The person is using their phone to access a one-time code that is synced only with their phone and twitter.