Instagram makes API calls to non-HTTPS endpoints with session cookies in the request headers allowing full session hijack by a malicious actor.
Steps to reproduce (on Mac OS X):
- Jump on an open or WEP encrypted wifi access point
- Put your network interface into promiscuous mode filtering on i.instagram.com