> These teenagers are relying on a sophisticated network of trusted Instagram users to post content from multiple different devices, from multiple different locations.
I'm not sure that quite qualifies as a "sophisticated network" but you're right, I would think any service, especially something as big as Instagram, would end all sessions if the password is reset. Could this be by design? Seems like too be to be missed by the security teams though. Does Facebook do the same thing?
Was the same for Amazon as well since I was able to change my passwords and Kindle devices still worked. (Might still be the same, but haven't checked recently).
From experience I would say that most services do not invalidate access tokes after any account modifications, since you would need to track them. Depending on the service that might not be too trivial, but I would expect services like Instagram to do so. It is becoming more common at least.
This is not completely accurate - I recently updated a password on a group account and eventually, I had to log back in on every device. It isn't immediate though - maybe on token expire or something with a delay. It is also a business Instagram account - might make a difference.
I like the idea. But if you have the knowledge that they are tracking you, why even participate in the app? I get it that all your friends do it, but that's terrible excuse. You don't become a social pariah.
Just like your webshit is not to be taken seriously if you don't show a lot of ads and track the living shit out of your users, nothing spells doom on your societal status more than not being subject to tracking. Not being tracked means to be a total outcast and, yes, a social pariah. There are good reasons that people cannot live without Google and Facebook any more.
Some people want to keep up-to-date or discuss a topic, and some content is exclusive to certain places. It’s an unfortunate side effect of the network effect, really
I've done the same by never logging into google and sharing my residential connection via VPN with friends and family. Google, Facebook, and Instagram all get very confused especially when the other users are sometimes logged in, and physically located in faraway locales.
Downside is that sometimes google.com gets redirected to a foreign language, or I get tons of captcha challenges. Worth it though to see the random locations it thinks I'm at and ads it thinks I'm 'interested' in.
This strikes me as a decent benefit to Instagram. Otherwise, why would they leave sessions active after password resets? That's standard practice for any large service.
Now, not only do you know the habits of individuals, but now you have insight into their closest friend networks and I bet can glean a more information from that fact. I'm sure this technique doesn't anonymize the people in the group, because I bet they aren't all using burner phones for insta. However, it does make it difficult for external data brokers to get that information, so maybe there's a sales opportunity in here.
"They might be like, 'Hey, you posted from this hamburger place in Germany, maybe you like Germany, or hamburgers, or traveling, we'll just throw everything at you,'" Mosley said. "We fluctuate who's sending to what account. One week I might be sending to 17 accounts, and then the next week I only have four."
Would probabaly deliver more interesting ad results.
I strongly suspect Instagram has enough data, in the posts/photos, to distinguish each separate install. And thus also, enough data to profile each "sub-persona" separately, if they wanted to, or otherwise limit the behavior if they didn't like it. (And their logs are probably extensive enough for them to do this retrospectively.)
So this is an interesting social behavior – perhaps a hint to new potential features/apps? – but probably not an actual escape from "Instagram tracking" via a "flood" of "random data", as the author/presenter has spun it.
While it might be possible to Insta/FB to do that, I strongly doubt, that they do that or have systems in place to do that. It most likely is not an important use case for them as the user group that does this is way too small.
I wonder, if these teens will change to something like, e.g., pixelfed, a distributed image service. That would be a lot more effective in hiding.
One thing I recommend doing is block every single advertiser you see on Instagram. It doesn't reduce the frequency of ads but will reduce their revenue. Every time you block one it has to show you a lower value ad.
I don't really understand how this is news - this is no different than when I spend an hour browsing #antiquewatch and then switch to #denverbroncos and end up on #startups. The same thing happens if you share a netflix account - I had a good laugh with my partner when I started getting barbie movie recommendations.
That doesn't mean Instagram isn't able to track the activity specific to each device though. Just like if you are logged into 5 Instagram accounts on one device they're probably attributing activity to both the active account AND the device.
Doesn't Instagram have every device's photos' metadata anyway, when each one of those people gives it permission to access photos, and is then able to build a device specific profile and connect that with a corresponding Facebook account where some of these people may be sharing (their own) photos? Maybe the Instagram feed is using all these mixed signals, but to think that Instagram doesn't have a lot more data from each of those people's devices seems to be a bit of a stretch. I don't believe this tactic hides these people much from Instagram.
I'm really curious of what the future of the internet is. The reason these services are mainstream and popular is because they are free and offer customized experiences. Without ad money how would you expect more services like this in the future. Before you say charge money for them... I just don't believe this works within the context of social applications, plus the group of people that primarily use these applications don't really have the ability to pay.
28 comments
[ 6485 ms ] story [ 588 ms ] threadYikes.
I'm not sure that quite qualifies as a "sophisticated network" but you're right, I would think any service, especially something as big as Instagram, would end all sessions if the password is reset. Could this be by design? Seems like too be to be missed by the security teams though. Does Facebook do the same thing?
Downside is that sometimes google.com gets redirected to a foreign language, or I get tons of captcha challenges. Worth it though to see the random locations it thinks I'm at and ads it thinks I'm 'interested' in.
Now, not only do you know the habits of individuals, but now you have insight into their closest friend networks and I bet can glean a more information from that fact. I'm sure this technique doesn't anonymize the people in the group, because I bet they aren't all using burner phones for insta. However, it does make it difficult for external data brokers to get that information, so maybe there's a sales opportunity in here.
Would probabaly deliver more interesting ad results.
So this is an interesting social behavior – perhaps a hint to new potential features/apps? – but probably not an actual escape from "Instagram tracking" via a "flood" of "random data", as the author/presenter has spun it.
I wonder, if these teens will change to something like, e.g., pixelfed, a distributed image service. That would be a lot more effective in hiding.
And targeting of ads is mostly done by device ID anyway so they're probably already storing it.
just... don't use the app maybe?
That doesn't mean Instagram isn't able to track the activity specific to each device though. Just like if you are logged into 5 Instagram accounts on one device they're probably attributing activity to both the active account AND the device.