Forest Global Training Partners

Cyber Risks · Krebs on Security

Instagram’s New Security Tools are a Welcome Step, But Not Enough

Summary: Instagram began rolling out support for third-party authentication apps like Authy, Duo and Google Authenticator over the coming weeks, adding a one-time code after password entry alongside its existing SMS option. The article notes the new offering does nothing to block account takeovers via SIM swaps, because Instagram still allows password resets with a single factor: a text message to the mobile number on file, and a spokesperson confirmed disabling SMS two-factor does not disable SMS password reset.

Bottom line: An attacker who convinces a mobile carrier to move your number can reset the Instagram password regardless of the authenticator app you installed, and the same hijack reaches every account that permits resets by text or automated call.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related