Hacker News Reader

Comment by aidos | Hacker News Reader

It’s rough out there. Was helping a friend of a friend last night who had been scammed into giving out her Instagram password. They’ve change the email / phone / pw on the account. In her case the account is actually a substantial business (art) portfolio with a lot of followers.

Naturally, after a little digging, I discovered that her email was using the same pw and had also been compromised (hackers deleted the emails from Instagram about the email address change).

As ever, the main issue is that getting through to Instagram to get any real help seems impossible. Which sucks, because surely changing all the details on an Instagram account should flag something on their side.

View on HN

You usually login in the West Coast, then, all of a sudden, you started login in the East Coast -- hey, GOOGLE, FACEBOOK, isn't that ODD?????????????????

I can't believe they act as they don't know what's going on and have no means to deter this. They SHOULD BE LIABLE!

I usually log in from one city in Germany, now I suddenly log in first from another city in Germany. It's the same user agent, but an empty cookie jar. Should the login be denied?

Now I log in from a city in the Netherlands, 20 minutes later. From a phone, again, empty cookie jar. Even with a helicopter there's no way to make it there that fast. Should the login be denied?

(The answer is "no, because I've traveled to another city to visit a conference, and the conference network was routed in a weird way and the GeoIP data for their exit IP was incorrect".)

People jump locations all the time, for reasons like remote desktop sessions, mobile roaming, personal and company VPNs, etc.

Locking out a real user has a significant cost.

No, that isn't really odd. People travel. Should my account be locked everytime I visit family?

I permanently lost access to may aim account a while back because I tried to connect while traveling out of country.

The key point here is that it's impossible to travel long distances in a short amount of time... Of course people travel. What's not normal is to log in in Miami and in the next minute log in Seattle....

VPNs are pretty mainstream these days. If you talk to anyone working on anti-abuse you'd find the answer to most "Why don't you just.." ideas is because it'd impact many orders of magnitude more legitimate users than victims.

I turn on my company VPN and the next minute my network connections come from their HQ halfway across the world.

If I leave my desktop logged into my account in LA—or it even has some form of autologin enabled and it reboots and auto-logs-in—but I log in from my phone in DC three seconds later, that doesn't mean I traveled from LA to DC in three seconds.

well... it might be normal, if you're on VPN and traveling and what not.

The key, imo, is 'normal'. A new account has no activity, but an account that has, say, 3 years of only ever logging in from IPs located in, say, Detroit area suddenly has logins from Europe and attempts to change email/pass/etc while activity is still coming from Detroit - that's an anomaly. But until there's historical data to compare against, you can't really know. And... unless you've got a lot of computing power to check for that all the time (or outsource that sort of stuff), you probably can't detect that.

Not sure about facebook, but google used to(no longer use them) warn me about location change(SMS and e-mail to secondary account).

Should be able to get that account back unless they stole her email as well. Typically the original email is able to recover the account and it doesn't matter that the hackers changed the email.

She managed to get it back now. Thanks.

Reply on news.ycombinator.com