Friday Tech Tip: Scrub Your Photos!

Welcome back to the Friday Tech Tip! (Did you want this yesterday? If you were a Patron, you could have seen it already!)

I took this picture on my phone at a protest over the summer. How much information does it give away?

If you’re from the area, you might know where it is. The subject is obviously a Black Lives Matter protest. There are people’s faces, covered by masks.

Hidden in the image, there’s a lot more information, called metadata. Let’s take a look at just a few of the bits there:

Make : Apple
Camera Model Name : iPhone XS
Orientation : Horizontal (normal)
Software : 13.5.1
F Number : 1.8
Exposure Program : Program AE
ISO : 25
Flash : Off, Did not fire
Lens Model : iPhone XS back dual camera 4.25mm f/1.8
Lens Make : Apple
GPS Altitude : 89 m Above Sea Level
GPS Latitude : 41 deg 33' 23.80" N
GPS Longitude : 73 deg 2' 32.18" W
Date/Time Created : 2020:07:04 14:45:35

Wow! Just from one photograph, you know that at the time I was using an iPhone XS running iOS 13.5.1. I took the photo on 7/4/2020 at 2:45:35pm. This metadata isn’t all bad: Photographers often reference the technical details of a photograph (flash, F Number, Exposure, ISO and so on).

And you know where I was! We can easily convert 41 deg 33′ 23.80″ N and 73 deg 2′ 32.18″ W to decimal GPS coordinates and see exactly where the photo was taken:

That’s where the event was, right on the Waterbury Green.

But let’s say someone wanted to attack me. They’d where I was – and imagine if I’d shared a photo from home! GPS is powerful enough that it can at least give a general block or half-block radius of where you live. A tech-savvy attacker could also try to exploit the some kind of vulnerability they know in the version of the iPhone software I’m running.

Social Media

Surprisingly I’ve found that Facebook, Instagram, reddit and Twitter strip creation date, location and camera metadata when you upload a file.

Facebook and Instagram, though, add metadata to a file:

Current IPTC Digest : c963e2c8f3475ab56d9fcf1f2f70b695
Special Instructions : FBMD2300096a010000591b0000b0230000c62d0000694c000085650000dc700000d89800003ab9000054d00000

Both Facebook and Instagram add “Current IPTC Digest”; only Instagram adds “Special Instructions.”

When I uploaded the same source file to Facebook and Instagram, they both ended up with the exact same Current IPTC Digest. It’s some kind of marker to track the file, and Facebook can use this to track who’s uploaded a file.

And there’s no guarantee that Facebook doesn’t save the location and camera metadata somewhere before removing it.

So what does this all mean? If you share a photo on social media, some identifying information will be removed, but Facebook and Instagram will add traceable information without your knowledge or consent. That metadata will exist in every copy of the file downloaded and shared until it’s cleared out.

If you text, Messenger or email a file from your phone, all the original metadata stays with it and is readable by the recipient and anyone they share the file with.

Solutions

Signal removes metadata from photos before you even send them. If you want to share photos elsewhere but still want to remove that information, check out EXIFPurge on Mac or Windows. On an iPhone, TNW has a great tutorial on setting up a shortcut to do this without any additional apps. For Android phones, try Photo Exif Editor.

No matter what, don’t forget to trash the original photo so you don’t get confused and send the wrong file!