It shouldn't be too much of a pain to do. I do something like this on http://thingist.com (Not caching facebook photos, caching the randomly generated 3x3 pictures that it gives you if you don't connect with facebook [the script to generate the pictures is expensive])

The python to do it would look something like this:

def cache_fb_photo(fb_uid,cache_name):

     import urllib
     import time

     request = urllib.urlopen("https://graph.facebook.com/%s/picture" % (fb_uid))

     photo = request.read()

     photo_location = "/path/to/photo/cache/cache_name"
     cached_photo = open(photo_location, "w")
     cached_photo.write(photo)
     cached_photo.close()

This may or may not violate facebook's ToS. Obviously it would take more than this to actually put it into production, but this would kindof work.

There really isn't a way around that (as far as I can tell) beyond caching them on your server.

Your relaxed attitude to privacy is enough to make me never use that site, sorry.

The fact that it is a 'pain' to make the effort to protect someones identity means you're probably in the wrong business.