Slashdot Mirror
The Hidden Security Risk of Geotags
pickens writes "The NY Times reports that security experts and privacy advocates have begun warning consumers about the potential dangers of geotags, which are embedded in photos and videos taken with GPS-equipped smartphones and digital cameras. By looking at geotags of uploaded photos, 'you can easily find out where people live, what kind of things they have in their house and also when they are going to be away,' says one security expert. Because the location data is not visible to the casual viewer, the concern is that many people may not realize it is there; and they could be compromising their privacy, if not their safety, when they post geotagged media online."
This is why upload services should simply just strip out the un-needed info of the pictures. The original pictures still have the sometimes useful geolocation data, but your Facebook pictures won't.
Taxation is legalized theft, no more, no less.
Might want to take a look at jhead. jhead -purejpg will, as the name suggests, strip everything that isn't actually the image.
OMG, letters have post marks and tell what town the sender lives in!
OMG, caller ID gives my phone number to people that I call!
OMG, the Registry of Deeds lists my address and how much I paid for the house!
OMG, the phone book list my name, phone number and address!
We've been dealing with stuff like this for decades, right? I think the danger is more about the contents of your tweets ("I am on vacation") than the metadata ("I live here"). I can probably find your address if I wanted, even without Flickr metadata.
Of course, metadata can lie as well. Maybe I want to say, "I have a big coin collection" in Twitter and put photos of it all over the place on the web, but with false geotag data to make it look like it came from someone else's home. Because of that risk, even those who do not use Twitter, or the iPhone or Flickr are also at risk. Gee. maybe we should just lock our doors at night.
http://www.sentex.net/~mwandel/jhead is a nice Exif Jpeg camera setting parser and thumbnail remover. Try it and get scared. Geotags are new, but the problem has been there for years. The "hidden" parts of images give away camera model, camera time, camera serial number and that is just the tip of the iceberg. Always open and save images in some editor such as GIMP before uploading them to the Internet(s). This is a good idea anwyay as viewers will generally be more happy if you crop the picture, perhaps adjust the color balance etc.
9/11: Never forget it was a false-flag operation
Help, they can see me going into my house!
They will know where i live..
WHERE IS MY TIN FOIL HAT?!?!
Don't post media on unprotected pages. No big loss behind this step. Friends and family can handle a simple user/password combination - we've been doing this for years. Trust me, the rest of the world doesn't really want to see your pictures of the kids at their friend Joey's birthday party.
OP states "By looking at geotags of uploaded photos, 'you can easily find out where people live, what kind of things they have in their house and also when they are going to be away,'..." How can uploaded photos tell someone when I am going to be away? Can pictures now show us what we'll be seeing and where at some point in time in the future? Neat... So, what setting do I use for my DSLR to get it to show me where I'll be going and when I'll be away? I want to see what's ahead of me.... Maybe it can show that I am currently away but how can it show when I'm going to be... anything? Oh, now I get it... I should take a picture of my airline tickets or hotel booking and post those on line... Yeah, that's how they'll know....
Or, you can just use ImageMagick:
$ mogrify -strip image.jpg
Palm trees and 8
Yup, and it recompresses the image when you do so. See suggestions here for ways of stripping it without recompressing.
Disclaimer: IANAL. This post is, however, legal advice, and creates an attorney-client relationship.
Potential security issues aside, geotags have always concerned me with the potential for unintended consequences. As someone with a passion for both native orchids and other rare life forms, along with history, I'm always concerned how an innocent snapshot by someone using geotagging might provide detailed location data to a poacher or pothunter. I've already seen a few plant populations decimated by a mere Flickr post, and I know I've seen geotags for the same species at other locations. I think it is a feature that should be disabled by default and used only with caution.
I actually mean that literally. We go on and on about various privacy risks and on and on about how stupid "average people are" when there are some obvious patterns of behavior outside of computing/networking that shed some real light on where the problems originate.
People simply don't understand the world they live in. They don't understand their cars, their food (c'mon diet coke? really? that nutrasweet that slows your metabolism?) or just about anything? They might think they know some things but not really understand them and nor do they really care to. The people get "flu shots" every year not knowing what strains of influenza are actually being covered by this year's flu-shot-du-jour... they just expect "the experts" to know and to do what they are told.
So who are these experts that the masses follow? Whoever claims to be. The dairy council, for example (you know, the guys who make their living selling dairy products?) tell us every year to drink even more milk than last year. And Microsoft, the company who helped to make "computer virus" a household word and cares more about selling the same thing over and over again instead of redesigning an OS that is both easy and secure. And a lot more. The people who have the most to gain by people being stupid are the "experts." And of course, questioning is something that is beaten out of us by the time we get through the first years of public school so there's no chance of a renaissance happening any time soon... at least not without a dark ages preceding it.
The problem is much, much larger than just being aware of meta-data in a picture. And yes, I agree with some here who suggest that "these online services should really have our backs" on this sort of thing, but it's not really in their interests to do so... so why would they?
Gimp has an exif option, I have not used it.
But if you take a photo for Wikimedia Commons and strip the Exif, and your photography skill looks professional, some regular might assume that you are fraudulently claiming copyright ownership of some other photographer's all-rights-reserved images. Preserving your camera's Exif data tends to shift the burden of proof to whoever is calling bullshit.
It seems that quite a few geotags on the porn I download are at my house. The time stamps are when I'm at work.
Have gnu, will travel.
[*] Separate purchase of time machine required for viewing geotags on photographs from the future.
There's a pretty big site dedicated to the growing of marijuana, where the users post pictures of their grow operations from behind the "protection" of proxies. :)
Just for kicks one day I started checking their pictures. About 20 to 25 percent of them were geotagged. Some of those grows had hundreds, if not thousands of plants. So much for hiding behind a proxy.