Think Your Private Instagram Posts Are Private? Guess Again

Anyone who has a Facebook or Instagram page and thinks that posts they make to a private account are actually private may be disappointed. Photos and videos that are put into private accounts on Instagram and Facebook are still vulnerable to a straightforward workaround that allows any of that content to be shared. The workaround also enables the sharing of Instagram Stories content as well.

A user only needs a very basic understanding of HTML to exploit the workaround and the ability to make a few clicks. The user simply needs to inspect the images and videos that are loaded on the page and pull the source URL from the page. That public URL can be shared with people who aren't logged into Instagram and don't follow the private user.

The workaround allows the sharing and viewing of JPEGs and MP4s from private feeds and stories. Instagram parent company Facebook seems to be unconcerned about the workaround having issued a statement to Buzzfeed saying this issue was like taking a screenshot and didn't give access to a private account.

To make things worse for users, if you delete a private post that has been shared in this way, the content is still viewable via the link. That means posts meant to last only 24 hours are visible with the URL sharing workaround for days or longer after the stories expire. There is no way to know if a private photo or video is shared this way because views via a public URL aren't tracked.

While Facebook contends that this workaround is nothing more than taking a screenshot, the URL method does contain more data than a screenshot. The URLs contain basic info on the photo or videos like how it was uploaded and photo dimensions. Facebook had another significant privacy issue recently that exposed over 400 million personal phone numbers.