Their photos are stored in a CDN as static files, not served using a script. Hence, by design, it is not possible to block photo URLs to a subset of people. I

Their photos are stored in a CDN as static files, not served using a script. Hence, by design, it is not possible to block photo URLs to a subset of people. I don't think the model is too bad. You have to get hold of a pretty complex URL, so only those who can see it in the first place can share it. A static CDN model makes scaling easier. Ultimately, it means the user has to share content with only those he can trust, and I think that's fair.