Live data from Hacker News

My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

news.ycombinator.com

251–260 of 262 posts

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#251

Earlier quoted context omitted.

What was your account? Can you prove it?

Instagram.com/chucky I have old password reset emails and probably some screen shots somewhere

Please post this on Medium and submit it to HN. I'd be glad to help this get seen.

You were robbed and deserve the handle back. And potentially compensation if an audit trail reveals an inside job.

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#252
post #221

Earlier quoted context omitted.

A nice illustration of Poe's law :) I'm pretty sure it's a joke :D https://en.m.wikipedia.org/wiki/Poe%27s_law

Yes I should probably be more careful with an /s on some things. But that also seems to defeat part of the purpose of parody, automatically signalling that you don't need to think more about what I'm saying because I already told you. Sort of like explaining a joke makes it not funny (most times), signalling parody or sarcastic intent seems to dull the pointy end of it. The most extreme will say "yes, this person get…

I've also been thinking a bit about that :-)

And, it's happened in real life that I said something sarcastically, without indicating this, instead assuming the others would realize -- and instead they thought I was crazy. Maybe my voice sounded too serious

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#253
post #212

Earlier quoted context omitted.

What do you mean? It’s not like a deepfake is a model that produces a new video from scratch in a completely random setting. It needs a base video to be modified. They need a video of a person talking to do the deepfake.

I think the issue is that there would be insufficient audio sources to generate new spoken language.

That is not an issue. You can generate new spoken language with not much more than a word.

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#255
post #225
post #223

Earlier quoted context omitted.

Be care with that! I've created accounts in the past with a 40+ random character password and everything went swimmingly. Until I tried to log in. Bzzzt! Couldn't get in. Apparently the password had a character limit that wasn't mentioned when signing up and was silently truncated server-side. A bit of investigation showed the had maxlength="20" which is only enforced when typing characters. When using Javascript to…

I've noticed my bank doing shenanigans in order to prevent password managers from working well. It appears to be JS scripts that uppercase or lowercase the input field after posting but before the browser saves it. So it perpetually looks like I'm updating my password when I'm not. It literally just got populated by the browser.

What is the deal with banks being actively hostile to password managers?

One bank specifically I have to deal with will:

- Not allow you to paste a username/password (ctr+c/ctrl+v, right click disabled)

- Lastpass autofill doesn't work

- If the page loses focus, both user/password inputs are cleared, you get to start all over.

There is also a very small subset of special characters that are allowed. If you do not reset your password as often as they'd like, you have to agree to waive any responsibility for any issues with your account before logging in.

SMS 2FA required, there's no other 2FA option.

After entering your 2FA code, the "proceed" and "cancel" buttons are the exact same shape and color and I've hit the wrong one multiple times, in which case there is also SMS 2FA cool down and you have to wait 15 mins to start all over again.

It's absolute insanity and every time I have to login its an adventure.

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#256
post #212

Earlier quoted context omitted.

I think the issue is that there would be insufficient audio sources to generate new spoken language.

That is not an issue. You can generate new spoken language with not much more than a word.

Sincerely: I’d love to hear an example of that.

The reason for my skepticism: The state of the art language pronunciation from the best this planet has to offer still requires a full phoneme library recorded in studio conditions. A voice sample taken from a user’s instagram page doesn’t seem like the kind of source material that would be useful to make convincing speech.

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#257
They deepfaked my wife yesterday. No idea where they got the video from but it looks 100% like her with a different voice actor. Its so frustrating that theyre using her likeness for a scam, and theres no way instagram can help. They changed our email and theres no way to recover her acct. We cant even get IG to delete it

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#258
post #213

Earlier quoted context omitted.

I'm not reading that they hacked/stole a gmail account. My understanding is that by taking over the account, they updated the associated email address used for contact within Insta. It just so happened that the email used by the attacker was a gmail account. >Testing auth from unexpected locations in advance seems like an easy way to get noticed. How many times we've received emails from online accounts notifying abo…

A friend of a friend went through this a while ago and I was called on to help. Insta was totally taken over and so I made her start going through the linked gmail account because there should be a message in there from insta about the details changes. Nope. You use the same password, don’t you. Yup. So it’s - access insta, change email, phone and password. Access gmail, delete notifications from Instagram, profit. I…

How did you get them to give it back? I cant find anyway to contact them

Re: My friends Instagram was hacked and deep-fake videos posted in less than 6 hours

#259
post #209

Earlier quoted context omitted.

I had a 3 letter as well. I was getting daily password resets for years and then one day it was stolen despite 2FA and a random 32-char password. No idea how they did it. I wasn't a heavy user and Instagram doesn't seem to offer any support so I just created another account and moved on.

Some sort of social engineering I guess :(

Considering that Instagram doesn't provide any support (that I can find, anyway), social engineering seems unlikely. Unless they found someone who worked at Instagram and somehow socially engineered them to transfer the account?
Post reply on HN