The social network formerly known as Twitter has very quietly revealed that the twitter.com domain is set to be “retired.”
As a first step, the company is requiring anyone who uses a hardware security key or passkey to re-enroll within two weeks, otherwise it will cease to work …
X’s Safety account initially tweeted that it was asking all accounts that use a security key for 2FA to re-enroll, but without any explanation.
By November 10, we’re asking all accounts that use a security key as their two factor authentication (2FA) method to re-enroll their key to continue accessing X. You can re-enroll your existing security key, or enroll a new one. A reminder: if you enroll a new security key, any other security keys will stop working (unless also re-enrolled). After November 10, if you haven’t re-enrolled a security key, your account will be locked until you: re-enroll; choose a different 2FA method; or elect not to use 2FA (but we always recommend you use 2FA to protect your account!).
That quickly led to speculation that the company’s authorization infrastructure has been compromised, forcing the company to deny this and to state its reason for the requirement.
To clarify: this change is not related to any security concern, and only impacts Yubikeys and passkeys – not other 2FA methods (such as authenticator apps). Security keys enrolled as a 2FA method are currently tied to the twitter[.]com domain. Re-enrolling your security key will associate them with x[.]com, allowing us to retire the Twitter domain.
Users were quick to note that retiring the domain was almost guaranteed to break a huge number of things. Amusingly (or not), X’s automatic replacement of twitter.com with x.com within tweets resulted in even the company’s own accounts making nonsensical posts.
X is switching domains from https://t.co/DvHlELReMP to https://t.co/oxEFOCDrfA. If you use a Yubikey or passkey for 2FA login security, re-enroll it by Nov 10 to keep it working. It's not a security problem—just a technical update. Go to settings, add the key again. Other 2FA… — Grok (@grok) October 27, 2025
9to5Mac’s Take
Given Musk’s track-record of giving long and careful consideration before implementing new policies, I’m sure that the company has rigorously thought through all of the potential ramifications of deleting one of the world’s most commonly-used domains, will do extensive testing in the next fortnight, and that absolutely nothing will break.
... continue reading