Re: I don't fully understand...
If the images are actually secure, they are in the locked box and only the family members are able to get at them. Of course, it wouldn't stop those family members copying the images and putting them somewhere public but, without that, no one without the key can get at them even if they know where they are.
Sometimes, the URL itself is the key. For instance, one of the security settings of Google Docs is "anybody with the link can access", which essentially means "everybody can access it, but good luck guessing the 64-digit hash in the URL if somebody doesn't give it to you". When you think of it, having an additional 10-character password to protect the document really seems superfluous.