Remove username from photoUrl path
Since I use email addresses as usernames, I don’t think it’s a good idea to expose the email addresses of all users on the web.


I agree, and that's something we overlooked when we added the 'useEmailAsUsername' config setting.


  Question: Is there a way to remove the username (in my case email address) from the photo path and replace it with the users ID for example?


Currently not, unfortunately.  And it's hard-coded so there really isn't a chance for a plugin to override the behavior.  And I don't think it's really any better to be displaying a user's ID or UID as well, since people wouldn't expect those to be publicly available by default.


  Bonus question: is there any way to protect user photos from access at all? It looks to me like the urls to the user photos could be guessed quite easily.


Again, no.

I think the proper solution to both problems would be, upon uploading a user profile photo, generate a random string and save that along with the user in the database.  The string would be used in the URL when retrieving the user's profile photo. 

I'll add it to our list to address.