Hacker News Reader

Instagram password reset can start from an email address.

> If my info got out, it likely came from Instagram’s side, not mine.

Did you use a burner email account to register? An account that was never used for anything else?

I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy.

[1] https://www.instagram.com/accounts/password/reset/ (screenshot: https://imgur.com/a/4x5HPLx)

Ahhhhh, no. This account was registered pre hide-my-email days.

Yeah, common surprise point for services that have any form of username recovery from email.

Reply on news.ycombinator.com