A major security failure has reportedly left users of X, the social media platform formerly known as Twitter, permanently locked out of their accounts. Elon Musk now owns this platform outright. On October 24, things started going wrong when X prompted its users to re-sign up for two-factor authentication (2FA). This request included use of the new x.com domain. Our ask here is especially targeted to users who use passkeys or hardware security keys such as Yubikeys for authentication. This approach has deep digital roots to the former twitter.com site.
In 2022, Elon Musk bought Twitter for $44 billion. Since then, the platform has continued to evolve, including the establishment of a new weekly cybersecurity newsletter, “This Week in Security.” The later move to the x.com domain was one step in a required two-factor security process that Elon first announced in May 2024. The implementation rightfully received a lot of criticism as countless users struggled after the November 10 deadline.
The biggest part of the problem is that passkeys and security keys can’t be migrated or copied from twitter.com to x.com. This has resulted in thousands of beneficiaries encountering a never-ending cycle or total shutdown from accessing their accounts. Reports indicate that many of the affected users were warned that their accounts would be suspended. They will remain so until they either re-register under the new system or select an alternate method for two-factor authentication.
Zack Whittaker, the security editor at TechCrunch, underscored how pervasive these problems are on social media platforms. Users have been filling this space sharing their frustrations and seeking solutions. On the ground, it’s complete turmoil but in typical Elon Musk fashion, X is business as usual. He seems very much undeterred by the non-existent systems capacity that has left most users struggling.
So far, X has declined to respond to requests for comment about their role in all this. The incident spotlights larger issues about security transitions and the risk of alienating users during major system updates.
