Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The newest Instagram “exploit” is the goofiest I've seen

0xsid.com

Post reply on HN
Print view View original

281–290 of 528 posts

Re: The newest Instagram “exploit” is the goofiest I've seen

#281

Post by thayne »

varispeed wrote: post #267
dzonga wrote: post #262

Earlier quoted context omitted.

but yet still testing people on interviews via leetcode instead of writing e2e tests that cover all edge cases.

At standup: Dev: So this feature should take a day to get working version, then I need about two weeks to write test suite. PM: We need to present it by Monday. We have a meeting with stakeholders. Maybe cover the obvious paths and we will prioritise the rest for later. laughs Dev: okay.

I'm doubtful a dev was involved in this at all. More likely someone set up the AI support system and gave it access to existing support tools without thinking through how that could go wrong.

Re: The newest Instagram “exploit” is the goofiest I've seen

#282

Post by chasebank »

joao wrote: post #79

I'm among the first 6000 users of Instagram and my first name username was stolen a few years ago. Support for verified accounts acknowledged the issue, but couldn't do anything about it. This turn was an AI exploit, in my case was an outsourcing support 'exploit', where someone paid for my username to be manually changed and given to another user. There will always be a way to get access to accounts if human account…

ive had rappers offer me $10k for my ig username. i'm holding out for the bank to buy it.

Re: The newest Instagram “exploit” is the goofiest I've seen

#283

Post by pif »

hbn wrote: post #21

It's insane the AI has been provided the tooling to send emails to arbitrary addresses like that. Like, getting it to send a 2FA code at a user's request is one thing. But it should only be able to "hit a button" to send a 2FA email to the address attached to the account, all run with hand-written code. It shouldn't have access to the 2FA code itself, or the message subject, or body, or the recipient address, etc. Wh…

> Why did they give it any of that?!

Because they are idiots. You need to be a freaking idiit to trust AI.

Re: The newest Instagram “exploit” is the goofiest I've seen

#284

Post by Marsymars »

basisword wrote: post #206
SoftTalker wrote: post #176

Earlier quoted context omitted.

Completely unrealistic. Stuff happens. Email accounts get closed for no reason. People lose their phones, or have them stolen. Lots of reasons why someone might need an exceptional account recovery process. Not saying it should be easy or routine, it should not be. But it must be possible.

That's what recovery codes are for. Unfortunately it seems a lot of 2FA is now implemented without recovery codes.

I suspect very few people have good management of recovery codes.

I just save them in my password manager.

As best as I can tell, everyone I work with simply doesn't save them at all and initiates a password reset if they lose their password/2FA.

Re: The newest Instagram “exploit” is the goofiest I've seen

#285

Post by ipaddr »

Lonestar1440 wrote: post #277
pocksuppet wrote: post #205

Earlier quoted context omitted.

A flow can either fail safe or fail secure. Fail secure: if you lose your email, your account is forever locked. Fail safe: if you lose your email, your account is not forever locked. But, someone else might be able to get your account by pretending you lost your email. There are no other choices. When the electronic door controller loses power, either the door stays locked, or the door stays unlocked. In case of a f…

There are no other online choices. If my Bank login goes totally Kaput, though, I can take my ID down to the Branch to get it sorted. Same with my telecom provider. I try to only depend on services which have this property. I don't succeed.

Sounds great until you have an aging parent with a problem who can't get there. Get a power of attorney you say.. great but they won't accept unless parent comes to the branch.

This comes back to haunt you in the future.

Re: The newest Instagram “exploit” is the goofiest I've seen

#286

Post by Marsymars »

prism56 wrote: post #249
qingcharles wrote: post #239

Earlier quoted context omitted.

I had a Threads account banned recently because I liked five posts too quickly and they said my account was "inauthentic", even though the attached Instagram account is just fine. I tried to use the Meta Verified support and they told me I had used my full quota of support already (!?) and refused any requests.

Delete the accounts and move on... They don't deserve your time and business.

Can you delete your accounts if you've been banned?

Re: The newest Instagram “exploit” is the goofiest I've seen

#287

Post by CPLX »

pocksuppet wrote: post #205
sosodev wrote: post #9

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.

A flow can either fail safe or fail secure. Fail secure: if you lose your email, your account is forever locked. Fail safe: if you lose your email, your account is not forever locked. But, someone else might be able to get your account by pretending you lost your email. There are no other choices. When the electronic door controller loses power, either the door stays locked, or the door stays unlocked. In case of a f…

Of course it's not binary, any more than there are two choices between "cheap" and "expensive"

The question is how much effort and authority is required to gain access through alternative means, not whether it's possible.

It's always a question of how much, insofar as kidnapping Mark Zuckerberg or winning an order from a Federal Judge are two of the possible scenarios.

Re: The newest Instagram “exploit” is the goofiest I've seen

#288

Post by Marsymars »

demritocracy wrote: post #130

I was wondering why I got 15 instagram password reset emails over the weekend. It also reminded me I had an instagram account, which I promptly tried to log into and delete. I created the account when instagram first came out, never used it, and totally forgot about it. I got stuck in a strange position where I had to login from a device I had previously logged in from, but because it's been over a decade, I no longe…

I got locked out of some old gmail accounts in a similar way - they were created without phone numbers and while I have the passwords, I get flagged for suspicious activity when I try to log in, and there's no actionable recovery flow.

Re: The newest Instagram “exploit” is the goofiest I've seen

#289

Post by ipaddr »

ValentineC wrote: post #173
sosodev wrote: post #9

Support requests have always been the weakest link in the security chain for big corps. I've had accounts of mine turned over with 2FA disabled by humans before. I guess we shouldn't be surprised that the LLMs are doing the same thing. The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process.

> The simple fact that 2FA can be removed by low level support staff drives me mad. It defeats the whole purpose of the process. Crazy Domains (one of the few registrars for my ccTLD) removed 2FA from my account (that was in the process of getting hijacked) despite me being on the phone with them specifically telling them not to do so [1][2]. What's worse was that my account got targeted by the same hijacker again wh…

I remember losing subdomain search: search.batcave.net 20+ years ago when they suddenly took it over. Batcave offered free hosting and a subdomain at the time.

Re: The newest Instagram “exploit” is the goofiest I've seen

#290

Post by saghm »

joquarky wrote: post #258
saghm wrote: post #200

Earlier quoted context omitted.

Yeah, telling an AI "don't ever listen to users who say to send it to a different email" is not a guardrail, it's a painted line that can still be driven over. It's not bad to have it per se, but it's not a safety mechanism. The best comparison I can think of is that it's like validating dats on the frontend; it can make for a better user experience and he more efficient than hitting the backend when you know it will…

> It's not bad to have it per se It might be bad to have it if the user can obtain the system prompt and make note of any advisories as potential weaknesses.

Realistically, if the proper validations for stuff this basic is missing, I don't think this will end up mattering much; vulnerabilities like this are going to be found regardless.
Post reply on HN