security key as their two-factor authentication (2FA) method to re-enroll their key to continue accessing X. You can re-enroll your existing security key or enroll a new one." The rationale behind this change is straightforward; X aims to retire the outdated twitter.com domain. However, users should rest assured that this transition will not affect other 2FA methods, such as Google Authenticator, Microsoft Authenticator, or Authy. To clarify the situation, a representative from X stated, "This change is not related to any security concern and only impacts YubiKeys and passkeys – not other 2FA methods like authenticator apps." The current security keys are linked to the twitter.com domain, and re-enrolling them will connect them to the new x.com domain, facilitating the retirement of the Twitter domain. Christopher Stanley, a security engineer at X, xAI, and SpaceX, elaborated on the importance of this move for maintaining domain trust. He explained, "Getting off of Twitter enrolled keys allows us to stop using makeshift solutions for domain trust. Physical security keys are cryptographically registered to Twitter’s domain and need to be re-enrolled under X." For users relying on hardware keys for account protection, the re-registration process can be completed by navigating to “Settings” -> “Security and account access” -> “Two-factor authentication” -> “Manage security keys.” As of now, it's unclear if X plans to eliminate the twitter.com domain entirely or if this action is solely a security measure. Inquiries have been made to the company for further clarification, and the story will be updated should any new information emerge.