While Instagram's new multiple accounts feature was a long-awaited advantage for corporate users, it brings with it a security flaw that demolishes the treasured barrier between personal and professional social network use.
A bug in Instagram's multiple accounts feature allows Android users to view private messages (called "direct messages" on Instagram) sent to the personal accounts of other users with whom they share access to a different account.
For example, if two or more Android users each have personal Instagram accounts while sharing access to a corporate Instagram account, and a direct message is sent to any one of their personal accounts, they may all receive push notifications for the private message intended for just one of them.
The push notifications (abbreviated notifications that appear on users' smartphone lock screens) do not allow users to read the full message or respond to it. The misdirected notifications, if swiped or tapped, merely send the user back to their personal Instagram account.
ITWeb Security Summit 2016
Don't miss the definitive event for security professionals:
17-18 May (conference and expo), 19 May (workshop)
Vodacom World, Midrand
Book today!
Yet the bug nonetheless breaches users' privacy in allowing others to see the first few words of a message intended for their eyes only, as well as which user sent it.
It is unclear whether the bug makes Android users privy to iOS or Windows Phone users' messages as well.
Instagram told Mashable on Tuesday that the bug had been fixed.
The social network is also working on implementing two-factor authentication, according to Android Headlines.
Whereas logging into an Instagram account previously required only a username and password, the social network will soon demand the user's phone number - verified by asking users to enter a short code sent to them via SMS - as an additional security measure in the login process.
Share
