SAN FRANCISCO — Twitter is adding a new security tool to its website, making it harder for outsiders to gain access to accounts, a month after a false posting triggered a stock-market decline.
The two-step authentication measure, available as an option starting Thursday, requires users to input a code sent via text message to a mobile phone to log in, Jim O'Leary, a member of Twitter's product security team, said in a blog post Wednesday.
Twitter, which has more than 200 million users, follows Apple, Google and Facebook in introducing two- step authentication, as people put more information online. The hack of an Associated Press account last month resulted in tweets about explosions at the White House that temporarily wiped out $136 billion in value from the Standard & Poor's 500 Index. That increased pressure on Twitter Chief Executive Officer Dick Costolo to install safeguards for users as he prepares for an eventual initial public offering.
"Social sites are a big target of these hackers," said Barmak Meftah, chief executive officer of San Mateo, Calif.- based computer-security company AlienVault. "All the efforts around fortifying and securing these sites is obviously huge. It's great that Twitter is taking steps toward stopping this."
Twitter's new authentication feature has been in development since at least last month, according to a person familiar with the matter. The San Francisco-based company said it plans to introduce more security measures to prevent hacking.
"When you sign in to twitter.com, there's a second check to make sure it's really you," O'Leary wrote. "Much of the server-side engineering work required to ship this feature has cleared the way for us to deliver more account security enhancements in the future."
In the AP hacking attack, the fabricated tweet was sent after unauthorized users gained access to the account, the news agency said. Common tactics that hackers use include spear phishing attacks, in which someone is duped into installing malicious code onto their computer or mobile device, and malware hidden on websites.