Oooh, something shiny!
- Jul 13, 2004
These days only a really poorly coded script/app should be a concern when it comes to payloads hidden in EXIF. The bigger concern people should have is the geo location tags; a *lot* of people who post photos online don't realize that they may be accidentally revealing their detailed location information so a quick pic taken on their mobile device can actually reveal their home address (these days it's a minor thing to grab the GPS co-ords from the EXIF and then plug them into Google Maps). Something else I run into is people who configure their mobile device cameras, their dedicated cameras, and their photo processing software to automatically tag their photos with some information (eg: photographer name) and forget that that info' could up being made available when they post their photos ("could" being based on how the particular site handles metadata, resizing images, etc.). Somebody posting a "cute" picture on social media sites of their Christmas tree with the presents underneath? Takes a look at the EXIF & IPTC data... hey, there's their name and location.There seems to be quite a lot of disparity when it comes to the use of EXIF by forum developers. At least one product strips out the data claiming it's a security risk while others embrace it. I have read that EXIF data can harbour malware which might be under certain circumstance allow security holes in software to be exploited.
Does anyone have any further insight into this? Is it a real risk or can steps be taken to alleviate any potential problems?
It's how some software is handling it already; they grab the basic EXIF, strip the metadata, and then re-add the basic fields back in again. For a photography site, or at least ours, the location data isn't something we display and many of the members are aware to strip out the location before posting an image because it's really the rest of the data that people on the site care about (device make, model, lens model, camera settings when the image was taken, etc.). Making it a bit more complicated, some data like the precise lens model might be in a few different metadata spots (eg: IPTC instead of EXIF) so a library like EXIFTool make it a lot easier to work with. For some sites & scenarios I know that members manually obscure the location data with false info.I would think that having a background script strip the data from the image and posting only the pertinent data as a caption or note would mitigate most of the security concerns.
It is a privacy concern and one that many may not realize exists. But different communities have different needs. None of the sites I'm involved with these days would ever have a need/want to extract geo information from image metadata but I can easily envision some of Fixer's community members wanting to post a picture of a spot out in the middle of the desert and to be able to easily share the location information about it and being able to tag it so it can be grouped & searched on. The rest of the EXIF data (make/model/lens/settings) his members likely don't care about all but location of some images may be of interest to them.I struggle with understanding the purpose of it. While I can see some use in a photographic site, to show the settings used to capture the image, I don't follow the reasoning behind using the geotagging data. If someone wanted to share the location where they took an image, they would volunteer it in their post. To pull the location data from every image and post it seems quite an invasion of privacy to me.