I just realized that Craft puts the username into the path of the
photoUrl. Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.
Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?
I would like to get around adding a new asset field for every user, since the user photo would be fine.
Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.