14 DAY TRIAL // Users logged into Instagram’s photo sharing service could browse any photos posted by other members, regardless if content was published from an account that permitted viewing them only to its followers.
Viewing content from an Instagram account that is set up to be private cannot be done unless the profile is followed. The follower has to issue a request to the profile holder, who in turn can approve or deny it.
This way, the service ensures privacy of the content for the clients who do not want to have their posts publicly available.
Followers could share links to private content by mistake
By default, all profiles created on Instagram are public, and the user has to explicitly switch it to private mode.
The privacy security loophole has been fixed as a result of inquiries made by Quarts news outlet, and it appears that it stemmed from the fact that Instagram forgot to turn the privacy switch on to public accounts whose owners decided to make them private at a later time.
In the previous Instagram configuration, a link to content shared from a profile when it was in public mode would still be available after enforcing privacy settings on the profile.
However, someone trying to pry in would have to know where to look for the pics; in other words, to have the URL of the video or the image. This would not have been too difficult, considering the level sharing information online has reached.
Any of the followers could make a blunder and impart private content on a social media channel like Twitter, Facebook or Google Plus.
Private means private, for all content
With Instagram applying the patch over the weekend, access to private content published by its clients from someone that has not been approved as a follower is no longer possible. Clicking on the link would load a “page not found” error, as it should have always been.
Worth noting is the fact that any picture shared when the account was set to private was displayed only to followers.
Quartz communicated the issue to Instagram and was initially told that concerns regarding this issue had not been received.
“If you choose to share a specific piece of content from your account publicly, that link remains public but the account itself is still private,” a spokesperson for Instagram said, implying that the service worked as intended.
After applying the patch, Instagram said the they “made an update so that if people change their profile from public to private, web links that are not shared on other services are only viewable to their followers on Instagram.”