Live data from Hacker News

Ask HN: How does my Instagram keep getting compromised?

news.ycombinator.com

21–30 of 118 posts

Re: Ask HN: How does my Instagram keep getting compromised?

#21

Someone at Facebook stealing your domain is quite an accusation. Assuming your domain was similar to your username/IG handle, wouldn't it be more likely to be people wanting your "china" domain for spam/malware/propaganda/etc?

I think the stealing of my domain was a bit of social engineering by a hacker (not somebody at FB).

Now, my account gets taken without any noticeable trace on my end. No security emails, no suspicious login attempts, nada...

Re: Ask HN: How does my Instagram keep getting compromised?

#22
post #7

Earlier quoted context omitted.

Interesting, do you have any links to that end?

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

How do valuable usernames 'become available'? Like the person deletes their account?

Re: Ask HN: How does my Instagram keep getting compromised?

#23

Have you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

I haven't yet... so far I have always been able to get it back via a friend at FB.

Re: Ask HN: How does my Instagram keep getting compromised?

#24
post #9

Your situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently. In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it. Be safe! [0] https://darknetdiaries.com/episode/106/

I'll have to listen!

Re: Ask HN: How does my Instagram keep getting compromised?

#25
post #7

Earlier quoted context omitted.

Interesting, do you have any links to that end?

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

If you could post before / after screenshots showing proof of this theft somewhere - along with the real-world names of these employees -- that might get a lot of eyeballs.

Re: Ask HN: How does my Instagram keep getting compromised?

#26
post #23

Have you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

I haven't yet... so far I have always been able to get it back via a friend at FB.

Get on record with law enforcement and state legal reps. Unauthorized authorization is a federal crime, and a paper trail is crucial for seeking recourse.

Re: Ask HN: How does my Instagram keep getting compromised?

#27
post #9

Your situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently. In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it. Be safe! [0] https://darknetdiaries.com/episode/106/

Here's another podcast episode about it, and I remember it being really really good. They actually befriend a scammer who is pretty open about how it works:

https://gimletmedia.com/shows/reply-all/v4he6k

Re: Ask HN: How does my Instagram keep getting compromised?

#28
post #12

What devices are you using the account on? If it's on a desktop browser, my assumption would be that you've got malware. That allows them to trivially steal the session cookies, steal the passwords the next time you log in, steal any device identification cookies that are used to control not using 2FA on logins from trusted devices / sending new device notifcations, and also hijack your recovery and notification emai…

99% of the time I am on an iPhone, the other 1% (which is generally right after I have been hacked) is on a fully updated MacOS install.

Re: Ask HN: How does my Instagram keep getting compromised?

#30
post #9

Your situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently. In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it. Be safe! [0] https://darknetdiaries.com/episode/106/

Reply All also did an episode about this a few years back.

https://gimletmedia.com/shows/reply-all/v4he6k

tl;dr There's underground marketplaces where shady people buy and sell OG usernames for money, which creates an incentive for shady people to steal them from the original owners.

Post reply on HN