Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

161–170 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#161

Post by SoftTalker »

giancarlostoro wrote: post #147
sosodev wrote: post #9

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.

The fact that if your account has had the SAME EMAIL AND NUMBER FOR 14 YEARS OR MORE and support still thinks you got hacked is more embarrassing to me.

I used my work email for everything for 14 years, now I'm retired/fired/laid off and I can't access it anymore and I forgot to change the email linked in my Facebook account.

Re: The newest Instagram “exploit” is the goofiest I've seen

#162

Post by fn-mote »

toomuchtodo wrote: post #31
macintux wrote: post #27

Earlier quoted context omitted.

I’d wager your range of tech literacy/capabilities for your firm is much narrower than big tech.

Range != value, depending on use case. Doing more poorly does not make something better. Our customer identity capabilities are very close to login.gov (we don't have to support hundreds of agency customers and common access cards), and if its good enough for ~342M Americans, its good enough for our customer base. Broadly speaking, work for the sake of work is not valuable work. Show me outcomes for resources and tim…

> [login.gov] if its good enough for ~342M Americans

I am very curious about the actual number of users of login.gov.

I am a US citizen and my experience was … negative to the point of actively avoiding it.

Re: The newest Instagram “exploit” is the goofiest I've seen

#164

Post by ValentineC »

basisword wrote: post #86
sosodev wrote: post #9

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.

>> The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process. The fact it can be removed by anyone is the problem. If you lose access to your 2FA (and recovery codes) then you should lose access to your account. Having it removable by anyone (other than a logged in account holder) defeats the entire point.

> The fact it can be removed by anyone is the problem. If you lose access to your 2FA (and recovery codes) then you should lose access to your account. Having it removable by anyone (other than a logged in account holder) defeats the entire point.

At least make it a major pain in the ass to recover like AWS, which requires some kind of notarised identity verification [1].

[1] https://news.ycombinator.com/item?id=13122723

Re: The newest Instagram “exploit” is the goofiest I've seen

#165

Post by [deleted] »

SoftTalker wrote: post #161
giancarlostoro wrote: post #147

Earlier quoted context omitted.

The fact that if your account has had the SAME EMAIL AND NUMBER FOR 14 YEARS OR MORE and support still thinks you got hacked is more embarrassing to me.

I used my work email for everything for 14 years, now I'm retired/fired/laid off and I can't access it anymore and I forgot to change the email linked in my Facebook account.

[deleted]

Re: The newest Instagram “exploit” is the goofiest I've seen

#166

Post by [deleted] »

acdha wrote: post #36
spullara wrote: post #11

Earlier quoted context omitted.

recovery is always the weakest link in any authentication system

This is not wrong but what’s really missing is cost: Meta did this so they can avoid paying people to do it. Lots of companies follow that decay spiral: your bank could shut phishers down cold by requiring wire transfers to be authorized in person but they don’t want to pay staff or risk you being upset by a transaction taking an extra hour so they don’t. Imagine an alternate universe where big tech companies worked…

[deleted]

Re: The newest Instagram “exploit” is the goofiest I've seen

#167

Post by fn-mote »

harikb wrote: post #153

Why isn't there a middle man service to do IRL verification. Like - account is locked, you must use 2FA backup codes. Else go to western union / 7-eleven / super-market, show ID proof, pay $10 for recovery service. Wait 2 days (of someone not clicking on this-was-not-me) If account is already hacked - pay $100 for expert support

With a lot of care for the details, otherwise you just made account hijacking possible for $20.

Those 7-Eleven & Western Union jobs are very low wage in the US (if not worldwide?). Cheaper than paying an insider to do something for you.

Your assumption that the target is going to respond within two days is pretty fast. There’s a lot of details and they will all be attacked / exploited in any standard workflow.

Re: The newest Instagram “exploit” is the goofiest I've seen

#169

Post by prox »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

This sounds like it was “designed” by an actual idiot. Maybe vibe coded on a Saturday.

Re: The newest Instagram “exploit” is the goofiest I've seen

#170

Post by rozab »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

The reason all these meticulously designed flows have been done away with is because some manager believes that AI is omniscient and can just replace it all.

Like, flagging VPN endpoints is bread and butter for this kind of thing and must already exist. But it's been bypassed

Post reply on HN