An update on our security incident
> 2FA compromised<p>This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone).<p>The only secure authentication these days is a <i>non-communicable</i> possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.