[catch23]

couldn't they just solve it by serving up an image with a hash of the facebook uid as the filename?

[maurycy]

Facebook uid = users.id? It gives zero privacy then.