Hacker News Reader

Google allows attackers to retrieve the profile picture of accounts if they know the account name, which they can retrieve using this bug.

Which sounds, like they are meant to be public? If the user has already been identified, public info can’t be expected to be secret anymore.