SEC Twitter account hacked; Twitter says two-factor authentication wasn’t enabled. Is it legal for Twitter to make it public whether 2FA is enabled on an account? Should it be?