Facebook: Alleged security vulnerability profile picture visible to everyone?

For some time now, a text has been circulating on Facebook that reveals a supposed “security hole”.
These are profile pictures that shouldn't actually be released publicly. Of course, we should all be aware to some extent that the thumbnail of the profile picture that a user is currently using cannot be hidden. This profile picture is basically the figurehead of a profile and should actually make it easier for a searcher to find the one they know among several people with the same name. That's why we wouldn't necessarily call the whole thing a security hole, but simply a little trick.

This text draws attention to the gap:

Gap on Facebook to be able to view profile pictures that have not been shared:

• Poke that person.
• Immediately nudge this person again and a message window will open indicating that this person has not yet responded to your last nudge.
• Right-click on the – now completely – displayed profile picture and open it in a new tab/window.
• In the address bar in the URL, replace “fbcdn-profile-a.akamaihd.net/hprofile-ak-snc7” with “fbcdn-sphotos-ca.akamaihd.net/hphotos-ak-prn1” and if necessary change the “ s" into an "n" and you have the URL to the entire profile picture - regardless of whether it is shared with you or not.

Of course, this is preferably shared as an image:

Of course, we tested the whole thing for you and want to show here what exactly happens.

So steps 1 + 2 lead to the following note:

As you can see, instead of the thumbnail, the complete photo that the user uses as a profile picture can be seen in the information window. So if you see more there than you actually wanted to show, you should consider whether you would rather use a different photo or upload the desired section in the size 180×180 pixels.

In step 3, we open the image in a new tab or window by right-clicking as described in the text:

So now we have the image in the size in which it was displayed to us in the information window.
In step 4, we change the URL so that we can see the image stored on FB's server in its original size. Voila, the “gap”:

So we see nothing really reprehensible happening here.
The only time it could be unpleasant is if the original size image used shows more than you would like. Not that the boss or other “unauthorized” people suddenly get intimate insights. The visibility of profile pictures (whether currently in use or not) can be determined separately for each picture in the “Profile Pictures” album. To do this, simply open the album or profile picture and make a new selection next to it.