Hacker News new | past | comments | ask | show | jobs | submit | page 2 login
Someone has stolen my Instagram account (twitter.com/dannyjhall)
976 points by testloop on Sept 27, 2020 | hide | past | favorite | 333 comments



Anecdotal, but I used to own the @clonetrooper Twitter handle. One day I woke up and someone else had it.

Tried contacting Twitter, and they wouldn't accept my screenshots as evidence that I owned it. So what do I do? It's been almost a decade now, and I will never get it back.


There's a great episode on ReplyAll podcast[0] about the methods for bypassing 2FA to snag accounts. Was the 2FA endpoint a SMS cell number? In that case, it's probable the thief fraudulently impersonated the victim to the cell service provider and phished the 2FA code. Sadly, the cell providers are the weakest link in that particular chain (probably much weaker than Facebook's security).

I also wouldn't put it past someone to guess a password or have reused a password with another service that has been hacked. Humans are terrible at password hygene.

[0] https://gimletmedia.com/shows/reply-all/v4he6k


This is one of the symptoms of possible anticompetitive issues. Facebook has a lot more power now and really no meaningful competitors. The more you learn the more you realize that competition can be a good thing and facebook may be abusing their position.



Looking at the screenshot of the IG story, it indicates that the compromised account is now followed by @blood, @murder and @dead.

Looks like whoever took over the account is not some random kid with a friend at Facebook, but a "professional" account hijacker.

Whether they compromised the account via hacking, bribes or social engineering is anyone's guess, but it seems like this ain't their first rodeo.


A bit late - but worth adding anyway, the issue was apparently resolved, and the relevant Instagram account returned. Although no explanation on what occurred.

https://twitter.com/dannyjhall/status/1310499000471224320


More than this, instagram doesn't take reports seriously. I have reported many accounts obviously impersonating celebrities to gain followers, and they didn't ban those accounts.


He got his account back it looks like: https://www.instagram.com/danny/


Technically nobody owns anything. An ID is assigned at the discretion of the issuing organization. The ID wasn’t purchased, rights and ownership was never transferred.


On a related note, I would appreciate suggestions on how to regain my Facebook account, shut down without explanation a year ago. Despite its age (15 years) I barely used it, let alone for anything "controversial", but did regularly log into it. I have repeatedly tried to verify my identity by submitting an image of my driver's license, without any response.

I don't want to create a fake new Facebook account. I want my own back.


This has happened to me previously on FB. Had an account, of my first and middle names, that I'd stayed up to get when they released that feature on FB. Both short names like LeoMark. Woke up one morning and they'd changed it to LeoMarkus, and given the old account to someone. Pretty sure something similar also happened on LinkedIn.

Was pissed off at the time but pretty happy with no Facebook account these days.


As soon as I saw the first name only as the username I didn’t even have to scroll to see that it was probably an Instagram employee that stole it.


https://help.instagram.com/519522125107875 based on the data policy, Danny Hall and imposter collected as the same identity. One wonders if the ads will be pitched to the same 2 individuals.


Sounds an awful lot like the Twitter Blue Checkmark Hack a few months ago where a hacker got into a db and just reset all the accounts to his own/his friends email addresses

www.theverge.com/platform/amp/2020/7/15/21326372/twitter-hack-bitcoin-scam-new-tweets-shut-off-verified-accounts


This isn’t your property. It belongs to Facebook, they are just letting you use it and they have the right to take it away or do whatever they want with it. If you’re a nobody you don’t have a lot of recourse, just got to move on with your life.


Its exactly the same as with government, yes? Roads isn't our property, houses (sometime) isn't our property, country where we all live isn't our property. So what?


Shocking behavior from the most immoral company on the Internet. What can be done about this?


> Shocking

If you are so easier to shock, you will probably die from a heart attack at 30.

But seriously, it is an action of one bad employee at worst, this story (if it is even true) can happen in any company. Facebook gets spotlighted simply because it is large.


No, they get spotlighted because when stuff like this happen, it's impossible to resolve or get in touch with a human. If it was resolved after contacting support it wouldn't have been a story.


> it's impossible to resolve or get in touch with a human

I worked in a couple of large internet companies. The army of support people work long hours trying to deal with endless stream of support requests from people who cannot articulate what they actually need, disappear after a couple message, throw insults at support, and in addition to that a lot of fraud requests, spam and so on. I read some of their conversations with users (when they were related to my work), dealing with them is really hard.

I belive companies technically physically cannot do much better at tech support.

When your car breaks, you simply go to repair service, and pay to get the issue resolved.

Asking to cancel any large internet company for bad tech support is childish.

Adult response would be: I want paid tech support.


/s needed perhaps.


Something similar happened to me too - an automated squatter took control of my account when I changed email addresses, started posting TOS violating images and got banned. There’s zero support unless you ask someone to abuse their access to help.


I had my I instagram account stolen. I think it's not an employee but a flaw in their account recovery process that lets 3rd parties change the email.

Only way to resolve it was to click the link in the email notification for change of email address.


It appears to have reverted back to the originally Danny? (6 posts, not 100, 5,563 followers, 6 posts, set to private)

https://www.instagram.com/danny/


apparently he did not lost his images. the original account was swapped with this one: https://www.instagram.com/danny.miracle.done3/


How? Where did you read about it? The fact that IG accounts can be just "swapped" like that seems like a big security problem.


I saw it in his twitter thread.


I’ve asked danny on Twitter if he can confirm this.


It hasn't. Although a product designer at FB has got involved. https://twitter.com/diegojimenez/status/1310266030388846595?...


Lo’ and behold!


My instagram account belongs to somebody else too. I could once recover it with "forgot my password" feature, but then they took it back anyway


What username?


In US? Contack FBI, report identity theft, maybe extortion (message from new "owner").


I work at Instagram and there's literally zero chance of this happening. I work on the backend, so I know the kind of tools or logging we do. If in the chance this happens remotely, like 1 in a million chance, the employee will be fired like instantly.

I can't believe a random tweet with a screenshot is on front page of HN with 500+ upvotes.


Well then I'm sure you'll put in a ticket on Monday and have this investigated.


The account transfer happening may well have occurred, whilst the mechanism is misrepresented (likely by the attacker). Either way, a claimed user is plausibly representing a problem with no viable recourse from IG/FB.

The upshot of unauthorised account transfer would still lie on Instagram/Facebook, and should you in fact be a back-end engineer, filing a ticket and escalation would be strongly encouraged.


> I can't believe a random tweet with a screenshot is on front page of HN with 500+ upvotes.

How does that outcome compare to the believability of your average HN throwaway account?

Green username person says it's like a one in a million chance. Fired instantly? Oh the nos, will The Zuck rain down torment and lightning from the sky like Zeus?


I mean this has happened with Instagram accounts historically.

https://medium.com/@behoff/they-say-nothing-will-change-5c54...


That's from 2014. However, it seems like there's not been an official statement, so, unclear how or why it got resolved.

These days in 2020, a short Instagram handle is probably worth more than it was in 2014, though.


It wouldn't be if Facebook didn't prove in the past it is the most immoral online company. I get that they pay you, but maybe it's time to take another look at your employer with a more objective lens?


Here we go. Instagram guy tells us it cannot happen. Investigation closed.


If you can't believe a crazy conspiracy theory about Facebook would get 500+ on HN then you haven't been in post-2016 HN much.


That is the software engineer mantra: "There is no way that bug could happen... Oh"


This is why you want Mastodon :)


Does Mastodon have an Instagram-esque mode now?


Pixelfed is the instagram-esque incarnation of the fediverse.


Which I'd assume will be filled with alt-right and similar content (banned from other platforms usually for good reason), anime avatars and a liberal dose of poor taste (and potentially illegal in certain jurisdictions) content such as "lolicon".

None of this is something most people want to be anywhere near. While mainstream social media has many flaws, at least I am grateful for the fact that it bans, discourages or significantly dilutes this kind of content so that it isn't visible in most cases.


Not really, actually. Pixelfed (and mastodon, at least the official instances) aren't at all anti-moderation, for better or worse. They're more about moderation at the local instance level. I don't run in to any alt-right content on either pixelfed or mastodon. Not that I'm a huge user of either.


As long as you stay away from sites that are purposely for that audience like Gab, you will be fine.

Most Mastodon users feel the same way we do, and block users and instances that promote toxic content. Join an instance with similarly minded people and you will never see people be shitty in those specific ways because they're blocked from engaging entirely.


Lots of the servers simply block based on tribalism though, irrespective of "toxic content".

My single-user instance, for example, which is entirely free of "toxic content", even with an extremely critical viewpoint, is blocked by an admin of a popular public instance of 17k users, none of whom can follow me (or can I follow), simply because I publicly disagreed with him about the virtue of instance censorship.

These things tend to naturally centralize, and that's always going to enable small groups to have an invisible, unearned, outsized influence over what people can see or read.

I think client-server is the wrong model for p2p networks. Look at the issues with the deliverability cartel and the relative inability of normal people to deliver messages to Gmail users without paying money into it.


Ask for censorship and you will reap the controlled and powerless society that you have sowed.


So that's a yes, then?


Pixelfed is the federated IG.


Does the new owner of the account have access to his previous messages? I wonder how this would play out with GDPR if the original owner was from the EU.


As someone who used to be following his account, any messages we'd had have now gone from my inbox. I also haven't been able to find any likes on any of my images (there was previously)


Are we seriously just going to presume that this is true based on a hacker saying "my friend works at facebook"? This feels like the Apple refund thread all over again, with the same problematic outcome if it turns out to be false - people not seeing the rebuttal and still thinking it actually happened.


For all the talk about The Social Dilemma and how quickly unconfirmed stories spread and are cemented due to social media I'm disappointed that we are no better. We devour this as facts just because it fits our narrative.


I suppose he has read and agreed to Terms of Service when he signed up, which gives the company ability to do anything with their account. Facebook is not in the wrong here against this guy, just some employee did not follow the Facebook's internal rules.


Get a new one. I think they are free.


could be phished fb employee's account like it was in twitter bitcoin case?


My Instagram account has suddenly started asking for a phone number and won’t let me log in without one.


OK, then give it a phone number? Why do you post about it on HN, what's the story you want to tell here?


Please upvote this story — if it gets enough attention, someone at FB or IG might act.


Dont. This is HN not a support attention army.


Sometimes the HN support attention army is the only way to draw attention to issues that should be addressed anyways.


The only evidence of Facebook being involved is the hacker claims it?

Seems somewhat flimsy...


[flagged]


The number of votes on this post says otherwise. I find HN is good at solving these kind of issues and I find the stories behind these posts interesting.


it unfair as most people will not know how to make the necessary drama

The solution to a deep problem is not to kick down the ladder a few people have found to climb out of it.


I never said its a solution to the problem. Its a solution to the symptom - the crappy non-content posts on HN like this one. I'm pretty sure these post are against the guidelines anyway.


other than the leading title, interesting post.


Basically. "A guy who stole my account claims someone at Facebook helped them" would be more accurate


I’m going to guess they sold the account are now trying to get it back


There is no reason here to believe the victim is telling the truth.

He could have simply grown tired of the Danny username, because of the constant spam it gets, and decided to cash in on it in exchange for some internet fame.

I assure you no Facebook employee would do something like this, an audit would clearly show what happened and that employee would be terminated quickly and probably face legal repercussions.

Don’t believe everything you read.


I'm worried about the failure of Internet literacy reflected here. As far as I can tell, the author of the Twitter thread is just some guy, not famous or otherwise widely known to be reputable. And he's presented no evidence which can be independently confirmed - he could be misunderstanding the scenario, or the framing could be made up, or the screenshots could be faked, or any of a million other things. But a bunch of us - 201, as of when I'm writing this comment - are signal boosting and discussing his accusation based on no information beyond our preconceptions about what kinds of things Facebook might do.


I know him. He's the poster on here, not just the tweet.


I suppose that does alleviate my concerns.


I understand its not exactly proof, but its the best I could do lol.


Yeah, it makes sense. I don't mean to propose a standard where nobody can believe anything because it might be made up.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: