The knowledge that people can ref things by their hash is a serious problem for power centers.

What does this comment mean? I understand the words, but not the meaning.

> power centers.

What does this mean here?

Who gives Facebook the authority to do so?

Those who agreed to the terms of service and uploaded their pictures.

This is akin to asking who gives Facebook the permission to badly compress pictures? The answer's same.

This is a really weird question. If it's not prohibited, why shouldn't you be allowed to do something by default? Isn't that a basic thing in all(?) legal systems?

I don't know if this is a rhetorical question or strongly held belief on your part, but this kind of thinking is what has led to such a grotesque invasion of personal privacy via trackers and other data gathering techniques the last few years. Legality is not the right standard. How about basic courtesy and erring on the side of respecting user privacy?

If all of us pushed our behavior to the legal limit, society would likely fall apart. Orderly society only happens because the vast majority of people respect the rights of others.

In copyright, for example, all-rights-reserved is the default if nothing else is specified.