Teens have figured out how to mess with Instagram's tracking algorithm | Hacker News Reader

Teens have figured out how to mess with Instagram's tracking algorithm

cnet.com

56 pointselorant26 comments

I strongly suspect Instagram has enough data, in the posts/photos, to distinguish each separate install. And thus also, enough data to profile each "sub-persona" separately, if they wanted to, or otherwise limit the behavior if they didn't like it. (And their logs are probably extensive enough for them to do this retrospectively.)

So this is an interesting social behavior – perhaps a hint to new potential features/apps? – but probably not an actual escape from "Instagram tracking" via a "flood" of "random data", as the author/presenter has spun it.

While it might be possible to Insta/FB to do that, I strongly doubt, that they do that or have systems in place to do that. It most likely is not an important use case for them as the user group that does this is way too small.

I wonder, if these teens will change to something like, e.g., pixelfed, a distributed image service. That would be a lot more effective in hiding.

The only thing they need to do is store the device ID that the data originated from send they'll clearly see every individual user.

And targeting of ads is mostly done by device ID anyway so they're probably already storing it.

> Password resets don't end Instagram sessions, so both you and the second person will be able to access the same account at the same time.

Yikes.

> These teenagers are relying on a sophisticated network of trusted Instagram users to post content from multiple different devices, from multiple different locations.

I'm not sure that quite qualifies as a "sophisticated network" but you're right, I would think any service, especially something as big as Instagram, would end all sessions if the password is reset. Could this be by design? Seems like too be to be missed by the security teams though. Does Facebook do the same thing?

From experience I would say that most services do not invalidate access tokes after any account modifications, since you would need to track them. Depending on the service that might not be too trivial, but I would expect services like Instagram to do so. It is becoming more common at least.

Timestamping the tokens and invrementing timestamp at reset & compare these tses on reset is one way to do it

Was the same for Amazon as well since I was able to change my passwords and Kindle devices still worked. (Might still be the same, but haven't checked recently).

I think it's the same on Facebook.

It’s an option, you can choose to log out all devices when you perform a reset.

This is not completely accurate - I recently updated a password on a group account and eventually, I had to log back in on every device. It isn't immediate though - maybe on token expire or something with a delay. It is also a business Instagram account - might make a difference.

I've done the same by never logging into google and sharing my residential connection via VPN with friends and family. Google, Facebook, and Instagram all get very confused especially when the other users are sometimes logged in, and physically located in faraway locales.

Downside is that sometimes google.com gets redirected to a foreign language, or I get tons of captcha challenges. Worth it though to see the random locations it thinks I'm at and ads it thinks I'm 'interested' in.

Hopefully none of your family members have any "questionable" porn preferences... Make sure you're logging to protect yourself.

Mix it all.

I don't really understand how this is news - this is no different than when I spend an hour browsing #antiquewatch and then switch to #denverbroncos and end up on #startups. The same thing happens if you share a netflix account - I had a good laugh with my partner when I started getting barbie movie recommendations.

That doesn't mean Instagram isn't able to track the activity specific to each device though. Just like if you are logged into 5 Instagram accounts on one device they're probably attributing activity to both the active account AND the device.

Doesn't Instagram have every device's photos' metadata anyway, when each one of those people gives it permission to access photos, and is then able to build a device specific profile and connect that with a corresponding Facebook account where some of these people may be sharing (their own) photos? Maybe the Instagram feed is using all these mixed signals, but to think that Instagram doesn't have a lot more data from each of those people's devices seems to be a bit of a stretch. I don't believe this tactic hides these people much from Instagram.

"They might be like, 'Hey, you posted from this hamburger place in Germany, maybe you like Germany, or hamburgers, or traveling, we'll just throw everything at you,'" Mosley said. "We fluctuate who's sending to what account. One week I might be sending to 17 accounts, and then the next week I only have four."

Would probabaly deliver more interesting ad results.

This strikes me as a decent benefit to Instagram. Otherwise, why would they leave sessions active after password resets? That's standard practice for any large service.

Now, not only do you know the habits of individuals, but now you have insight into their closest friend networks and I bet can glean a more information from that fact. I'm sure this technique doesn't anonymize the people in the group, because I bet they aren't all using burner phones for insta. However, it does make it difficult for external data brokers to get that information, so maybe there's a sales opportunity in here.

I'm really curious of what the future of the internet is. The reason these services are mainstream and popular is because they are free and offer customized experiences. Without ad money how would you expect more services like this in the future. Before you say charge money for them... I just don't believe this works within the context of social applications, plus the group of people that primarily use these applications don't really have the ability to pay.

I actually enjoy Instagram's ads. I just wish there were higher quality providers in the things I find interesting.

This method is brute force as it gets. Replication in real world is not really feasible for most just to prevent simple as tracking

One thing I recommend doing is block every single advertiser you see on Instagram. It doesn't reduce the frequency of ads but will reduce their revenue. Every time you block one it has to show you a lower value ad.

when you "block every single" something, technically it becomes a job.

just... don't use the app maybe?

I like the idea. But if you have the knowledge that they are tracking you, why even participate in the app? I get it that all your friends do it, but that's terrible excuse. You don't become a social pariah.

Some people want to keep up-to-date or discuss a topic, and some content is exclusive to certain places. It’s an unfortunate side effect of the network effect, really

Reply on news.ycombinator.com