X Users Must Re-Enroll Security Keys Due to Domain Shift, Enhancing Protection Against Phishing
October 27, 2025
X (formerly Twitter) has announced that users relying on hardware security keys or passkeys for two-factor authentication must re-enroll their keys by November 10, 2025, due to the domain change from twitter.com to x.com.
The domain transition aims to improve domain trust and security by removing reliance on the twitter.com domain, as explained by X's security engineer, Christopher Stanley, to prevent 'hacky' trust issues.
This move is purely technical and does not indicate new security concerns; it is designed to enhance protections against phishing attacks exploiting domain-specific trust.
The change is solely related to the domain transition and does not suggest any new security threats, emphasizing that it is part of a broader effort to maintain security during the rebranding.
Elon Musk's involvement indicates he is actively shaping the platform's direction, balancing improvements with his vision and policies.
Recent platform updates include improvements introduced by new head of product Nikita Bier, though Musk has intervened in content moderation and monetization policies.
This update is unrelated to any security incident and only affects users employing hardware security keys like YubiKeys or passkeys, not those using authentication apps or SMS codes.
Re-enrollment can be completed through the account's Security and Privacy settings, where users can add, remove, or update their security keys or passkeys.
X has experienced issues such as a bug causing irrelevant recommended posts, which Musk acknowledged and said the team is working to fix.
The announcement caused confusion among users and security experts due to unclear communication, raising questions about whether the change was security-related or solely technical.
Using 2FA or passkeys remains crucial for online security, as they protect accounts even if passwords are compromised, though debates about the safety of SMS-based 2FA continue.
Despite ongoing rebranding efforts, legacy assets like the old Twitter logo still appear in some parts of the platform, but the platform is rapidly shifting under Musk's leadership.
Summary based on 15 sources
Get a daily email with more Tech stories
Sources

The Verge • Oct 27, 2025
X is getting closer to removing the last reminders of Twitter
Forbes • Oct 26, 2025
X Issues November 10 ‘Account Will Be Locked’ Twitter Security Warning
TechCrunch • Oct 27, 2025
PSA: Re-register your hardware 2FA key for X before Nov. 10 to avoid getting locked out
CNET • Oct 27, 2025
X Is Retiring Twitter.com. Update Your Account Now or Risk Lockout