Facebook’s New Privacy Feature Comes With a Loophole