* * *

Charles Arthur 

Twitter plans to introduce a "two-factor authentication" option that would make it impossible for hackers or vandals to break into accounts – even if they acquired the passwords.

The "2FA" system, which is also offered as an option by Google for its Gmail email system, blocks access from new devices or internet addresses, even when using the correct password, unless accompanied by a short numerical code that is sent separately to the account owner's mobile phone.

The news comes just days after the company reset the passwords on at least 250,000 accounts, after hackers broke into its systems and were suspected of accessing users' data, including email addresses and encrypted passwords. Twitter said it reset the passwords as a safety measure, and that it was not certain whether the hackers had accessed them.

Two-factor authentication adds an extra layer of safety to any service, as well as effectively alerting the true owner when attempts are made to hijack the account. It could also have averted HMV's embarrassment last week when an intern began tweeting about mass firings at the company, leading to a brief struggle for control of the account with her boss.

When an attempt is made to log in to the account from a new device, app or unfamiliar location (as indicated by the IP address), a two-factor authentication system will prevent the login being authorised. A code will be sent to the registered user's mobile phone, and only when that has been entered in the same login page is access given to the account.

Graham Cluley, senior technology consultant at the security company Sophos, said: "This is a splendid idea – I'm looking forward to it. It's something that we've wanted for some time. We've often said we would be prepared to pay for it – Twitter could monetise it by offering it to corporations and branded accounts. It would be pretty attractive."

There's no indication that Twitter would charge for two-factor authentication, but its increasing desire to attract major brands, both as users and advertisers on the service, has led to it emphasising safety. Google offers the service for free with any Gmail account.

The intention is revealed in a job posting by Twitter for a "software engineer – product security", among whose tasks would be to "design and develop user-facing security features, such as multifactor authentication and fraudulent login detection".

A number of high-profile Twitter accounts have been hacked over the years, usually after owners are tricked into giving their credential to sites posing as Twitter. Among those that have been affected are PayPal UK and Fox News politics, as well as the actor Ashton Kutcher – at one time the celebrity with the biggest Twitter following.

Twitter added SSL – the Secure Sockets Layer – connectivity to its website and third-party apps in August 2011, ensuring that users' credentials could not be captured via open Wi-Fi networks, for example. But that does not protect against people who unwittingly give their passwords to malicious hackers. /Guardian