Facebook’s privacy issues have been called into questioned numerous times over the past month, and the latest discovery by Ars Technica won’t curry the social network any favor: photos deleted by users still remain on FB’s servers and anyone can access the images with a direct URL.

AT first discovered the issue three years ago and curiously tried the same trick recently, getting the exact same results. Facebook then responded with a statement, attributing the error to a storage system that never worked properly. The network’s currently working on a new one that will delete the photos within 90 days. Or so they say.

[via Gizmodo]