Live data from Hacker News

'I want your Instagram account': a deadly campaign over coveted handles

businessinsider.com

51–60 of 164 posts

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#52
post #39

Instagram and Twitter afik the only social media sites that have valuable handles

People routinely try to get HN ones, albeit by politely emailing.

Out of curiosity, what's your policy in these situations?

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#53
post #49
post #47

Earlier quoted context omitted.

That was nice of you, you probably could've kept the money and there isn't much they could've done. Ask me how I know :( PP money was not recoverable that one time my ex sent it to the wrong email address.

Paypal has a "reverse charge" button. You should be able to cancel any payment within a reasonable timeframe.

Must be a newer feature, this was back in 2014 and there was no button.

Thankfully it was only $500 bucks or so, not $45,000.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#54

I can't imagine these people are that untraceable. If they are dumb enough to reach out to the victims, finding them should be doable with a bit of luck.

They are traceable, but generally nobody bothers to actually trace them. On top of that, most of the people who would be charged with the task to do this are somewhat out of touch with how the (digital) world works.

I'm curious to see how laws and law enforcement around the world actually perceive this, especially considering the very different ways in which things like order bombing or swatting exist/don't exist in various countries.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#55
post #26

I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.

> Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves. I have this problem also! I thought it was rare. In my case I think the person is very bad with computers and doesn't know what their email address is. I've gotten emails from their bank, cell phone, and even online dating. I tried ma…

my gmail is my @gmail.com

It's not a super-common lastname, but there are probably several hundred people with it in the US.

I get all sorts of email for people whose address is some variant of it, like @gmail.com. I've gotten plane tickets, paypal payments, cancer diagnoses, Bar Mitzvah and Wedding invitations, college transcripts, all sorts of personal information.

In many cases, I don't think it's the fault of the person with the email; I think they give their email as "firstname.lastname@gmail.com" and some clerk just uses "lastname@gmail.com"

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#56

Easy solution: Assign all accounts a unique and randomly generated ID, and allow everyone to then use the handle they want. If someone wants to write a @handle in a post or a comment, a list shall appear, asking them to choose the account they wish to link to. IDs shall be public, and the list shall present itself as something like "@Max 36hf28bcd ; @Max 9jv1tcsh ; @Max b63avg960"

[deleted]

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#57
Wow. I have a 6 letter Instagram account handle that actually matches a popular (Western) name and initial out there. So far I get about one fairly polite request per month via DM to sell my handle to them, which I always decline, but lately I am seeing a rise in the number of 'password reset' emails I am getting from Instagram. It's gone from about one per week to sometimes 2 or 3 per day.

That fact, plus the stories in this article is making think of really closing off my social media visibility a lot more than it currently is.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#58
post #33

Earlier quoted context omitted.

could this be credential stuffing attempts? or just typos?

usually it is someone who has their email john.r.smith or similar and forgets they need the r There are other stories of people forgetting which company it was with (gmail vs yahoo) and even of google accidentally giving out emails with a period and then silently removing periods.

The Gmail domain will deliver email to an email address regardless of periods in the username. My email address is first name period middle initial period last name. I can a period between any letter, all letters or none and I can still receive it.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#59
post #44

I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.

Likewise I have no fewer than three people trying to use a gmail address I've had since 2003 as their own. It's extremely frustrating - one even sent me $45,000 in a mistaken paypal transfer and then when I reversed the charges I was hit with an overdraft since I had made a Paypal purchase (which would ordinarily come from my direct bank funds) not knowing the money had been sent to me in error. It shouldn't be this…

I have an old 7 letter gmail address, not an English word even but it must mean something in India and someone must have used it because for years I got eye-opening stuff, full color scans of national IDs, job applications, business proposals, invoices etc. At first I tried to send messages back explaining but in the end I just had to block it all, didn't have the time.

>It shouldn't be this easy to use someone else's email address.

This though, seems hard. I don't think this is a "security" thing per se (though I dearly wish there was a modernized "email" system built with modern crypto from the ground up). But for any sort of communications at all it seems like there is an inherent tension between how low friction one wants for the world to communicate vs protection. Like, there is nothing stopping anyone from doing a pure whitelist system for email right now. I even do in fact do that for a few accounts like specific ones for client contacts, only active client addresses will be accepted everything else is blackholed. Those obviously receive zero spam or misuse of any kind [0]. But obviously the tradeoff for that is no new potential clients could ever "cold call" it either. One could imagine technical solutions like "only accept stranger email from accounts with a signed ID" or "vouched for by known address" (ie, WoT) or "only address with a signed time token >N from providers X, Y or Z", or some kind of challenge/response, but all would have privacy tradeoffs, complexity, and still wouldn't inherently do anything about honest mistakes.

We could have more powerful options for this, but it'd still involve subjective tradeoffs between how open to new communications one wants to be vs cutting down on noise. No one right answer there.

----

0: Forged from fields are of course possible but in practice someone would at the least have to know which handful of the total planetary email addresses were whitelisted, never mind flags that show up in the headers from that

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#60
post #26

I remember getting a demand I surrender my HoTMaiL address to somebody in a very threatening email to my address way back in 1998. It was kind of surreal back then as the internet was still fresh. Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves.

> Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves. I have this problem also! I thought it was rare. In my case I think the person is very bad with computers and doesn't know what their email address is. I've gotten emails from their bank, cell phone, and even online dating. I tried ma…

I had some person's client email me regularly for years, which I ignored.

One day I decided to take action and sent a expletive filled email to them telling them that I was not the person they thought I was and to stop emailing me.

They then sent me an email telling me I was fired.

Post reply on HN