Isn't it illegal to take photos of people without their permission, and then post them on the Internet?

Sadly (in this case) the answer is "probably not". I'd assume that a judge would rule that a convention counts as a public place, where one doesn't have a "reasonable expectation of privacy" from random people taking photos. (Perhaps not if the venue had a policy against taking photos, but I assume that wasn't the case?) This isn't a case of using the images for commercial or promotional purposes, either.

Of course, there may be some legal objections to the content of the post, but good luck to anyone who tries actually getting something through court.