Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

211–220 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#211

Post by pocksuppet »

demritocracy wrote: post #130

I was wondering why I got 15 instagram password reset emails over the weekend. It also reminded me I had an instagram account, which I promptly tried to log into and delete. I created the account when instagram first came out, never used it, and totally forgot about it. I got stuck in a strange position where I had to login from a device I had previously logged in from, but because it's been over a decade, I no longe…

Never delete an account in protest of not liking a company, when you could instead give it away to a spam operation, which hurts the company even more.

Re: The newest Instagram “exploit” is the goofiest I've seen

#212

Post by varenc »

> The first proper zero auth password reset I've seen in production.

In 2011 Dropbox briefly had an even easier "zero auth exploit". For a couple hours if you typed in any email on the login page, password checking was skipped and you could login to any account. Albeit, you still couldn't reset the user password, just login.

https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...

Re: The newest Instagram “exploit” is the goofiest I've seen

#213

Post by alex1138 »

nashashmi wrote: post #61
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

Some Jr engineer got tired of handling stupid support requests and automated the job with an agent. That’s how. Assigning Jr engineers for security support is ridiculous partly because young people don’t understand how critical security is sometimes. And partly because they don’t value privacy as much.

...yeah, but its CEO is also who he is. The guy who refers to people using his products as "dumb fucks". That's kind of important

Re: The newest Instagram “exploit” is the goofiest I've seen

#214

Post by queenkjuul »

smrtinsert wrote: post #201
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

It's stuff like this that honestly makes it very hard for me to take anyone working at Meta seriously. How much communication had to happen to enable this feature? It really casts doubt across the organization at multiple levels, don't tell me a single engineer caused this.

I can't take Meta seriously, period.

Re: The newest Instagram “exploit” is the goofiest I've seen

#215

Post by ventana »

asdff wrote: post #128
ventana wrote: post #71

Earlier quoted context omitted.

I see no difference between X and Instagram in this regard whatsoever. Think NASA, for example; it's also a government agency, and they are doing great job posting photos in Instagram, do you think anything is wrong with it?

It is just bizzare when you take a step back and remember the world 20 years ago. NASA would just post directly to their own website. Of course they would. Now imagine you go back in time 20 years ago and say "What if we took all these images you are providing for the public on their dime, compressed the hell out of them, and served them in this for profit proprietary marketing/propaganda app instead?" Engineers in 2…

I feel that this is somewhat orthogonal. Yes, some questionable things have happened that made the ways how people exchange information be controlled by a handful of corporations.* But for NASA specifically, this is not relevant. They were not the ones who forced people to go to social networks; they needed to go there because this is where their audience was.

* On that note, and for the sake of the argument, I would say that the years of free uncontrolled information exchange in the Internet can probably be considered an exception. Information exchange was always controlled by governments and businesses (e.g. TV and newspapers) before, just as it is now. The fact that you or I don't like it does not change that this is how it used to be before the Internet appeared as a "free space". My generation was lucky to see how great the world with free information exchange could be, but I don't have much hope that it would stay like that for long.

Re: The newest Instagram “exploit” is the goofiest I've seen

#216

Post by thedelanyo »

dpark wrote: post #43
hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

This exploit has essentially nothing to do with AI and everything to do with a terribly designed account recovery flow. This exact same flow could have been (and may have been; I don’t know how much the chatbot here actually does) statically coded.

Account recovery (forgot password) doesn't actually require human or Ai in the loop?

I mean this particular auth flow has been a well-known pattern, even before Ai came along.

I guess the only way they got away with this is due to the Ai in the loop. They kind of social (artificial) engineered the Ai, which prolly overlooked the well-known password recovery pattern.

Re: The newest Instagram “exploit” is the goofiest I've seen

#219

Post by lenerdenator »

pocksuppet wrote: post #209
jubilanti wrote: post #171

Earlier quoted context omitted.

Sue who? Meta? You "consented" in the Terms of Service to waive your right to a trial and only get forced arbitration by an arbitrator of Meta's choosing. Sue the anonymous person who stole your account and sold it to someone else, who is probably nowhere near your jurisdiction? Good luck.

Clickwrap terms of service are worth the paper they're printed on. You may still be able to sue.

At which point you are going to be competing in court with a company that has a current market capitalization of $1.6 trillion dollars.

Re: The newest Instagram “exploit” is the goofiest I've seen

#220

Post by lenerdenator »

hennell wrote: post #208
avnfish wrote: post #7

The implications of this are quite unsettling. Meta gave an agent privileged read AND write access to user accounts with no human in the loop?

Can't fire the humans you keep them in the loop

Yeah but those humans want things like "pay" and "benefits" and "time off to sleep and use the bathroom".
Post reply on HN