An example: https://www.facebook.com/photo.php?fbid=263620283790579&set=...

"We're using PBE" is obviously not quite the kind of answer that was expected here. For all we know, you could be OR-ing the characters of the password and doing a rotX with the result. Hardly secure.

Not sure why i cannot reply to the comment below, so i reply it here. The encryption use is PKCS #5 (5.3 PBE with MD5 and DES). The algorithms are outdated but in the subsequent release we can update it to SHA-2 and AES-256.