> The only solution I can think of is having an application server serve the pictures after authenticating the request. Or, make the URL fbcdn.com/p/timestamp/

> The only solution I can think of is having an application server serve the pictures after authenticating the request. Or, make the URL fbcdn.com/p/timestamp/hash of internal salt + timestamp/unique ID.jpg. If the timestamp isn't from within the past 2 minutes, don't serve the image. Almost every static server offers this as a plugin, and it doesn't need to touch a database. AWS offers something similar as a time-limited "access key".