ndza

Instapaper RSS token scoped too wide and can't be reset

In my previous post, I mentioned how I've used an Instapaper RSS feed for my curated collection of Must-read links. I did this by proxying the RSS feed through this site. And any link I save in Instapaper, I can tag it as must-read and it pops up on the feed and on this site.

While doing so, I noticed that the Instapaper RSS feed URL actually contains a private token. For my tagged collection, it looks like this: https://www.instapaper.com/rss/tags/<my_tag>/<subscriber_id_or_something>/<token>

So, if I want to share this tagged collection as a feed, I can share this URL. But, wait! No! Don't do that! The token is scoped too wide. It's for the entire account. So, all my links are visible through feed URLs with other tags.

Besides tags, folders are also visible through feed URLs like this too: https://www.instapaper.com/rss/folder/<folder_id>/<subscriber_id_or_something>/<token>

Heck, even the entire collection is visible through a feed URL like this: https://www.instapaper.com/rss/<subscriber_id_or_something>/<token>

I've tried searching for a setting to reset the token or to keep them private, but couldn't find anything. There's something of a checkbox when editing the folder as shown below, but it doesn't seem to serve a purpose. A screenshot of Instapaper's edit folder dialog

So, once it's leaked, everything is accessible.

Not happy. I've written to Instapaper about providing a way to at least reset the token.