10 ms·

I'll be the contrarian and ask why this is surprising? Of course if an application has been granted access to files of type X, the application can access those

by sib 9y ago

I'll be the contrarian and ask why this is surprising? Of course if an application has been granted access to files of type X, the application can access those files and read / parse / write / etc those files and the data contained within them. As a user, I'd be pretty annoyed if I used Instagram, FB, Camera +, or one of the many other camera or photo editing apps on my phone and they did not have the ability to read and write the location data.

untog 9y ago
> I'll be the contrarian and ask why this is surprising? Because users aren't actually all that aware of there being location data attached to their photos. If you told them that an app could stitch together a relatively accurate map of where they'd been in a day based on the photos they took, most users would be surprised.
- adrr 9y ago
  There's a map in the albums showing where all the pictures were taken. Also IOS creates memories(machine generated albums) with location names. You'll have to be pretty naive to think it wasn't storing location.
  - untog 9y ago
    > You'll have to be pretty naive to think it wasn't storing location. I think you'll have to be pretty naive to assume that users inherently realise that "photos have location attached" automatically leads to "third party app can read location in these photos" and can lead to "build a profile of you based on your photo locations". It's not that people can't put these things together, it's that they don't ever really think about it. When you download a photo editing app you're thinking about editing a photo, not about the metadata you might be leaking in doing so.
    - chii 9y ago
      exactly - users don't use logical deduction to work out what information an app is capable of inferring. If i didn't give the app permission/information, it stands to reason that said app shouldn't be able to infer, or deduce it. If the app is able to do so, then they ought to be legally obligated to disclose this fact.
  - eradicatethots 9y ago
    Do you hate people or something? Most people probably would not realize this
  - s73ver_ 9y ago
    But those are both Apple apps. I wouldn't expect that, just because I gave access to FB or Twitter to see my photos, that they'd get the location of them too.
    - oddlyaromatic 9y ago
      Interesting. I would have thought always that yes, if I'm moving an image around, its metadata goes with it unless I've specifically taken steps to strip it. I guess we've all had different introductions to this stuff.
      - Skunkleton 9y ago
        Coincidentally, I have asked some non-technical people exactly this question. All of the people I asked didn't even understand that there was anything other than "my picture" in an image file. I would guess that if you pressed a lay-person to explain how Apple shows a map of where your photos were taken, they would guess that the information was stored separately.
  - hobarrera 9y ago
    That doesn't really make it evident that letting an app access a photo lets it access the photos location. You and I both understand that that's metadata in the file, but non-tech users don't know that much -- they might simply have never though about it enough at all.
- sib 9y ago
  Given that many social networking apps show you the location in which the photo was taken as an option for geotagging posts, it's clear that the data is there. I'll grant that users may not make the leap to thinking of building a full-on historical profile without being prompted in that direction...
  - jamiethompson 9y ago
    And I think most users would be aware of this yes. But should they be expected to understand that this location data is different to the other location data and isn't secured at all by the "share your location" permission?
  - Ntrails 9y ago
    > Given that many social networking apps show you the location in which the photo was taken as an option for geotagging posts, it's clear that the data is there. I had literally no idea. None. Probably because I don't upload photos to social networking sites from my phone. So I'd be pretty shocked that Whatsapp could plot my movements despite not having access to location data...
- tomp 9y ago
  > Because users aren't actually all that aware of there being location data attached to their photos. Users are stupid. iOS clearly asks you to allow the Camera app to access location, explaining it’s to tag photos.
  - jamiethompson 9y ago
    Stupid? Perhaps in some cases. But are you perhaps expecting to much of a layperson? How are they supposed to know that the "access photos" permissions overrides the "location" permission because the "location" permission doesn't even apply to their photo location data. Sure, we all know this. But this can't be taken for granted. Do we expect regular users to appreciate that how the location data is stored as exif data within their photos rather than separately. I wouldn't expect this of most people.
  - salvar 9y ago
    Users are human beings. You can affix a derogatory label to them if you want, but deciding that they're not as smart as your ideal of what humans should be isn't useful to anyone except your ego I guess.
kristiandupont 9y ago
It's obvious to me now, but I hadn't thought of this. So it was a surprise in that regard, and an unpleasant one even though I feel like I am less concerned with privacy than most of HN.
dsp1234 9y ago
There is no technical reason the OS couldn't stop this by stripping exif/location data from photos if the requesting application doesn't have location permissions.
- mschuster91 9y ago
  > There is no technical reason the OS couldn't stop this by stripping exif/location data from photos if the requesting application doesn't have location permissions. There is: every app that does stuff with photos (e.g. filter software or other processors) will strip the exif data now in the process.
  - vaishaksuresh 9y ago
    There is no need to strip all EXIF data. Strip just the location since that is an explicit permission needed. you can keep aperture, shutter speed, capture time etc.
    - Klathmon 9y ago
      Well I'm not in the iOS ecosystem, but I genuinely like the location data to be in my photos, and I go somewhat out of my way to ensure it stays there. Being able to search my images by location means I can easily find all images from my trip to X, or grab all the pictures I took while at my old house. It's hugely useful and I would be livid if an is update or app update started striping that info.
      - abakker 9y ago
        Simple. Make a setting that defaults to "no, don't share the exif location data with 3rd party apps" but can be changed to "yes, do that" if you want to.
        hobarrera 9y ago
        What if an app edits a photo? The exif location data would then be permanently lost. It's not as simple as that.
jakemor 9y ago
You should need access to image & location data to see where the images were taken. Period.
codezero 9y ago
As a parallel – imagine if the file picker on web browsers gave a website access to all the metadata of any file on your hard drive.
- macsj200 9y ago
  Once you pick a file, I'm fairly certain that the metadata is made available as a JavaScript Blob object containing any relevant metadata (this is how Facebook geotags uploaded photos)
  - codezero 9y ago
    Yes maybe. On one file. The iOS version gives access to all files after you allow it. That’s the point.
    - codezero 9y ago
      By any file I meant all files.
ben174 9y ago
I've spent hours of effort making sure Facebook Apps on my phone never have access to my location. It's something I'm particularly crept out with regard to Facebook specifically. I've granted them access to my photo library when I'd like to post a picture there, so this means they they can suddenly read all the photos in my library, including their exif data? If so, what are they chances they are collecting all that exif and uploading it? I'd be genuinely pissed. And if such a practice came to public eyes, wouldn't that bring up enough of an uproar to cause fb some serious harm?
- myrandomcomment 9y ago
  What are the chances? 100%
- michelb 9y ago
  Even if they are not using your exif, they will be trying to identify your locations in the photos based on the presence of other people, landmarks, or other objects. In the same way that Google does.
- hobarrera 9y ago
  What I've found works best for keeping access to photos restricted, is clicking on "Share" on the iOS photos app, and then selecting the target app (eg: FB Messenger). This means that the target app doesn't get access to my entire library -- but I can still share one (or a few) photos through it.
smoser 9y ago
If Adam Savage was caught by surprise (the location of his home was embedded in a photo he shared online) then I would think a lot of other people would be surprised too.
hobarrera 9y ago
This is probably only something that tech-related people understand (and maybe some specific types of photographers and designers). The great majority of the population doesn't really know that "photos store location", let alone join the dots to assume that these things are possible.

by sib 9y ago

untog 9y ago

> I'll be the contrarian and ask why this is surprising? Because users aren't actually all that aware of there being location data attached to their photos. If you told them that an app could stitch together a relatively accurate map of where they'd been in a day based on the photos they took, most users would be surprised.

adrr 9y ago
There's a map in the albums showing where all the pictures were taken. Also IOS creates memories(machine generated albums) with location names. You'll have to be pretty naive to think it wasn't storing location.
- untog 9y ago
  > You'll have to be pretty naive to think it wasn't storing location. I think you'll have to be pretty naive to assume that users inherently realise that "photos have location attached" automatically leads to "third party app can read location in these photos" and can lead to "build a profile of you based on your photo locations". It's not that people can't put these things together, it's that they don't ever really think about it. When you download a photo editing app you're thinking about editing a photo, not about the metadata you might be leaking in doing so.
  - chii 9y ago
    exactly - users don't use logical deduction to work out what information an app is capable of inferring. If i didn't give the app permission/information, it stands to reason that said app shouldn't be able to infer, or deduce it. If the app is able to do so, then they ought to be legally obligated to disclose this fact.
- eradicatethots 9y ago
  Do you hate people or something? Most people probably would not realize this
- s73ver_ 9y ago
  But those are both Apple apps. I wouldn't expect that, just because I gave access to FB or Twitter to see my photos, that they'd get the location of them too.
  - oddlyaromatic 9y ago
    Interesting. I would have thought always that yes, if I'm moving an image around, its metadata goes with it unless I've specifically taken steps to strip it. I guess we've all had different introductions to this stuff.
    - Skunkleton 9y ago
      Coincidentally, I have asked some non-technical people exactly this question. All of the people I asked didn't even understand that there was anything other than "my picture" in an image file. I would guess that if you pressed a lay-person to explain how Apple shows a map of where your photos were taken, they would guess that the information was stored separately.
- hobarrera 9y ago
  That doesn't really make it evident that letting an app access a photo lets it access the photos location. You and I both understand that that's metadata in the file, but non-tech users don't know that much -- they might simply have never though about it enough at all.
sib 9y ago
Given that many social networking apps show you the location in which the photo was taken as an option for geotagging posts, it's clear that the data is there. I'll grant that users may not make the leap to thinking of building a full-on historical profile without being prompted in that direction...
- jamiethompson 9y ago
  And I think most users would be aware of this yes. But should they be expected to understand that this location data is different to the other location data and isn't secured at all by the "share your location" permission?
- Ntrails 9y ago
  > Given that many social networking apps show you the location in which the photo was taken as an option for geotagging posts, it's clear that the data is there. I had literally no idea. None. Probably because I don't upload photos to social networking sites from my phone. So I'd be pretty shocked that Whatsapp could plot my movements despite not having access to location data...
tomp 9y ago
> Because users aren't actually all that aware of there being location data attached to their photos. Users are stupid. iOS clearly asks you to allow the Camera app to access location, explaining it’s to tag photos.
- jamiethompson 9y ago
  Stupid? Perhaps in some cases. But are you perhaps expecting to much of a layperson? How are they supposed to know that the "access photos" permissions overrides the "location" permission because the "location" permission doesn't even apply to their photo location data. Sure, we all know this. But this can't be taken for granted. Do we expect regular users to appreciate that how the location data is stored as exif data within their photos rather than separately. I wouldn't expect this of most people.
- salvar 9y ago
  Users are human beings. You can affix a derogatory label to them if you want, but deciding that they're not as smart as your ideal of what humans should be isn't useful to anyone except your ego I guess.

kristiandupont 9y ago

It's obvious to me now, but I hadn't thought of this. So it was a surprise in that regard, and an unpleasant one even though I feel like I am less concerned with privacy than most of HN.

dsp1234 9y ago

There is no technical reason the OS couldn't stop this by stripping exif/location data from photos if the requesting application doesn't have location permissions.

mschuster91 9y ago
> There is no technical reason the OS couldn't stop this by stripping exif/location data from photos if the requesting application doesn't have location permissions. There is: every app that does stuff with photos (e.g. filter software or other processors) will strip the exif data now in the process.
- vaishaksuresh 9y ago
  There is no need to strip all EXIF data. Strip just the location since that is an explicit permission needed. you can keep aperture, shutter speed, capture time etc.
  - Klathmon 9y ago
    Well I'm not in the iOS ecosystem, but I genuinely like the location data to be in my photos, and I go somewhat out of my way to ensure it stays there. Being able to search my images by location means I can easily find all images from my trip to X, or grab all the pictures I took while at my old house. It's hugely useful and I would be livid if an is update or app update started striping that info.
    - abakker 9y ago
      Simple. Make a setting that defaults to "no, don't share the exif location data with 3rd party apps" but can be changed to "yes, do that" if you want to.
      - hobarrera 9y ago
        What if an app edits a photo? The exif location data would then be permanently lost. It's not as simple as that.

jakemor 9y ago

You should need access to image & location data to see where the images were taken. Period.

codezero 9y ago

As a parallel – imagine if the file picker on web browsers gave a website access to all the metadata of any file on your hard drive.

macsj200 9y ago
Once you pick a file, I'm fairly certain that the metadata is made available as a JavaScript Blob object containing any relevant metadata (this is how Facebook geotags uploaded photos)
- codezero 9y ago
  Yes maybe. On one file. The iOS version gives access to all files after you allow it. That’s the point.
  - codezero 9y ago
    By any file I meant all files.

ben174 9y ago

I've spent hours of effort making sure Facebook Apps on my phone never have access to my location. It's something I'm particularly crept out with regard to Facebook specifically. I've granted them access to my photo library when I'd like to post a picture there, so this means they they can suddenly read all the photos in my library, including their exif data? If so, what are they chances they are collecting all that exif and uploading it? I'd be genuinely pissed. And if such a practice came to public eyes, wouldn't that bring up enough of an uproar to cause fb some serious harm?

myrandomcomment 9y ago
What are the chances? 100%
michelb 9y ago
Even if they are not using your exif, they will be trying to identify your locations in the photos based on the presence of other people, landmarks, or other objects. In the same way that Google does.
hobarrera 9y ago
What I've found works best for keeping access to photos restricted, is clicking on "Share" on the iOS photos app, and then selecting the target app (eg: FB Messenger). This means that the target app doesn't get access to my entire library -- but I can still share one (or a few) photos through it.

smoser 9y ago

If Adam Savage was caught by surprise (the location of his home was embedded in a photo he shared online) then I would think a lot of other people would be surprised too.

hobarrera 9y ago

This is probably only something that tech-related people understand (and maybe some specific types of photographers and designers). The great majority of the population doesn't really know that "photos store location", let alone join the dots to assume that these things are possible.