Elon Musk’s X botched its security key switchover, locking users out

Reports are flooding social media with alarming accounts of users being locked out of their accounts on Elon Musk’s platform, X, due to a flawed transition involving two-factor authentication. This issue arose after a mandatory shift to new security measures on October 24. X announced that users utilizing passkeys or hardware security keys—like Yubikeys—needed to re-enroll through the x.com domain. This change is part of the broader effort to phase out the old twitter.com domain, which has redirected to x.com since May 2024. However, the transition has not gone smoothly. Many users are discovering that their security keys are still linked to the now-defunct twitter.com domain, making it impossible to transfer them to the new system. As a result, individuals must manually un-enroll and then re-enroll using x.com. X issued a warning that account access would be suspended after November 10 for those who failed to complete the re-enrollment process or select an alternative two-factor authentication method. Following the deadline, a wave of users has reported being locked out, encountering error messages, or getting trapped in frustrating loops that prevent them from accessing their accounts. This incident adds to the growing list of challenges faced by X, which Musk acquired for $44 billion. Since his takeover, the platform has undergone significant layoffs and has been mired in various controversies. While X has not provided any official comments on the current issue, Musk continues to post updates as if unaffected by the situation.