Slashdot Mirror
The Hidden Security Risk of Geotags
pickens writes "The NY Times reports that security experts and privacy advocates have begun warning consumers about the potential dangers of geotags, which are embedded in photos and videos taken with GPS-equipped smartphones and digital cameras. By looking at geotags of uploaded photos, 'you can easily find out where people live, what kind of things they have in their house and also when they are going to be away,' says one security expert. Because the location data is not visible to the casual viewer, the concern is that many people may not realize it is there; and they could be compromising their privacy, if not their safety, when they post geotagged media online."
This is why upload services should simply just strip out the un-needed info of the pictures. The original pictures still have the sometimes useful geolocation data, but your Facebook pictures won't.
Taxation is legalized theft, no more, no less.
Might want to take a look at jhead. jhead -purejpg will, as the name suggests, strip everything that isn't actually the image.
OMG, letters have post marks and tell what town the sender lives in!
OMG, caller ID gives my phone number to people that I call!
OMG, the Registry of Deeds lists my address and how much I paid for the house!
OMG, the phone book list my name, phone number and address!
We've been dealing with stuff like this for decades, right? I think the danger is more about the contents of your tweets ("I am on vacation") than the metadata ("I live here"). I can probably find your address if I wanted, even without Flickr metadata.
Of course, metadata can lie as well. Maybe I want to say, "I have a big coin collection" in Twitter and put photos of it all over the place on the web, but with false geotag data to make it look like it came from someone else's home. Because of that risk, even those who do not use Twitter, or the iPhone or Flickr are also at risk. Gee. maybe we should just lock our doors at night.
http://www.sentex.net/~mwandel/jhead is a nice Exif Jpeg camera setting parser and thumbnail remover. Try it and get scared. Geotags are new, but the problem has been there for years. The "hidden" parts of images give away camera model, camera time, camera serial number and that is just the tip of the iceberg. Always open and save images in some editor such as GIMP before uploading them to the Internet(s). This is a good idea anwyay as viewers will generally be more happy if you crop the picture, perhaps adjust the color balance etc.
9/11: Never forget it was a false-flag operation
Yes, I was going to recommend jhead as well. I haven't used it for deleting EXIF headers, but I have used it to get a list of what focal lengths I've used for all of my photos. It's a handy free utility, and I wish it worked on RAW photos as well.
Slashdot's first reaction to VMware
Help, they can see me going into my house!
They will know where i live..
WHERE IS MY TIN FOIL HAT?!?!
You can use the "-strip" command-line option with ImageMagick's "convert" utility to strip out all the metadata from an image prior to uploading it.
The Lumber Cartel, local 42 (Canadian branch)
British Columbia, Canada
Don't post media on unprotected pages. No big loss behind this step. Friends and family can handle a simple user/password combination - we've been doing this for years. Trust me, the rest of the world doesn't really want to see your pictures of the kids at their friend Joey's birthday party.
OP states "By looking at geotags of uploaded photos, 'you can easily find out where people live, what kind of things they have in their house and also when they are going to be away,'..." How can uploaded photos tell someone when I am going to be away? Can pictures now show us what we'll be seeing and where at some point in time in the future? Neat... So, what setting do I use for my DSLR to get it to show me where I'll be going and when I'll be away? I want to see what's ahead of me.... Maybe it can show that I am currently away but how can it show when I'm going to be... anything? Oh, now I get it... I should take a picture of my airline tickets or hotel booking and post those on line... Yeah, that's how they'll know....
Presumptively a 'safe' geotag is one that the user has control of.
The user should have options (A) No geotag [the default], (B) Fuzzy geotag that may reveal what city or state they are in, but not their actual location, (C) Hi-Res Geotags
Their phone should ask them how detailed the Geotag should be before they take pictures.
Their graphics software / picture sharing websites should ask what to do with Geotags before uploading.
e.g. (A) Hide/remove all geotags, (B) Only let friends see GeoTag information, (C) Make all Geotags fuzzy
With the default being A.
Or, you can just use ImageMagick:
$ mogrify -strip image.jpg
Palm trees and 8
It's worth pointing out that not all services are ignorant to this issue. I use flickr and upload geotag information for every picture I take, but, nobody can see it unless they are someone I've accepted as a contact. You can ratchet things up a bit further and use their added friend and family classes for even more restriction. You can also reveal the data on a photo by photo basis if you don't mind it being seen (or actually want it available, like a photoshoot of interesting things in a public place.)
I'm sure other similar photo sharing sites have similar permissions capabilities. I suppose the most likely risk areas are the twitpics and yfrog type upload it and forget it sites.
I read the script, and I think it would help my character's motivation if he was on fire. -Bender
Potential security issues aside, geotags have always concerned me with the potential for unintended consequences. As someone with a passion for both native orchids and other rare life forms, along with history, I'm always concerned how an innocent snapshot by someone using geotagging might provide detailed location data to a poacher or pothunter. I've already seen a few plant populations decimated by a mere Flickr post, and I know I've seen geotags for the same species at other locations. I think it is a feature that should be disabled by default and used only with caution.
This is pretty obvious. Without even going into detail, once you know what "geotags" are, the first thing that comes to mind is "oh crap. this could be a big problem."
I actually mean that literally. We go on and on about various privacy risks and on and on about how stupid "average people are" when there are some obvious patterns of behavior outside of computing/networking that shed some real light on where the problems originate.
People simply don't understand the world they live in. They don't understand their cars, their food (c'mon diet coke? really? that nutrasweet that slows your metabolism?) or just about anything? They might think they know some things but not really understand them and nor do they really care to. The people get "flu shots" every year not knowing what strains of influenza are actually being covered by this year's flu-shot-du-jour... they just expect "the experts" to know and to do what they are told.
So who are these experts that the masses follow? Whoever claims to be. The dairy council, for example (you know, the guys who make their living selling dairy products?) tell us every year to drink even more milk than last year. And Microsoft, the company who helped to make "computer virus" a household word and cares more about selling the same thing over and over again instead of redesigning an OS that is both easy and secure. And a lot more. The people who have the most to gain by people being stupid are the "experts." And of course, questioning is something that is beaten out of us by the time we get through the first years of public school so there's no chance of a renaissance happening any time soon... at least not without a dark ages preceding it.
The problem is much, much larger than just being aware of meta-data in a picture. And yes, I agree with some here who suggest that "these online services should really have our backs" on this sort of thing, but it's not really in their interests to do so... so why would they?
For those who have forgotten, Google is trying to do location based analysis without the geotags - you send them a picture of a place, they tell you where it is (well, what it is for right now). No geotagging necessary.
Of course, Picasa is kind enough to mark each geotagged picture with a google map pin in the preview window - so you at least know which pics have the metadata in the tags.
Is it just my observation, or are there way too many stupid people in the world?
Why not just have a camera setting that says "Do not record geotag data within 1 minute of my selected location(s)"? Seems that would be the easiest fix. No extra processing needed.
Gimp has an exif option, I have not used it.
But if you take a photo for Wikimedia Commons and strip the Exif, and your photography skill looks professional, some regular might assume that you are fraudulently claiming copyright ownership of some other photographer's all-rights-reserved images. Preserving your camera's Exif data tends to shift the burden of proof to whoever is calling bullshit.
It seems that quite a few geotags on the porn I download are at my house. The time stamps are when I'm at work.
Have gnu, will travel.
[*] Separate purchase of time machine required for viewing geotags on photographs from the future.
There's a pretty big site dedicated to the growing of marijuana, where the users post pictures of their grow operations from behind the "protection" of proxies. :)
Just for kicks one day I started checking their pictures. About 20 to 25 percent of them were geotagged. Some of those grows had hundreds, if not thousands of plants. So much for hiding behind a proxy.