301–310 of 330 posts
Is it possible to extract exif info client side (in browser, via javascript) and then upload photo standard way and exif metadata via side channel?
It uses native APIs to request the media file from the OS and since the app doesn't request the permission to receive location data along with it, the OS provides the files without the location
Related permission: https://developer.android.com/training/data-storage/shared/m...
Earlier quoted context omitted.
Wait... You post selfies on Google Maps? The thought never crossed my mind. What would the purpose be? Sorry I'm probably thick...
For that sweet local guide score.
Earlier quoted context omitted.
Obviously an image picker shouldn't leak filenames... The filename is a property of the directory entry storing the file storing the image. The image picker only grants access to the image, not to directories, directory entries or files. If you want filenames, you need to request access to a directory, not to an image
"Obviously" There are plenty of use cases where the filename is relevant (and many, many people intentionally use the image name for sorting / cataloging).
Earlier quoted context omitted.
You have way more faith in the government not using any information it has against you than I do…. You have been paying attention to what’s going on haven’t you?
A government agency, which might even have good use for the data, isn't the problem. The problem is sending your precise location to Facebook and a two dozen silly little games and a note app, which all sell this data to anyone and their brother. By framing the problem as being with untrustworthy government agencies rather than with greedy data brokers selling data everywhere, you are part of the problem. You may dis…
Earlier quoted context omitted.
Really? You don’t understand why people wouldn’t want to share their location with the government?
If a state environmental agency asks you for your location on photos that you volunteered to upload and you freak out, you might be mentally ill.
This is a common approach to "privacy" taken by orgs like Google. You don't get to access or export your own data in order to protect your privacy, but Google still gets 100% access to it. Some messaging apps do the same and won't let you take a screenshot of your own conversations. Like, someone sent me an address, but I can't take a screenshot to "protect my privacy".
Which messaging apps are those? I have only seen such behavior for one-time photos, where it makes sense (although one-time photos are security theater because nothing prevents you from taking a photo of the screen with another device).
Show a location picker with the user's current location and the option to select an alternative location. Not as smooth as using EXIF data, but doable.
I wish they'd just switch to fuzzing the location instead of stripping it entirely. Instead of specifying 6 digits of lat/lon, publish 1 digit to identify what rough area you're in (to about 10km). I've done a lot of neat projects with geolocation over the years. Including a personal travel diary, a bunch of visualizations of tweets and Flickr photos, etc etc. I am sad that's become nearly impossible but I do respect…
Depending on how populated your current location is, even a fuzzed location can reveal personal information. In a city, 10km is fine, nobody is identified. But if your home is the only one for 10km in any direction, and your fuzzing threshold is 10km, you've identified down to a single home.