Today I had to login into my old mailbox. It was probably one of the first email addresses I’ve ever had as a kid.

I noticed, drowning in an ocean of spam, some emails from Instagram. Someone tried to reset my password several times.

This also reminds me that I have an Instagram account. I first discovered the existence of my IG account few years ago while checking this same obsolete inbox. That time the email was different. It was a warning stating that if I didn’t logged in within a short period of time then my account may be deactivated. I didn’t care much because I’ve never really used Instagram, so I ignored it.

But this time… is different. Someone is trying to reset my password. Do they want to break into my account? My Software-Engineer-Spider-Sense tells me there is something. Even if the account is empty I don’t want it to be hacked. Plus, I chose the password when I was 20 and stupid. The password is for sure something guessable, and the combination <obsolete-mail, stupid-password> is likely a match on Have I Been Pwned.

Let’s go updating the password with something decent. After some tries I spot the correct one and I’m in. Good, it seems no one hacked the account, or at least no one changed the password before me. I use Google Chrome to generate a new shiny random password.

Let’s check the obsolete-mail on HIBP. Two breaches:

Dropbox: email address, password (salted SHA-1)
8Tracks: email address, password (salted SHA-1)

As expected.

Now back to the Instagram account. I feel immediately disoriented by the platform. I follow no one and my profile is empty, so the UI is full of call to actions:

Find your friends!
Add a profile picture!

They are trying to engage me in the system. Their purpose is to move some user engagement business KPIs defined somewhere in California.

But I’m not completely blank.

I have 100 stranger followers and I have 2 pictures.
Apparently, when I registered in 2011 I uploaded two photos before quitting immediately. The photos are quite insignificant and they have that vintage effect that was popular at that time.
There are some comments, though.

I immediately notice that almost every person that left a comment during all these years has a username similar to mine.

They are asking me to give them my username. My username is simpler compared to their one. It has only four letters, no symbols or digits. Just a simple, lowercase, four letter word.

Someone is mad at me because I took his real life nickname and then I never used Instagram.

There is one guy that tagged the official @Instagram account reporting that I am inactive. Also in this case, my username is a substring of his one.

Apparently my early, super-short experience with Instagram gave me the chance to choose a special username.

And then there are these two guys performing an auction:

Instagram username bid

Ok, ok, I know that you can find the conversation with a little research, but I enjoyed redacting their so precious nickname 😂.
The point is, are they willing to pay real money for a username on a social media? I genuinely hope that they are joking.

But this conversation reminds me that, yes, there exist people on the Internet able to do strange things just to get a special username on a platform. They have an obsession with owning early or unusual names. They call them “OG” accounts, short for “original gangster”.

I learnt about this in the summer of 2020 when Twitter suffered a social engineering attack that had a lot of media visibility. Some celebrity accounts like Jeff Bezos or Elon Musk posted a Bitcoin scam stating that they were going to send back the amount received on a wallet, but doubled.
It turns out that the origin of the attack had a different purpose. Some kids gained access to Twitter’s administrative tools so that they could take over fancy usernames and reselling later, or show them off to their friends.

What I’ll do with my original gangster Instagram account? I don’t know, i’ll probably leave it empty but aging like a whiskey in oak casks. One day I could be millionaire, or most probably, it will be deleted for inactivity.