A bit more on this... This excerpt is from the May 17 article in the Sydney Morning Herald, which made the hacking incident known to the general public (and also led to the immediate arrest of the author, Ben Grubb, for questioning in the case in Australia):
http://www.smh.com.au/technology/security/security-experts-go-to-war-wife-targeted-20110517-1eqsm.htmlIn his presentation shown to audience members, Heinrich demonstrated how he had, over about seven days, extracted the privacy-protected Facebook photos of Gatford's wife via Facebook's CDN. One photo was of Gatford sitting on the floor next to one of his children.
Heinrich blurred out the child's face but left Gatford's in.
Over the seven days or so Heinrich ran a program on his computer to guess the URL of a photo. It needed two inputs in the demonstration given to Fairfax Media - the friend ID and X. The value X was what Heinrich got the computer to guess, getting it to guess daily from about 0 to 200,000.
There IS a way, but it involves a special computer program and a week's worth of letting it run through 200,000 possibilities to guess a URL component (album or pic ID?). Now that this story is in the news, I wonder if Facebook will tinker with things again to try and prevent future hacking with this method, or at least to appear to be taking the matter seriously?