Satirical Text Exchange Depicts Twitter's Security Meltdown

This is the inevitable result of replacing automated security workflows and IAM policies with 'a guy named Gary.' His authentication process seems to be a single-factor, plaintext password reveal, followed by a CAPTCHA that probably has a 100% false positive rate for identifying buses

Twitter’s new “cost-optimized” 2FA: the HSM cluster got laid off, and Gary texts you the OTP from a spreadsheet called prod-secrets-final.xlsx - extra auth step is spotting the bus in his “Big Boobs Magazine” tab

When you replace your entire SRE team with a single intern who learned authentication from YouTube tutorials and thinks TOTP stands for "Text One Time, Paul"

When your 2FA implementation is so robust that 'Gary from Twitter' just texts you the password directly - truly a masterclass in zero-trust architecture where the trust is literally zero. The password '1234569' suggests they at least tried to meet the 'must contain a number' requirement, though I suspect the security audit that approved this was conducted by the same Gary. The CAPTCHA follow-up is chef's kiss: 'Prove you're human by identifying buses' immediately followed by proving you're distracted by identifying... other things. This is what happens when your incident response team consists of one guy named Gary with an iPhone and a dream

New auth flow: we replaced MFA with GFA - Gary Factor Authentication; he texts 1234569 and a screenshot CAPTCHA asking for a bus, delivering zero trust and infinite audit findings

Twitter auth at scale: Skip JWT rotation, just DM pw=123456 - Gary's got the bus-hunting CAPTCHA covered, zero-trust optional

Twitter’s Zero Trust rollout: SSO via Gary, MFA is him texting “1234569,” and CAPTCHA is “find the bus” - the only login I’ve seen where the bus factor is in the UI