Live data from Hacker News

Ask HN: How does my Instagram keep getting compromised?

news.ycombinator.com

11–20 of 118 posts

Re: Ask HN: How does my Instagram keep getting compromised?

#11
post #7

Earlier quoted context omitted.

Interesting, do you have any links to that end?

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

Wow that's a shitty thing to do

Re: Ask HN: How does my Instagram keep getting compromised?

#12
What devices are you using the account on? If it's on a desktop browser, my assumption would be that you've got malware. That allows them to trivially steal the session cookies, steal the passwords the next time you log in, steal any device identification cookies that are used to control not using 2FA on logins from trusted devices / sending new device notifcations, and also hijack your recovery and notification email address.

If you're only using this via the app from a mobile device, then malware is an unlikely explanation though.

(Why are you regularly changing the password anyway? What's the threat model you're trying to guard against?)

Re: Ask HN: How does my Instagram keep getting compromised?

#13
post #3

> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

Should be easy enough to post a list of stolen accounts someplace public.

Re: Ask HN: How does my Instagram keep getting compromised?

#14
post #10
post #7

Earlier quoted context omitted.

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

I can understand the company pulling usernames from an automated name squatter... but I wonder if this happens to fully established accounts too?

Well, I tracked the previous UIDs and saw a lot of names that weren't squatted getting released and shortly after ending up with Instagram employees.

E: Oh yeah, there was also the whole "trademarking" thing that was used to steal generic names from active accounts using obviously invalid trademarks. https://www.vice.com/en/article/zma3w4/scammers-fake-tradema...

Re: Ask HN: How does my Instagram keep getting compromised?

#16
post #11
post #7

Earlier quoted context omitted.

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

Wow that's a shitty thing to do

Meh, it's their site. It's just weird that they don't seem to have any controls around this.

Re: Ask HN: How does my Instagram keep getting compromised?

#19

Someone at Facebook stealing your domain is quite an accusation. Assuming your domain was similar to your username/IG handle, wouldn't it be more likely to be people wanting your "china" domain for spam/malware/propaganda/etc?

Not really. It already happened several times since short usernames go for crazy amounts.
Post reply on HN