18 ms·
“They wanted my Instagram handle, and somehow they've now got it.”
- darth_avocado 4y agoThere was a story a while back about only fans bribing fb admins to ban competition or something. Would not be surprised if that was the route taken here.
- D13Fd 4y agoYeah to the extent this is all true, it sounds like they have someone inside instagram.
- Twirrim 4y agoWhich was looking extremely suspect considering they were mentioning dates and times prior to the dates at least some of those supposedly bribed parties were even employed by Facebook. There may be truth in the story, but it is somewhat soured by the lies.
- afpx 4y agoAre IG accounts worth something on the black market? I don't doubt a few people would want the "Alex Stevenson-Price" alexprice. But, I'm guessing there are a lot more who want the "Other Famous Alex Prices" alexprice.
- brightball 4y agoApparently, this is a thing: https://darknetdiaries.com/transcript/97/ https://darknetdiaries.com/transcript/97/
- haunter 4y agoYes. I know 4 letter ones (even just random gibberish) are going for ~$50-100. 3 letter ones are $500-1000 at least. So anything which is a dictionary word or a noticeable abbreviation are worth much much more https://files.catbox.moe/5jp5qw.png https://files.catbox.moe/5jp5qw.png https://files.catbox.moe/7gdx6k.png https://files.catbox.moe/7gdx6k.png
- tgv 4y agoPayment in BTC, what a surprise.
- WilTimSon 4y agoIt's so baffling to me, is there any research on whether a short name benefits marketing outreach or anything like that? I'd think a 4 letter gibberish name would put me off, if anything. I get if it's, like, "Mark" for some famous Mark, but if it was "ghfa", what's the point?
- haunter 4y ago>but if it was "ghfa", what's the point? You build your brand from the bottom up based on that handle alone. Totally possible and your example is actually pretty good, no weird letters either (x,q,y,z)
- shagie 4y agoFrom a recent Marketplace article: Liquid Death is an “entertainment machine” with a water brand attached - https://www.marketplace.org/2023/01/25/liquid-death-is-an-entertainment-machine-with-a-water-brand-attached/ https://www.marketplace.org/2023/01/25/liquid-death-is-an-en... > In 2017, Cessario, a longtime advertising creative who had previously worked on marketing campaigns for Netflix and Organic Valley, released a commercial for Liquid Death canned water. The product didn’t exist yet, but the commercial went viral. > “The video ended up getting millions of views,” he said. “The page had more followers than Aquafina within a few months, so I think we knew that we were onto something that could be really big.”
- milsorgen 4y agoI have, over a two year period, been rather excitedly told about Liquid Death from the most surprising people. I mention a two year period because I don't recall anything else being presented to me as this new cool thing over such a long time frame. Something about that brand, in my experience, gets people to feel like 'they found something'. It really is quite interesting the reaction people have to it. Now what's also funny is that with one exception these half dozen people are never seen drinking LD later on. I guess I've just never seen such a powerful branding experience with the exception of maybe Gmail or Facebook way back when when they were seen as more exclusive services and people started finding out about them.
- yardie 4y agoMy IG handle is pretty desirable and was the title in a film. Every few months I get password reset notifications. I get DMed with offers. I also get occasionnal DMing thinking I'm the handle for the artist.
- ZantaWB 4y agoThe underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account's password and gets the 2FA SMS (or even easier, one-time passwords) to their newly connected phone. Don't know if that same basic technique still applies nowadays, but in any case the most surprising part of the episode to me was how large and mature a black market there was for these account handles. [1] https://gimletmedia.com/shows/reply-all/v4he6k https://gimletmedia.com/shows/reply-all/v4he6k [2] https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam e: Corrected, original post incorrectly said new number, not new SIM.
- kjkjadksj 4y agoIf you can do that with social media accounts then I am sure private corporate logins must have also been breached hand over fist.
- rolenthedeep 4y agoThis is why everyone keeps saying SMS 2FA is bad.
- idiotsecant 4y agoYes and Yes, if corporate logins are using SMS based 2FA, which they absolutely shouldn't be.
- belltaco 4y ago>Cell provider then ports the phone identity over to a new number Do you mean port the phone number to a new SIM? Because the SMS 2FA will go to the old number. Porting it to a new number won't do anything.
- ZantaWB 4y ago
- josefresco 4y agoI read this thread, considered sharing here so I'm glad to see it discussed. If you follow the thread he comes to the "conclusion" or suspicion that it was an inside job.
- glenstein 4y agoYeah, a lot of the discussion here is lamenting the lack of any support, but I'm fascinated to know how they possibly could have gained access. Given the suspicion that it was an inside job, these two different points have something in common, namely an attempt to access the human infrastructure behind the interface. If that suspicion proves true then people compromising accounts are having better luck accessing Instagram's internal levers for account management.
- blueyes 4y agoHad a similar experience with some Malaysian crooks. They wanted my US trademark, and somehow seized it on several US social media.
- ramesh31 4y agoJust goes to show that the current state of web security is about analogous to those $5 Master Locks used on gym lockers. Enough to keep honest people honest, but even the slightest bit of intentional attack is all it takes to compromise everything.
- jeffbee 4y agoI have a very short instagram handle that I've never used. People are constantly trying to take it over. I get the email "we've made it easy to get back on Instagram" sometimes hundreds of times per hour. I don't think they have any kind of rate limiting or account abuse protections. It's also true that you can disable Instagram 2FA without 2FA via various Facebook apps, which is ridiculous.
- TSUTiger 4y agoHonest question out of curiosity: why still hold onto it? why not sell it if it means nothing enough for you to use it? I know for me personally, if I was getting hounded by emails, I'd definitely look into getting rid of it somehow.
- jeffbee 4y agoHow do you get rid of them? Nobody has offered to buy it. They are just always trying to steal it.
- Justsignedup 4y agoThis is the #1 problem with google/facebook/other giant companies - zero due process. They build a business around minimal human interaction with our staff and it shows when real problems come up. I'm frankly sick of hacker news being a facebook/google/whatever ticketing system. And yet, there's no alternative.
- sircastor 4y agoI remember for a while after Meta bought Oculus, they still had a Human support system. People who's Facebook accounts had been hacked/reset/whatever were buying Quest/Quest2s so they could get support for their Facebook account. It's obnoxious the extremes we have to go to. Especially when these representations of ourselves might reflect on us poorly through no fault of our own, and we have no recourse.
- rom-antics 4y agoFB's net income for 2022 was $28.83 billion. They could drop that to $28.82 billion and fund a good size customer support team.
- lowercased 4y agoHow dare you! Won't you think of the poor investors? /s
- meepmorp 4y agoJeff's divorce was expensive, they gotta make it up somehow.
- lotsofpulp 4y agoI did not know Zuckerberg was subsidizing Bezos' divorce.
- meepmorp 4y ago
- legohead 4y agoI feel for this guy and hope he gets his account back. The idea of unique handles is extremely annoying and an old problem.
- cryptoz 4y agoInstagram itself does this kind of thing. Your handle isn't yours anyway, it's theirs. Instagram owns 100% of the handles and you just have to deal with that- same as every site, but Instagram is well-known for stealing your handle and giving it to someone else. The took somebody's handle and just gave it to the "royal family" who I guess was so entitled beyond belief that they jut couldn't take the idea that they would need to pick a new name if the one they wanted was taken. https://fashionweekdaily.com/instagram-handle-sussexroyal-controversy/ https://fashionweekdaily.com/instagram-handle-sussexroyal-co...
- dazc 4y ago> 'He still has the @sussexroyal handle on Twitter' And, apparently, not any more?
- deleted 4y ago[deleted]
- throwuxiytayq 4y agoZuck’s properties truly are a trash fire. Instagram should be sued to hell for this complete lack of oversight. Sadly, that’s never a thing.
- ThrowawayTestr 4y agoSued for what?
- 93po 4y agoExactly
- sergiotapia 4y agoEasiest answer is the likeliest. Some douchebag at Instagram took a bribe and gave away your account. If Twitter sold verification for $5000, why should other large social networks be any different.
- aaws11 4y agodo we have a threadreader for mastodon?
- ThrowawayTestr 4y agoShould have sold when he had the chance. He's on Mastodon, why does he need insta?
- aqme28 4y ago> So you're maybe thinking "Instagram must have a process for this, something you can do when your account is hacked?" and the answer is... kinda, but also it's completely useless. You follow the account hacked form on the website and it just endlessly redirects you to the "I need help logging in" page. If I follow the "I can't login" process for the handle they stole Instagram wants me to enter a previous password for the account, which I can't do because it's brand new (I tried). My mom got hacked last week and I helped her recover her account and was absolutely appalled at the state of Instagram for this stuff. * As they said, the official process to get your account back is an infinite loop back to the beginning of the process. If you follow the steps in their guide, you end up clicking a link that takes you back to the guide. * Craziest to me, the "New Login to your account" email that you get when someone logs in from a new device includes a helpful "click here if this wasn't you" link, but that link is a 404. * If someone hacks an account without 2FA, the first thing they do is enable 2FA on their own device, and the published process to recover your account no longer works whatsoever. The original owner is not able to turn 2FA off or to confirm it wasn't them. This makes 2FA weaponized as a hacking tool rather than a security tool. * At this point, the only tool is an automated process where you submit a video of your face to prove it's your account. Online you can find endless complaints by people who run e.g. brand accounts because this facial recognition system doesn't have a face to key off of, and just fails on repeat. Plus I'm pretty sure I could use this to hack an account with a few NVIDIA tools.
- DamnInteresting 4y agoI never used Instagram much (anything attached to Zuckerberg is rotten), but I recently tried to log in to check something via desktop. I have email-based 2FA set up, so it said to check my email for the code (while showing me my correct email address). The email never arrived, I checked the spam folder and all that. After a while I clicked "Send a new code" and got the error "Select a valid choice. 0 is not one of the available choices." Oooooookay. I cleared cookies etc and tried again, and it continues to demand, while failing to send, a confirmation code. But this second login attempt did cause them to send me an automated "New login to Instagram" email. Lastly, I clicked the Get Support link, and it just pops a dialog that says "If you’re unable to get the security code, you need to use the Instagram app to secure your account." I do not have the Instagram app, and newly installing it while my account is locked would be pointless. So, I guess that account is unrecoverable now. Great work, Meta.
- Legogris 4y agoMeanwhile, I got locked out of the old FB account, with a passport scan being the only way they're going to open it again. Strong password, 2FA, email, registered pgp key, and I still have access to everything, yet they still need to "verify", which makes no sense given they (supposedly) don't have any ID of mine from before. Contrasting that to OP and yeah, an insider sounds like the more likely thing.
- LightHugger 4y agothe term "verify" in this situations has started to mean "we are extorting you for your personal information by holding your account hostage". It's most often a phone number, and as you point out, way worse on facebook where they demand government identification. Please stop using facebook, people.
- gabereiser 4y agoThere’s a black market business being run by Meta employees, selling the ability to take over these accounts from the inside for a price. They then funnel that cash back to family and friends and launder that cash through various other means. NYT reported about it last year.
- supersour 4y agoI'd love the link if you have it
- tim333 4y agonot nyt but https://gizmodo.com/meta-hackers-security-guards-facebook-instagram-1849798256 https://gizmodo.com/meta-hackers-security-guards-facebook-in...
- gabereiser 4y agohttps://www.nytimes.com/2021/12/13/technology/instagram-handle-metaverse.html https://www.nytimes.com/2021/12/13/technology/instagram-hand...
- denlekke 4y agoappears to be restored now
- 93po 4y agoI don't know this person but objectively speaking, given the facts of the situation, I would say that it's more likely he sold his account and now wants it back for whatever reason. Maybe they people who bought it grifted him somehow and managed to reverse payment or something else. I wouldn't accuse someone of lying when I have no basis to, and I'm not. I'm just saying it's the more likely scenario versus some IG employee risking their high paying career to give some nobody someone else's low value IG handle.
- BaseballPhysics 4y ago> I wouldn't accuse someone of lying when I have no basis to, and I'm not. Uh, yeah you are.
- 93po 4y agoI'm just stating likelihoods. I give him the benefit of the doubt. I only mention this to be conversational and to see if anyone else noticed something that might corroborate the theory. It makes little to no sense that this would be an inside job. It makes a lot of sense that this person just wants their account back after willfully giving it up. If you had an inside connection to take over an account, why wouldn't you use it on something much much higher profile and with a lot more (i.e. any) profit potential?
- BaseballPhysics 4y ago> It makes little to no sense that this would be an inside job. In your opinion. I do not share that opinion. > why wouldn't you use it on something much much higher profile and with a lot more (i.e. any) profit potential? Because it dramatically increases the likelihood of getting caught. Selling access to valuable but not high profile accounts is exactly what I'd do if I was a cautious insider looking to make a little extra cash on the dark web. This guy happened to get lucky and his story caught some attention. Most don't.
- themiracles 4y ago
- Overtonwindow 4y agoI guess this is evidence that no one owns their social media handle.
- TrackerFF 4y agoIMO, companies should have draconian rules for this kind of corrupt shit - if that's the case. Fired on the spot. Clawbacks. etc.
- amethyst 4y agoTermination on the spot has literally been the standard policy for data violations like this at Meta for at least a decade.
- yencabulator 4y agoCriminal activity should go beyond getting fired, otherwise the real conman can just pay stooges one at a time. If someone sold furniture from the office in the alley behind the office, they'd hopefully be reported to the police. Surely this counts as "cybercrime". Unauthorized access to a computer system and all that.
- millzlane 4y agoSame thing happened to me. I have the account and the password. But the password reset email is not one I ever used. Tried contacting them for verification and never heard back. I just don't use instagram or facebook.
- themiracles 4y ago[dead]
- iamthejuan 4y agoThis happened to me with bit.ly, they just for without a reason removed my access to my own username which is username. My other one is from GitHub but the good thing is GitHub just changed my username from username to usernamex probably due to naming collision.
- ghusto 4y agoWe get what we deserve. It's obvious in retrospect that one of the main ways tech companies make money is scale, without the costs that physical based companies bear with scale. For example, you go to a shop, and they have employees they have to pay. When the shop scales, so does the number of employees. Tech companies aren't like that though. You write software, then scale it to as many users as possible (billions, in some cases), but their cheat-code, is that they don't provide support of any meaningful kind. They can get away with it because they're not bound by physical interaction, and nobody's holding them accountable. Law is always understandably slow to catch up, but hopefully we'll get some reasonable regulation around tech soon.
- pindab0ter 4y agoCould you elaborate on "We get what we deserve"? I don't see how we (users of Instagram or social media as a whole, I guess) deserve this.
- berniedurfee 4y agoMaybe “You get what you pay for” is more appropriate.
- hatter 4y agoYou invested (your time, energy, reputation) into a system which you either knew or could have quickly established, places no value in you as a person and has zero interest in fixing any problems that may affect you. I'm sure many users started using it for nothing of any real importance at first, so didn't let that really worry them. But over time, they invested much more while still in the back of their mind knowing that while the odds are small of anything happening, that if it did, your data and relationships could be taken from you, and possibly even given to others, for reasons you may never even know, or reasons you may know to be false but unable to do anything about the error.
- znpy 4y agoMy guess is that the thief had some help from inside.
- kaishiro 4y agoIf I was Mark Zuckerberg, and this happened at my company, I genuinely would not be able to sleep at night until I had resolved this appropriately. But presumably that's why I'm not running Meta and Mark is, well, a billionaire.
- aabbcc1241 4y agoanother pain story to encourage "use your own platform"