Instagram Adds 2FA, Account Verification in Security Update
Social media platforms’ struggle with safety and security is like a game of Whac-A-Mole. One day, the threat is coordinated bot activity; the next, it’s SIM hijackers stealing the identities of regular users. In an effort to protect Instagram users from those and future threats, the company announced today a set of features designed make Instagram feel “safer,” including ways to protect your own account and to verify whether the accounts you follow are genuine or not.
First, all users will soon be able to use a more robust form of two-factor authentication to log into Instagram. Previously, Instagram offered two-factor authentication with a code sent via SMS—better than nothing, but insufficient to protect all Instagram users from having their accounts compromised. (Users with “valuable” handles may be more vulnerable to scams like SIM hijacking, where hackers access a person’s phone number and use it to log into their accounts and steal their usernames.) Now, the platform will allow integration with third-party authenticators, like DUO Mobile and Google Authenticator, which supply two-factor codes locally and provide an additional layer of security against account hacking.
To help users differentiate between real and fake accounts, Instagram will now make it easy to look up information about individual accounts, including the date the account was created, its country of origin, and a record of username changes over the past year. You’ll also be able to see any ads the account is running and similar accounts with shared followers. To surface this information, tap the three dots on an Instagram profile page and select the new tab, “About This Account.” The feature will roll out first to accounts with large followings—celebrities, public figures, influencers—and later to all Instagram accounts.
Lastly, accounts with large numbers of followers will now be able to request verification from Instagram. The platform already gives blue checkmarks to some celebrity users and brands—WIRED’s Instagram, for example, has one—but the verification process is mysterious, and Instagram hasn’t previously let users request verification. The new verification process involves a request form along with a place to upload a photo of a government-issued photo ID.
Instagram says the new changes are part of a roadmap to help the platform feel safe, and to empower users to follow genuine accounts over fake ones.
“Keeping people with bad intentions off our platform is incredibly important to me,” Instagram’s co-founder and CTO, Mike Krieger, wrote in a blog post today. “That means trying to make sure the people you follow and the accounts you interact with are who they say they are, and stopping bad actors before they cause harm.”
The platform is also hoping not to repeat the same mistakes of its parent company, Facebook, which has struggled to keep fake accounts, misinformation campaigns, and untrustworthy pages off its platform. In the past few weeks, Facebook has removed millions of fake accounts in the past year, and which are becoming harder to trace on the platform.
Instagram is, of course, a different beast. As it grows, it will have to face hard decisions about how to create community and trust on a global platform of over a billion users. Checkmarks and two-factor authentication aren’t the end of that story. But they’re a good place to start.