Right, my bad on the ambiguity—I was replying to the OP's concern about image sizes, not the attack in TFA:

> It really doesn't matter that they can't see an image or video, knowing its size upfront or later (for example in response to a law enforcement request) is enough