How to Secure Your Instagram Account With Two-Factor Authentication

Wednesday October 10, 2018 6:00 AM PDT by Tim Hardwick
With social media account hacking becoming increasingly more widespread, users would do well to make sure they're taking every security measure available to them. That goes doubly for frequenters of Facebook-owned Instagram, where account hijacking in particular is a recurring problem.

One of the best ways to protect any online account is by using two-factor authentication (2FA). 2FA offers hardened security during login attempts by requesting that the user provides an extra piece of information only they would know, such as a randomly generated code from a third-party.

Instagram has supported two-factor authentication for some time, but it was tied to a phone number and required users to receive text messages, which has proven to be insecure and left some Instagram users vulnerable to SIM hacking. Last week however, Instagram added non SMS-based two-factor authentication to the app with support for third-party authenticator apps.

With 2FA enabled, you'll be the only person who can access your Instagram account from another device, regardless of whether someone learns your password as the result of a hack or a phishing scam, so it's well worth taking the time to enable the feature. This article shows you how. Note that you'll need to download an authenticator app to follow the steps below – we'll be using Google Authenticator, but Authy is another tried and tested option that works equally well.

How to Protect Your Instagram Account With 2FA

  1. Launch the Instagram app on your iPhone and log in to your account if you aren't already.

  2. Tap your profile picture in the bottom right of the Instagram feed.
  3. On your profile page, tap the three-lined button at the top-right of the screen.
  4. Tap Settings at the bottom of the pop-out side menu.

  5. Tap Two-factor authentication, listed under privacy and security settings.
  6. Tap Get Started.
  7. Tap the Authenticator toggle.
  8. Tap Next.
  9. Tap Open in the prompt that says Instagram wants to open Google Authenticator.

  10. A prompt will appear in Authenticator asking if you want to add a token for your Instagram account. Tap Yes to confirm.
  11. Tap and hold on the Instagram token to copy the code to the clipboard.
  12. Return to Instagram and long press on the code entry field, then tap the Paste pop-up to enter the authenticator code.
And that's it – 2FA is now enabled for your Instagram account. Note that once you've authenticated a trusted device in this way, you won’t have to do it every time you launch the app, but your account will remain protected.

Tag: Instagram
26 comments

Top Rated Comments

(View all)
Avatar
Jyby
18 months ago
“How to secure your Instagram,” don’t use Instagram.
Rating: 2 Votes
Avatar
mdatwood
18 months ago

So basically as trivial as getting into someone else's car with a key, provided one finds a way to get the dealership to give them a duplicate key for someone else's car.


Not at analogous at all. A dealership actually has some protections in place like ID checks. I'm also not sure what dealership will mail me a key to someones car if I just call and give them my name and number. Cell phone companies port numbers almost at will because historically people complained that porting was hard. ATT is currently in a lawsuit with a person who lost 200M of bitcoin because they ported out his number. Social engineering it not the only way though. From this article:

https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/

Tactics like social-engineering or strong-arming the phone company to subvert two-factor comprise only a fraction of SMS vulnerabilities. Fake cell phone towers known as IMSI catchers or "stingrays" can intercept text messages, too. And the security community has recently been calling attention to weaknesses in SS7 ('https://www.wired.com/2016/04/the-critical-hole-at-the-heart-of-cell-phone-infrastructure/'), the protocol that allows telecom networks to communicate with each other. Hackers can exploit SS7 to spoof a change to a user's phone number, intercepting their calls or text messages. "Any network can tell any other network 'your subscriber’s here now,' and until your phone says otherwise, every call and text is diverted to this other network," says Karsten Nohl, the chief scientist at Security Research Labs, who recently demonstrated the attack for 60 Minutes. "If there’s an attacker, they get all your text messages. it’s completely trust-based...It’s so simple it’s almost embarrassing to call it a hack."


That was 2 years ago, and the attacks have only gotten easier to pull off. I know someone who makes their living on IG, and this was one of their biggest fears. Finally adding a secure 2FA method is a big deal.
Rating: 1 Votes
Avatar
Jyby
18 months ago

Cause, you know.... Facebook would never misuse the phone number you provide.

Oh wait they were already caught selling numbers provided for 2FA.


Yeah your phone number, mobile unique id, your browser fingerprint... It all links up to a profile that connects your data to the bulk intelligence store (for advertisement and consumer research)... This is how you can google your home address and see all your personal information... Why are there 30+ companies with the same info? Someone has created a standard for identifying people.. Just like insurance companies and doctors offices try to do when they get your social security number..
[doublepost=1539191860][/doublepost]

Don’t listen to this guy. Hiding under a rock is no way to live your life.


I agree- but I also believe there's no reason companies should just hold onto personal data you want to let go. Or track you and try to manipulate you into buying or believing something... Because some machine learning/AI computer profiled you and your behavior.. Allowing people in control of that information to play games with your behavioral biology..

I don't want to be behaviorally manipulated on purpose for capital gains of somebody else.. Thats immoral.
Rating: 1 Votes
Avatar
mdatwood
18 months ago

Trivial how?


There is lots of information online, but this describes the easy social engineerings ones.

https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/
Rating: 1 Votes
Avatar
mdatwood
18 months ago
Since we are having a conversation about sim hacking, this timely article came out today.

https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-instagram-email-tmobile
Rating: 1 Votes
Avatar
makr
18 months ago

2FA did little to protect my instagram account from being hacked. I was not even able to fully reclaim it. Only solution was to delete and I don't miss it one bit.

How did they hack your account with 2FA on?
Rating: 1 Votes
Avatar
Jyby
18 months ago

Those are encrypted data tho, right?


Not in the case of Cambridge Analytica. They had access without the need to bypass encryption. Furthermore, if actors can manage to get into your authorized device list (or circle of trust), like China might with Apple servers in their country, they would also have access to the protected information without bypassing the actual sting encryption.

Disclaimer, this is all speculation.. no need to live life paranoid. But I do agree as a society we need to evaluate how we use technology and what could go wrong if the technology is misused. I believe the founding fathers of America also thought this through for politics. We’re now at a point where we need to evaluate ourselves collectively again.
Rating: 1 Votes
[ Read All Comments ]