Instagram Announces Support for Two-Factor Authentication Apps and Streamlined Account Verification

I frankly don't understand why important features like this are "rolling out in coming weeks" as opposed to now.

Facebook (and Instagram as part of it) are so huge that they don't roll out new features all at once. Instead, they roll out to smaller areas at a time. This allows them to be sure things are working correctly before continuing to push new features out to everyone. It's a smart way to do things.

If you've ever wondered (or are one of those that gets upset) about Facebook, Instagram, and others who release new updates to their apps every week and just have "Bug fixes and other updates." in the release notes, these updates are what add the ability to push those new features. They don't want to announce those new features in the update because then they can't roll them out gradually. You'd have a bunch of people complaining "WHY ISN'T IT WORKING ON MINE!!!! ‽??!!"

Wonder what they consider "large accounts". Nearly every one of my accounts has over 20k followers, with most well over 100k. Certainly the +100k will be considered large but I wonder what the cutoff is on the lower end.
[doublepost=1535478415][/doublepost]

Just last week several apps made headlines for being hacked through SIM exploitation. This type of news (that Mac Rumors also publishes) puts these apps in the spotlight, necessitating moves like this from Instagram, Twitter, and others.

The fact that we're seeing accounts exploited this way is a great indicator that these additional measures are needed.

I have 8k and I got the notification about being a high-reach account

Wonder what they consider "large accounts". Nearly every one of my accounts has over 20k followers, with most well over 100k. Certainly the +100k will be considered large but I wonder what the cutoff is on the lower end.
[doublepost=1535478415][/doublepost]

Never understand authentication apps. I was using one for a while for 3 accounts. Got a new iPhone installed the app and it was reset. Lost 3 accounts because I couldn’t get back into them. For the average user phone number should be more than enough. I mean seriously who the hell is going to hack my SIM card. Come on.... I can see a use for it for users not wanting to hand over their phone number to shady services but maybe you shouldn’t be using those services anyway, just a thought.

Just last week several apps made headlines for being hacked through SIM exploitation. This type of news (that Mac Rumors also publishes) puts these apps in the spotlight, necessitating moves like this from Instagram, Twitter, and others.

The fact that we're seeing accounts exploited this way is a great indicator that these additional measures are needed.

Google Authenticator doesn't have the recovery code in all cases. I remember having to guess whether wiping and restoring my phone from a backup would save it... turns out it does but only if I encrypt my backup. This kind of thing can't be left undocumented!

Not the authenticator, the service you’re using it for. If you use an authenticator app for gmail, you get recovery codes, same with Dropbox, Facebook, and others.

Being pedantic, if there is a recovery code, technically it's 1-factor auth and not 2. But still safer because you'll likely keep that code more securely than you would a password.

It’s still 2 factors.
Factor 1: your password
facror 2: the one time password OR the recovery code.

While you aren't wrong, features like two factor isn't something most people use (they should but they don't). More people pay attention to new features on a launch date. And if the feature cannot be used, they tend to be forgotten.

And besides, Instagram's parent company Facebook had TOTP authentication for years. While things can always go wrong and rolling out in phases is safer, I think Instagram is taking more precaution than is warranted.

Also, let's not forget that some big companies, such as Apple, roll out major features to everyone on day 1.

It's not like this change is making major news. Most will never see this announcement on sites like this.

Instagram is already putting announcements within the app and they'll likely add a Story about it too when it rolls out to those chosen users.



I'll be surprised if they don't prompt users to enable it when it becomes available to them too.
[doublepost=1535495722][/doublepost]

Interesting! Did you get the notification recently?

I got the above notification the most recent time I opened the Instagram app.

Never understand authentication apps. I was using one for a while for 3 accounts. Got a new iPhone installed the app and it was reset. Lost 3 accounts because I couldn’t get back into them. For the average user phone number should be more than enough. I mean seriously who the hell is going to hack my SIM card. Come on.... I can see a use for it for users not wanting to hand over their phone number to shady services but maybe you shouldn’t be using those services anyway, just a thought.

You can switch the Google Authenticator app from phone to phone. Just follow the process on the Google Authentication webpage to transfer everything over to the new phone and it'll work just fine.
[doublepost=1535482405][/doublepost]

Wonder what they consider "large accounts". Nearly every one of my accounts has over 20k followers, with most well over 100k. Certainly the +100k will be considered large but I wonder what the cutoff is on the lower end.

Well, that answers my question. Logged into one of my accounts and got this message for "high engagement accounts like yours."