News for hackers. Stuff that matters.
Re:Someone has stolen my Instagram account by ipsum2 on Sunday September 27, 2020 @11:48AM (#24607510)
There's no evidence to back the user's claims. This sounds like "Hey my dad works at Xbox and will ban you". There are other ways to compromise an Instagram account, like sim swapping (https://krebsonsecurity.com/2018/05/t-mobile-employee-made-u...)
Re:Someone has stolen my Instagram account by WORLD_ENDS_SOON on Sunday September 27, 2020 @12:06PM (#24607673)
An interesting aspect to this story is that although there's no real evidence that a Facebook employee was involved, it still seems like a believable explanation to many readers including many commenters here. If a company's customer support is so bad that no one can tell the difference between being hacked and being abused by a rogue employee, does it actually matter what happened? I guess that it matters to the original poster, and I do hope that they do get their photos / account back, but in either case the message the message I'm taking away from the story same: your Facebook account could disappear tomorrow and you'd have no recourse.
Re:Someone has stolen my Instagram account by renewiltord on Sunday September 27, 2020 @12:53PM (#24608027)
Users here will believe any conspiracy theory so that's not really a high bar. I'm serious. There was that massive 2000 comment thread the other month about some big company doing something evil and then it turned out they didn't do it.

Everyone who was right and informed in the original thread was greyed out by users here.

Re:Someone has stolen my Instagram account by PragmaticPulp on Sunday September 27, 2020 @02:44PM (#24609113)
It's not conspiracy theories, it's any story about a big company doing something bad or evil. Or any story that confirms the worldview of the most active HN commenters.

Any story about Facebook, Instagram, Twitter, Google, Uber, or PayPal doing anything negative tends to bring out the most cynical commenters. HN is usually a skeptical crowd, right until a story arrives that fits their worldview.

The false story about Apple's refund policy that garnered 2000 upvotes before being retracted is a prime example ( https://news.ycombinator.com/item?id=23987584 ). When it was in the #1 spot, several people tried to correct the story in the comments. They were heavily downvoted. For some reason, the majority wanted to believe a random Twitter comment over actual iOS app developers trying to correct the misinformation.

Likewise, stories about psychedelics being miracle cures tend to rocket up the front page despite deeply flawed studies (no control group, usually). Meanwhile any study showing negative effects from psychedelics or cannabis tends to get picked apart for for small sample sizes or the evergreen "correlation is not causation" no matter how good the study was.

The real problem is assuming that HN is somehow immune from the same problems as other social media platforms. HN is very much a social media platform.

Re:Someone has stolen my Instagram account by apostacy on Sunday September 27, 2020 @08:12PM (#24611441)
> It's not conspiracy theories, it's any story about a big company doing something bad or evil. Or any story that confirms the worldview of the most active HN commenters.

> Any story about Facebook, Instagram, Twitter, Google, Uber, or PayPal doing anything negative tends to bring out the most cynical commenters. HN is usually a skeptical crowd, right until a story arrives that fits their worldview.

It's these companies that are cynical, not my worldview!

Nearly every single allegation about these companies doing something sneaky, evil, greedy, and underhanded has turned out be completely true.

When Uber was doing grey-balling, it turned out to be true. When Uber had made a secret agreement with Apple to have their app take screenshots in the background, that was true. Just off of the top of my head I can think of so many preposterous sounding incidents that turned out to be 100% true.

I would assert that people were completely correct to just assume that Apple was doing something shady with the app store. I think it is kind of naive to give Apple the benefit of the doubt at this point.

Re:Someone has stolen my Instagram account by classified on Tuesday October 06, 2020 @07:14AM (#24696541)
Absolutely. Being wrong in practise doesn’t matter at all as long as you’re right in principle.
Re:Someone has stolen my Instagram account by renewiltord on Sunday September 27, 2020 @03:53PM (#24609631)
Haha all too true. I say this as a user of psychedelics.

In any case, just for posterity, the actual event may well have happened, I'm just commenting on whether "HN believes it" has any impact on the truth of whether it happened or whether that company's reputation is shot.

Re:Someone has stolen my Instagram account by nrmitchi on Sunday September 27, 2020 @01:24PM (#24608306)
To be fair in that situation, despite the fact that it turned out that Apple didn't actually do the thing in question, it was explicitly in their developer agreement that they were entitled to.

Something is less of a "conspiracy theory" when there is explicit evidence written down in a contract that supports it.

Re:Someone has stolen my Instagram account by moralestapia on Sunday September 27, 2020 @02:54PM (#24609183)
It's not only a conspiracy theory. If you hear about the bully at school stealing someone's lunch, you would be inclined to believe it's true, even though you were not there at the time.

Plenty of abuse and mismanagement from these companies have affected a lot of people, to different degrees, and that sets a precedent over which we all subjectively evaluate their actions.

Just last month I had a Twitter account for a side gig banned for absolutely no reason and with zero explanation. I am more inclined to believe the "rich kid from LA" story than the "hack"/"sim swapping" whatever nonsense. Why? Because I see it happening all the time, everywhere.

Re:Someone has stolen my Instagram account by ayewo on Sunday September 27, 2020 @01:19PM (#24608242)
For anyone who missed it, here’s the original thread that made the false claim on Twitter that Apple keeps it 30% cut when a customer requests a refund: https://news.ycombinator.com/item?id=23987584

Here’s the follow up retraction: https://news.ycombinator.com/item?id=23995750

Re:Someone has stolen my Instagram account by JdeBP on Sunday September 27, 2020 @02:49PM (#24609150)
Re:Someone has stolen my Instagram account by Aeolun on Sunday September 27, 2020 @01:11PM (#24608164)
Maybe that’s because 90% of the time it turns out the company did do it?

I’d be interested in knowing what thread that was though.

Re:Someone has stolen my Instagram account by jonas21 on Sunday September 27, 2020 @06:33PM (#24610719)
It seems like most of the high-profile examples lately have either been false or misleading.

Just to check, I looked at all posts with over 1000 points in the past couple of months where a big tech company is accused of doing something "evil" to the little guy. They are:

--------

1. Tell HN: Never search for domains on Godaddy.com (1656 points) - https://news.ycombinator.com/item?id=24506303

The OP accused GoDaddy of registering a domain for itself after the OP had added it to their cart. It turns out that many people were searching for the same search terms and someone else just happened to register it via GoDaddy on the same day.

https://news.ycombinator.com/item?id=24523901

--------

2. Google is apparently taking down all/most Fediverse apps from the Play Store (1313 points) - https://news.ycombinator.com/item?id=24304275

The OP implied that Google was banning all Fediverse apps with no recourse for the developers. But it turned out that Google was asking developers to block logins to a set of unmoderated instances that are known to be full of hate speech. Some developers refused, but it seems like most did not, and are doing just fine.

https://play.google.com/store/apps/details?id=com.keylesspal...

https://play.google.com/store/apps/details?id=jp.juggler.sub...

--------

3. When a customer refunds your paid app, Apple refunds its 30% cut [edited] (1243 points) - https://news.ycombinator.com/item?id=23987584

The original title and tweet said that Apple keeps the 30% cut. The author turned out to be misinformed.

https://twitter.com/twolivesleft/status/1288625617873694721

--------

Re:Someone has stolen my Instagram account by jhardy54 on Sunday September 27, 2020 @01:16PM (#24608216)
> There was that massive 2000 comment thread the other month about some big company doing something evil and then it turned out they didn't do it.

Can you link to this? Not trying to be meta, I just don't believe random claims on the internet without any evidence.

Re:Someone has stolen my Instagram account by ayewo on Sunday September 27, 2020 @01:23PM (#24608288)
I just posted links as a sibling comment to yours although none of the links contain a 2000 comment thread.
Re:Someone has stolen my Instagram account by smt88 on Sunday September 27, 2020 @02:09PM (#24608748)
My anecdata says that HN users are among the least likely on social media to believe conspiracy theories. They actually tend to err on the side of skepticism. It's very common to see someone say, "Yes, this could be malice, but it could also be incompetence."

I think this is partly because so many of us have worked in (or with) the targets of most conspiracy theories: government and large corporations.

Re:Someone has stolen my Instagram account by renewiltord on Sunday September 27, 2020 @02:25PM (#24608928)
I think HN users are convinced in their immunity to various things: propaganda, conspiracy theories, advertising. I also think HN users are very good at coming up with reasons for why this might be the case.
Re:Someone has stolen my Instagram account by jknz on Sunday September 27, 2020 @12:22PM (#24607792)
There is some evidence of some kind of takeover though. Searching for site:http://instagram.com/danny in google, the first result is the following:

    Danny (@danny) • Instagram photos and videos
    www.instagram.com › danny
    8690 Followers, 134 Following, 100 Posts - See Instagram 
    photos and videos from Danny (@danny)

This is still in Google's cache. The current instagram profile is very different.
Re:Someone has stolen my Instagram account by heyoni on Sunday September 27, 2020 @12:32PM (#24607867)
That’s...not evidence of a facebook employee being implicated. It’s actually not even evidence that the account even swapped hands!
Re:Someone has stolen my Instagram account by jknz on Sunday September 27, 2020 @12:48PM (#24607985)
The victim is a real person with a PhD thesis that anyone can read.

Why would someone jeopardize his reputation by using his real name on some kind of staging of a fake account swap? I kindly disagree with your second sentence.

Re:Someone has stolen my Instagram account by otterley on Sunday September 27, 2020 @12:43PM (#24607954)
> It’s actually not even evidence that the account even swapped hands!

Do you honestly believe a jury of average people would agree with this proposition? It seems contrary to common sense.

Keep in mind that there is a significant difference between what meets the relevancy bar in court, and what is logically probative. See, e.g., https://www.law.cornell.edu/rules/fre/rule_401

Re:Someone has stolen my Instagram account by diab0lic on Sunday September 27, 2020 @01:21PM (#24608274)
> That’s...not evidence of a facebook employee being implicated.

The account messaged and said a facebook employee was involved. It isn't proof, it isn't strong evidence, but it is evidence and an implication that a facebook employee was involved.

> It’s actually not even evidence that the account even swapped hands!

Similarly the change in account usage pattern isn't proof but it is evidence.

Re:Someone has stolen my Instagram account by simonw on Sunday September 27, 2020 @11:57AM (#24607594)
It's believable though. The culture around "OG" accounts really is that weird.

It's easy enough for a Facebook policy team to confirm this one way or the other by looking at the logs. If this gets enough visibility I assume that will happen.

Re:Someone has stolen my Instagram account by bredren on Sunday September 27, 2020 @12:09PM (#24607691)
This reminds me of the federal indictment against consultants bribing amazon employees.

If Instagram account takeover favors can occur, how much do they cost?

Re:Someone has stolen my Instagram account by rodgerd on Sunday September 27, 2020 @04:58PM (#24610081)
It can be incredibly difficult to get that traction - I know Patrick Grey of Risky Business has mentioned in passing that he's occasionally helped local-to-him small businesses who have been locked out of their Instagram accounts, because it's basically impossible to get assistance except through well-connected folks.
Re:Someone has stolen my Instagram account by anonymfus on Sunday September 27, 2020 @01:44PM (#24608498)
It's easy, but remember that it is not a policy team who will decide what to say publicly, but PR team, which in Facebook's case has a sociopathic/capitalist culture of putting profits above everything, and so they will decide whether confirming it in either way will generate more negative news about that event than leaving it ambiguous.
Re:Someone has stolen my Instagram account by some1else on Sunday September 27, 2020 @12:10PM (#24607708)
Here's a screencap of Philip Kaplan's newsletter from 2017 where he claims a friend at Instagram helped him get @DistroKid, which was registered but inactive:

https://i.imgur.com/9mNY7lJ.png

Re:Someone has stolen my Instagram account by daveFNbuck on Sunday September 27, 2020 @01:25PM (#24608319)
That's not necessarily evidence of rogue employees being able to steal accounts for their friends. That may just mean that they had a friend at Instagram that helped them trigger the official process to delete an inactive account and give the name to someone who plans to use it.
Re:Someone has stolen my Instagram account by toyg on Sunday September 27, 2020 @02:03PM (#24608692)
In practice, it's the same thing: you have no way to know that this is not what happened to @danny, the consequences are the same.
Re:Someone has stolen my Instagram account by daveFNbuck on Sunday September 27, 2020 @08:35PM (#24611592)
It's unlikely that this is what happened to @danny, unless their account was inactive.
Re:Someone has stolen my Instagram account by tasuki on Sunday September 27, 2020 @03:55PM (#24609650)
Similarly, I "took over" https://github.com/tasuki by simply messaging the customer support. They said it wasn't being used and I could have it.
Re:Someone has stolen my Instagram account by fotta on Sunday September 27, 2020 @04:58PM (#24610082)
The difference is that this is a documented GitHub policy [0]. I’ve done the same for a handle that didn’t have any activity in its entire history. AFAIK neither Instagram nor Twitter have similar policies (though I somewhat wish they did).

[0] https://docs.github.com/en/free-pro-team@latest/github/site-...

Re:Someone has stolen my Instagram account by PragmaticPulp on Sunday September 27, 2020 @02:31PM (#24608990)
The author's girlfriend had to re-follow the account, which implies the original followers were replaced with Danny's.

In the new Danny's screenshot, it shows that he's followed by three other "OG" account names: "blood", "murder", and "dead". Furthermore, the screenshot was taken from another account, otherwise it would have shown as "This account is private" (Try viewing your own Instagram profile while logged in and private). Whoever was viewing it was therefore friends with Danny, 'blood', 'dead', and 'murder'. In other words, someone interested in OG accounts, or one of new Danny's alternate accounts.

Finally, it would be truly bizarre if new Danny immediately implicated a friend at Facebook before anyone asked him how he got the account. If this was true, I would suspect new Danny would be going to great lengths to hide the fact, rather than trying to hand the excuse out before anyone even asks. This guy just stole someone's Instagram account. He's hardly a credible source.

I wouldn't rush to conclude that a Facebook employee did this. It sounds like the kind of excuse someone would give to pretend to be coming from a position of internal power rather than appearing to be the result of a hack.

Re:Someone has stolen my Instagram account by jeremymcanally on Sunday September 27, 2020 @07:07PM (#24610956)
It doesn't surprise me at all, actually. These idiots brag about this to friends constantly and try to make new connections inside the companies to exploit. I have a very short Twitter that people try to take over constantly, and by virtue of being on the platform early, I've accrued a few "OG" accounts for various projects or whatever. When someone stole one of my accounts that I didn't use anymore by having their friend take it over, I had my friend look into it and they reversed it.

The account jacking idiot then messaged me trying to get me to put them in touch with my friend so they could try to help them get other accounts and bragged about how he was just going to take some of my other accounts that he somehow knew belonged to me despite there being no link to one another outside of what would be Twitter-internal data. It was the most brazenly ridiculous thing I've ever encountered, but I'm assuming it's an ignorant kid who doesn't realize the possible consequences or a really dumb adult.

So, I can totally believe the idiot would just blurt out how he got it because that gives him clout amongst his miscreant "OG account" friends.

Re:Someone has stolen my Instagram account by stefan_ on Sunday September 27, 2020 @12:04PM (#24607653)
I assume there is no evidence except an account full of pictures of the guy?

Maybe the employee claim is wrong, who knows, but determining who owns the account should be trivial. And frankly, given what we know about how the Twitter "hack" went down (rate limits? sign offs? resetting 2FA? impersonating accounts?!) it is fully believable.

Re:Someone has stolen my Instagram account by johnnyfaehell on Sunday September 27, 2020 @01:20PM (#24608261)
Well the difference between "hey my dad works at Xbox and will ban you" and this is this is now past tense. So it would be a case of you getting banned on Xbox and someone going "Yea that was my dad".
Re:Someone has stolen my Instagram account by maps7 on Sunday September 27, 2020 @11:52AM (#24607550)
If that was the case why would FB be marking the issue as resolved?
Re:Someone has stolen my Instagram account by tedunangst on Sunday September 27, 2020 @12:06PM (#24607666)
Kinda depends on the specifics of the issue. "I can't login." Send password reset, new account owner says thanks, all good. Resolved.
Re:Someone has stolen my Instagram account by renewiltord on Sunday September 27, 2020 @12:57PM (#24608057)
Because the process for that is automated. It sends you an email to see if you own the account and then asks people on your friends list to verify.

That's how it works on Facebook.

So if you have full control, you will pass these tests.

Re:Someone has stolen my Instagram account by itronitron on Sunday September 27, 2020 @12:40PM (#24607935)
It's possible that the new owner is notified when an issue is submitted and is able to mark the issue as resolved, or IG notes that someone is using the account and assumes there is no longer a problem.
Re:Someone has stolen my Instagram account by ipsum2 on Sunday September 27, 2020 @11:59AM (#24607613)
I don't know, but it sounds like the issue was resolved (correctly or incorrectly) the first time, so the user started filing a ton of issues, which were automatically marked as duplicate. Now he's spamming the white hat security form (https://twitter.com/dannyjhall/status/1310231761444581385), which is not likely to get him a response.
Re:Someone has stolen my Instagram account by 6gvONxR4sf7o on Sunday September 27, 2020 @12:59PM (#24608072)
“Spamming?” If repeated complaints about an issue the company won’t resolve is what we call spam now, I’m speechless.
Re:Someone has stolen my Instagram account by ipsum2 on Sunday September 27, 2020 @02:19PM (#24608864)
Spamming the white hat security bug program won't get him an answer, because he's not reporting a security flaw.
Re:Someone has stolen my Instagram account by hdjdbtbgwjsn on Sunday September 27, 2020 @04:16PM (#24609837)
https://en.m.wikipedia.org/wiki/Spamming

I don't understand how he is 'spamming'.

Re:Someone has stolen my Instagram account by verroq on Sunday September 27, 2020 @02:06PM (#24608729)
He is a “free” user, what duty does Facebook owe him?
Re:Someone has stolen my Instagram account by mumblerino on Sunday September 27, 2020 @02:17PM (#24608836)
Ah yes sure you don’t pay Google a dime, so don’t you worry if you lose your account tomorrow, it’s not like anything is owed to you. Say bye to [email protected]
Re:Someone has stolen my Instagram account by verroq on Sunday September 27, 2020 @03:17PM (#24609368)
Not sure what your point is because that’s happened to people and they have no recourse.
Re:Someone has stolen my Instagram account by colejohnson66 on Tuesday September 29, 2020 @12:24PM (#24629765)
That being the status quo doesn’t make it acceptable?
Re:Someone has stolen my Instagram account by 6gvONxR4sf7o on Sunday September 27, 2020 @02:13PM (#24608780)
Are we talking legal duty or “not being an asshole” duty? I’d argue it’s at least the latter, where the case should be pretty clear.
Re:Someone has stolen my Instagram account by paxys on Sunday September 27, 2020 @11:58AM (#24607599)
Because there's no proof of any malicious activity. It could very well be that the guy Tweeting is trying to take over the account.
Re:Someone has stolen my Instagram account by heyoni on Sunday September 27, 2020 @12:34PM (#24607881)
That could be completely made up. He could just be saying this to stir outrage at facebook and that’s why the tickets are being closed.

There’s really no evidence of anything at all.

Re:Someone has stolen my Instagram account by x86_64Ubuntu on Sunday September 27, 2020 @12:39PM (#24607927)
Then we would like an answer from FB about what occurred. The handwaving away about "nothing to see here" up and down this thread isn't a satisfactory resolution to the issue at hand. Someone alleges their IG was stolen and they allege that FB is batting away tickets about the issue. It would be nice to see FB respond to this. The urgency is compounded by the fact that Amazon had it's own little insider's ring of people providing "extra" services to people for a price.
Re:Someone has stolen my Instagram account by gsich on Sunday September 27, 2020 @11:50AM (#24607532)
That depends if the Authenticator was used or normal SMS messages.
Re:Someone has stolen my Instagram account by oh_sigh on Sunday September 27, 2020 @01:22PM (#24608281)
You can 2FA on twitter with the Authenticator app. There is no indication that OP was using SMS 2FA, and you would suspect that they would have mentioned that their phone stopped working if in fact they were sim swapped. I agree there is no proof it was an inside job but it seems plausible.
Re:Someone has stolen my Instagram account by tigershark on Sunday September 27, 2020 @03:31PM (#24609472)
I think he would have noticed if his phone network was dead by now.
Re:Someone has stolen my Instagram account by serjester on Sunday September 27, 2020 @12:04PM (#24607656)
Agreed. Is anyone really going to risk their cushy FAANG job to give their buddy a cool handle? Possible, but seems far fetched.
Re:Someone has stolen my Instagram account by objclxt on Sunday September 27, 2020 @12:20PM (#24607777)
I have seen this happen firsthand on several occasions at several companies, and it’s a well documented risk vector. You see it for things like username takeovers, and also ad account reactivations.

Typically it is not the people with cushy jobs, but those working for vendor companies (moderation, customer support, etc) who have little investment in the company, are barely making minimum wage, and are more than happy to flip a few switches in the dashboard for a few thousand (or less).

Re:Someone has stolen my Instagram account by heavyset_go on Sunday September 27, 2020 @02:01PM (#24608667)
People with positions of power are regularly found to take bribes that wouldn't even be a 1/10th of their normal paycheck. Power tripping is a recognized phenomenon, and greed makes people do irrational things sometimes.
Re:Someone has stolen my Instagram account by Nextgrid on Sunday September 27, 2020 @12:12PM (#24607726)
The lower-level jobs aren't as "cushy"; I don't see an engineer doing this but I can definitely see a junior in a lower-level customer service or similar administrative role do this.
Re:Someone has stolen my Instagram account by HenryBemis on Sunday September 27, 2020 @12:37PM (#24607903)
You cannot imagine how many times I have caught red handed, people with that mentality "screw the policy, my friend needs a loan/credit card/etc". A a bank can and will drag you to court and rip you a new one. That said, not all banks are scummy to create cards/loans to clients without their knowing. Some actually play by the book.

Anyway, yes some people think that because they are good enough at what they do, they will be given a pass when caught. Unbeknownst to them, if any auditors catch them, then the "jokers" can start updating their CV.

Re:Someone has stolen my Instagram account by SideburnsOfDoom on Sunday September 27, 2020 @12:27PM (#24607836)
> Is anyone really going to risk their cushy FAANG job to give their buddy a cool handle? Possible, but seems far fetched.

Given the kind of ethically vacuous tech-bro who might join FB in 2020? Not _that_ far-fetched.

Re:Someone has stolen my Instagram account by Nextgrid on Sunday September 27, 2020 @12:37PM (#24607908)
Ethically vacuous doesn't mean stupid though, and I doubt they will jeopardize a lucrative career for a quick buck or bragging rights in front of their friends.
Re:Someone has stolen my Instagram account by heavyset_go on Sunday September 27, 2020 @02:03PM (#24608693)
People do this all of the time, and there is nothing about jumping through Facebook interview hoops that prevents people from making immoral decisions for personal gain once they're an employee.
Re:Someone has stolen my Instagram account by SideburnsOfDoom on Sunday September 27, 2020 @04:47PM (#24610025)
You might even argue that joining Facebook is an example of "making an immoral decision for personal gain", therefore any Facebook employee has track record at that.
Re:Someone has stolen my Instagram account by biztos on Sunday September 27, 2020 @02:07PM (#24608732)
Except if they're sure they won't be caught.

Isn't that how actual crime works?

Re:Someone has stolen my Instagram account by marcinzm on Sunday September 27, 2020 @12:11PM (#24607710)
I doubt the low level customer service is a cushy FAANG job. Probably all contractors as well.
Re:Someone has stolen my Instagram account by BelleOfTheBall on Sunday September 27, 2020 @04:52PM (#24610049)
I'm like 90% sure there was an article about Shopify employees stealing customer data just recently. Not FAANG, granted, but it's still a traditional way of data leaking or accounts being stolen. Inside jobs aren't exactly a rarity.

[0]: https://community.shopify.com/c/Shopify-Discussion/Incident-...

Yup, here it is, just five days ago.

Re:Someone has stolen my Instagram account by croes on Sunday September 27, 2020 @12:44PM (#24607958)
People made a lot more stupid things for less