On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.
In the context of privacy and security on a social network, I'm assuming most people think these images etc. are secured. But are they?
Am I right in assuming that actually the security comes from the fact that an uploaded image just has some kind of extremely hard to guess
guid that forms the url? The fact that an album is hidden, therefore projects the urls for it's contained images being seen, but if someone had the URL for a specific image they could view it regardless.
I know you can use scripts that generate an image (e.g a php script) whereby the image itself doesn't have an actual URL and is above the document root, but is more of
$_GET parameter and the script could therefore enforce security. But something the scale of Facebook and Google where you would be relying on CDNs to deliver this content, a script handler for every image doesn't seem viable.
Am I right in assuming it's actually just security through obfuscation? Or do these sites employ some kind of sophisticated ACL to actually control access to individual images? How should this be handled in the context of social networks e.g more image based then truly sensitive files? (though obviously an image itself could be sensitive to the uploader)