If you ever posted any (ahem) questionable pictures to your "private" Instagram account prior to this weekend, then you may have given your boss, spouse or parent easy access to those images without even realizing it.
A Quartz report published Monday revealed that a (suggestively labeled) "privacy hole" on Instagram has been exposing the photographs posted to ostensibly private accounts. For example, say you snapped a selfie at a party but decided you didn't want it publicly viewable, then switched your account to private to conceal it -- that photograph could still have been seen by anyone via their web browser.
How? Any individual with access to your account via Instagram.com could click on one of your photos, copy its URL and share it with anyone else, regardless of who they were. If the photograph was initially posted while your account was public, it didn't matter that you later marked it as private: Anyone with the URL could still view the photo.
Instagram reportedly fixed the problem in response to inquiries from Quartz, but the loophole nonetheless proves an old adage: If you post something "private" online, don't assume it's completely safe.
In a statement to Quartz on Jan. 8, an Instagram representative seemed to suggest that the functionality that allowed individuals to share private photos was intentional.
"If you choose to share a specific piece of content from your account publicly, that link remains public but the account itself is still private," the representative said.
But following Quartz's investigation, Instagram appears to have reconsidered, and the company told The Huffington Post that it has nixed access private photos via public links.
"In response to feedback, we made an update so that if people change their profile from public to private, web links that are not shared on other services are only viewable to their followers on Instagram," an Instagram spokesperson told HuffPost via email.
Of course, even with the loophole closed, it's very easy for someone else to share your photographs online without your permission. While they can't grab an image's URL from Instagram.com by right-clicking on it, they can still access its URL by viewing the page source. Then they can circulate that URL to anyone. On Facebook, sharing "private" photos is even easier -- you can still right-click to copy an image URL. Simpler still: Take a screenshot of an image and share it that way.
If this all sounds complicated, we have some unfortunate news: It is not, and it's not like we're not giving away any secret hacks here. If you post something "private" online, then make sure you realize that word means something different online.