This summer, Instagram users complained en masse about account hacking, and many victims were allowed to use two-factor authentication (2FA) via SMS messages.
It quickly became clear that the problem was the insecurity of this kind of 2FA method as a whole.For example, in July 2018, journalists at the Mother Board division published the findings of an investigation showing that attackers often “stole” users’ SIM cards, which allowed them to steal accounts and the identities of other people by the dozens and even by the hundreds.
It should be noted that in 2016, the National Institute of Standards and Technology (NIST) presented an interesting document stating that using SMS messages for two-factor authentication is “unacceptable” and “not secure.” Security experts have been talking about this for a long time, because there can be many attack options here. For example, attackers can exploit SS7 vulnerabilities and intercept messages, carry out a SIM swap, meaning reissue a victim’s SIM card, and finally, SMS messages can even intercept malware that has infiltrated the device.
Instagram’s developers listened to the opinions of experts and the complaints of victims. They announced that they were improving the two-factor authentication of their service by adding support for third-party authentication apps (Google Authenticator, DUO Mobile), which will launch this week. Users will be able to choose the solution for implementing 2FA in Google Play or on the App Store by enabling the corresponding option in their account settings.
Additionally, to combat bots, fake star accounts, and abuse, the developers have introduced a new feature: About This Account. With it, users can see another person’s account history and find out when the account was created. the country to which the account belongs; information about username changes; searching for profiles whose follower bases overlap.
In addition, users can now submit a request to verify their accounts by providing Instagram operators with copies of documents and stating their real name. These accounts will receive a corresponding checkmark.
