I was browsing pictures of a friend on Facebook. This friend has their privacy settings configured so that you have to be a friend to view them. I'm not able to share them, and even if I open a pic, copy the URL from the address bar, and share it with someone who is not their friend, they're unable to view it.
However, I found a flaw in that routine. If you open up such a picture just the same, then right-click the picture and choose "Copy Image URL" (may differ depending on browser), and share that copied URL, then other non-friends are able to view it.
Is this supposed to be possible? Or is this a security breach in Facebook?
To be more specific, when I copy the image URL from the address bar, I get...
However, when right-clicking the picture and copying the image URL, I get...