Twitter tightens security after recent hacking spate

The Syrian Electronic Army claims to have been behind some of the highest-profile attacks

Micro-blogging site Twitter says it is bringing in an optional two-step login for users to beef up security following recent high-profile breaches.

The company said it would introduce the new system "to make sure it's really you" when a user signs in.

Recent attacks broke into news organisations' accounts, such as the Financial Times and the newswire service the Associated Press (AP).

One tweet sent from AP's hacked account said President Obama had been injured.

Some attacks have come from political organisations, notably the Syrian Electronic Army, which appears to act in support of President Assad's government.

It claimed credit for hacking several news organisations, including AP.

Two-step

Twitter product security head Jim O'Leary said that despite the new security plans, users should start out with a strong password:

"Of course, even with this new security option turned on, it's still important for you to use a strong password and follow the rest of our advice for keeping your account secure."

Twitter said the new system would allow users to opt in to a two-step system that would require a verification code for each sign-in.

Mr O'Leary said this would be simple: "You'll need a confirmed email address and a verified phone number. After a quick test to confirm that your phone can receive messages from Twitter, you're ready to go."

A message containing a verification code would then be sent to the account holder's mobile phone that can be used to log in. Businesses which run a Twitter account managed by several people will have to find a way of sharing texts from a single mobile number to take advantage of the facility.

Other security breaches suffered by Twitter included one in February, when 250,000 users had their passwords stolen in an attack.

News organisations including the BBC were warned by Twitter last month to tighten security in the wake of the high-profile hacks, one of which got into the BBC's weather feed.

Patent threat

Twitter's announcement prompted Kim Dotcom - the founder of controversial former file sharing site Megaupload - to claim the firm's use of the safety measure infringed one of his patents.

Mr Dotcom suggested firms using two-factor authentication should contribute to his legal costs

"Google, Facebook, Twitter, Citibank, etc offer Two-Step-Authentication. Massive IP infringement by US companies," he tweeted.

"I never sued them. I believe in sharing knowledge & ideas for the good of society. But I might sue them now cause of what the US did to me."

The US authorities are currently trying to extradite Mr Dotcom from New Zealand to face trial for charges related to online piracy carried out on Megaupload.

Mr Dotcom filed for a patent describing an SMS-based two-step-authentication process in 1998, suggesting it could be used by banks, the military and government offices. It was granted by US officials in 2000, and Mr Dotcom said the innovation was also registered in 12 other countries.

However, he is not the only person to have registered claims to the technology.

A New Jersey-based firm called Strikeforce is currently suing Microsoft over its use of two-factor authentication tech based on a patent it filed in 2004.

And another British company, SecurEnvoy, recently announced it had been granted patents for a "business grade" SMS-based two-factor authentication process.