Private files on Facebook and G+ are accessible by anyone who knows the URL. I'm pretty sure that's the standard practice. Is this the problem here? Surely, he

Private files on Facebook and G+ are accessible by anyone who knows the URL. I'm pretty sure that's the standard practice. Is this the problem here? Surely, he had enabled the sync gallery feature, or not?