How private are your Facebook photos?

UPDATE 2/11/11: It appears that Facebook has put at least one measure in place to help prevent issues. As you can see below, the image from Facebook no longer sources into this post. It appears they now prevent hotlinking of their images. However, you can still access private photos by clicking the direct link to the photo. That's something that they likely can't prevent.

I had an extensive discussion with a friend recently about posting pictures of our kids online. He won't do it, going so far as to require friends to remove any photos they have on Facebook or elsewhere that include his kids.

First, I'm not a paranoid person, so the privacy issues aren't a huge concern to me. I try not to make it easy for you track me down, but really, a Google search or two and you could be knocking on my front door. That goes for most people.

Second, I argued that even if you're paranoid, Facebook's privacy settings allow you to restrict who sees your photos.

I recently realized this second point really isn't entirely true.

Below is a photo I took with my phone and posted on Facebook. I took it on Saturday as my kids looked out the window at our big snowfall.



When most people send someone else a link to a Facebook photo, they simply copy the URL. For this photo, they would send this: http://www.facebook.com/photo.php?fbid=606953874260&set=a.570112459750.2102325.184901250. However, you would be unable to view that photo unless you're friends with me. My Facebook privacy settings don't allow anyone but my friends to see my photos.

However, the photo above is sourcing directly from Facebook's servers. Here's the direct link to the photo: http://sphotos.ak.fbcdn.net/hphotos-ak-snc4/hs1168.snc4/151092_606953874260_184901250_34727626_5009187_n.jpg. That link probably isn't familiar since there's no "facebook.com" in the link. The only indication it comes from Facebook is "fb." You can view that photo just by clicking that link, regardless of whether or not you're friends with me on Facebook.

Now, only my friends can access the page in my Facebook photo album with this photo. They're the only ones who could right-click on the photo, click "Save as..." and save it on their computer. They're the only ones who could right-click on the page, click "View page source" and get the link to where the image is hosted on Facebook's servers.

Still, if you don't have to even have a Facebook account to view a photo posted on Facebook's servers, how easy might it be for someone to access other photos on those servers?

I'm still not paranoid and I won't quit posting photos to Facebook. I am reminded, however, that regardless of privacy settings, once anything is posted on Facebook I have to assume that anyone may see it.