I just tested this with the image link for a non-shared photo in a private window. It loaded without incident.
Not okay, Google.
Getting hold of one of those URLs is not going to be easy, but still this is not at all what I would expect.
Not okay, Google.
Getting hold of one of those URLs is not going to be easy, but still this is not at all what I would expect.
The size of the URL for the image resource is utterly huge. If that is truly random in its generation, there's no way anybody's ever going to guess it or enumerate it. It's all SSL, so you'd need a serious network breach for anybody to sniff it, and then you have bigger problems.
So yeah. Not that bothered upon further thought.
I still think it's OK to use Google Photos. People just should be very careful with what they chose to share.