12 ms·
Facebook is embedding tracking data inside the photos you download
- Ultramanoid 7y agoTherefore this is happening with Instagram as well, of course.
- kabwj 7y agoObviously, since they use the same CDN.
- eyeball 7y agoIs WhatsApp doing it too?
- busymom0 7y agoSo far no, whatsapp isn’t doing it as someone checked. Maybe in the future: https://mobile.twitter.com/17haval/status/1149978537899642880 https://mobile.twitter.com/17haval/status/114997853789964288...
- rohan1024 7y agoSomeone else dug further into this https://stackoverflow.com/questions/31120222/iptc-metadata-automatically-added-to-uploaded-images-on-facebook https://stackoverflow.com/questions/31120222/iptc-metadata-a...
- jdillaaa 7y agoYeah, years ago. Nothing new here. Running "exiftool FB_IMG" would reveal the same "structural abnormality" (not an abnormality though because its part of the valid IIM block of the file). See https://sno.phy.queensu.ca/~phil/exiftool/TagNames/IPTC.html https://sno.phy.queensu.ca/~phil/exiftool/TagNames/IPTC.html
- raverbashing 7y agoWhat's exactly an IPTC instruction? Seems to be this https://iptc.org/standards/photo-metadata/ https://iptc.org/standards/photo-metadata/ It's also not clear what the data contains. Is it info about the original account? The account downloading the picture I would not be surprised if this was being used to prevent fake accounts being created with pictures taken from legitimate accounts.
- gmueckl 7y agoIt would in theory be enough to embed a random unique ID and keep the associated data on your own server so the actual data doesn't leak.
- mattigames 7y agoIs not only so the data doesn't leak, is also to make it as small as possible so is less likely to be corrupted unintendedly by third party software or protocols.
- pmlnr 7y ago"This is a simple text field that can include any of a number of instructions from the provider or creator to the receiver of the photograph. Any of the following might be included: embargoes (eg: News Magazines OUT) and other restrictions not covered by the Rights Usage Terms field (or new PLUS rights related fields); information regarding the original means of capture (scanning notes, color profile, etc.) or other specific text information the user may need for accurate reproduction; additional permissions or credits required when publishing. Note: This field is “shared” with the “Instructions” field in the Origin panel of the Adobe Photoshop File Info dialogue. Examples: Image to be used one time only, non-exclusive in English-language-edition magazine as inside image, no larger than a full page in color. Additional third-party rights to be negotiated with Julie Doe / XYZ Agency in advance. All rights not specifically granted are reserved. See delivery memo for specific license. For consideration only; no reproduction in any form without prior, written permission." quote from https://www.photometadata.org/META-Resources-Field-Guide-to-Metadata#Instructions https://www.photometadata.org/META-Resources-Field-Guide-to-...
- kabwj 7y agoNo indication of what it means. Has anybody tried to download the same picture from two accounts and see if the data changes? Maybe this is some data they embed into the picture for bookkeeping when inside their infrastructure and they forget to strip it when they let you download it.
- mattigames 7y agoNah, is extremely useful for them to know when a picture is being re-uploaded so I dont believe for a second they "forgot to strip it"
- Ultramanoid 7y agoIf the photograph is copyrighted, how does this modification and embedding of tracking data by a third party affect the owner, if it does at all ?
- nightfly 7y agoIts metadata, I doubt it does anything.
- Ultramanoid 7y agoMetadata is data.
- outadoc 7y agoFacebook also compresses your pictures, and I don't think anyone would seriously consider this as an infringement on your copyrighted material.
- Ultramanoid 7y agoI don't use any of their services myself, nor do I suggest infringement. I ask what is the legal situation for a copyright holder, given users likely are not aware of this data being added to a file; what the data exactly is, where or if this data is kept by them independently of the file itself, what is it used for, GDPR implications, etc.
- diroussel 7y agoCopyright applies to published works. Which in this case would be an image. Owning the rights to an image is a legal issue that is not concerned with representation. So if the images is converted to digital form, then compressed then decompressed, then printed out then usually it would be considered the same image.
- jjeaff 7y agoBy posting the photo to Facebook in the first place, you are giving them near unlimited freedom to do with it as they will according to their usage policies.
- jarfil 7y agoThis isn't something new, it's been known for years: https://www.hackerfactor.com/blog/index.php?/archives/726-Facebook-Tracking.html https://www.hackerfactor.com/blog/index.php?/archives/726-Fa...
- mattigames 7y agoThe value derived from this post is not it's "recentness" but to make aware of a practice by fb to the users of this site, specially in the light of fb importance on privacy matters and global politics in recent years
- floatingatoll 7y agoI didn’t know it, but if you have a link to previous HN discussions about it, that would be nice to have here.
- diafygi 7y agoIs the difference now that the tracking metadata used to be set at upload time, and now it's set at download time? Presumably, if you set it at download time, you can not only track the uploader but also the downloader.
- ksajadi 7y agoI’m curious, but are we biased here on HN or is it literally every piece of news that’s coming out on that company is about another nasty privacy invading practice at Facebook? Although I admit there are some posts about FB open source projects here too.
- outside1234 7y agoI think Facebook is biased itself towards doing a whole bunch of nasty privacy practices, not HN in reporting them.
- deleted 7y ago[deleted]
- Kiro 7y agoThey cause it themselves but you should always remember that HN is not representative of public opinion.
- high_5 7y agoNot only about FB. Yesterday it was about MSFT ad farming in Windows. The one MSFT, which also invests a lot in open source/-ish tech.
- baby 7y agoIs it possible that this is for finding out who is re-posting private pictures, like on ex revenge websites and co?
- jakeogh 7y agoThe knowledge that people can ref things by their hash is a serious problem for power centers.
- 7171u 7y agoWho gives Facebook the authority to do so?
- tambre 7y agoThose who agreed to the terms of service and uploaded their pictures. This is akin to asking who gives Facebook the permission to badly compress pictures? The answer's same.
- lucb1e 7y agoThis is a really weird question. If it's not prohibited, why shouldn't you be allowed to do something by default? Isn't that a basic thing in all(?) legal systems?
- 7y ago
- harel 7y agoIsn't it the same as printers watermarking printouts? I don't see this as a necessarily bad thing. In a public forum in a far from perfect world there should be a place for accountability when people distribute photos they shouldn't.
- verroq 7y agoPrinters shouldn't be watermarking printouts and neither should Facebook.
- harel 7y agoThey shouldn't, true. But they are. And have been for a very long time. People who require anonymity would/should/could subvert all those things. But just to give one example: if the daughter I don't have for example was to be targeted by some ex boyfriend posting private photos, I would like to be able to pinpoint the source of those photos. In the case of Facebook that tracking/watermarking is limited to stuff coming out of the FB platforms. Open any photo done with a digital camera and you can get a lot of information from the raw data as well. What I'm saying - a blanket objection of all 'meta' tracking data is not helpful - because it does and will keep on happening. Education on how to work around it when it's needed is maybe the solution. And in some cases, like the example I gave, that tracking data can actually be used to do good.
- verroq 7y agoNo amount of tracking is acceptable in the same way the freedom of speech is absolute (no censorship is acceptable). You can say it is not a slippery slope but our rights are eroded when we compromise. If you need tracking you put the dots on your own print outs. There is no need to have dots on everyone else’s print outs.
- harel 7y agoI do not approve of any printer that watermarks my printouts. There is no two ways about that. Tracking is a side effect of showing us ads. We will be shown ads no matter what because they pay for the services we get for free and the 99% don't mind them. Without tracking on the ad front we'll see random ads, they would be less effective, that industry will ultimately collapse and we will start paying for every single service we use. Again - I do not condone it, but I don't have the will personally to fight it or let it affect me in any way. When i want my actions to be untrackable, I will take steps to make them so. I would however like both the ad world and consumers to reach some sort of middle ground in regards to what is acceptable and what is not. They way things are now are out of balance in favour of advertisers. It should be corrected.
- xxxpupugo 7y agoNot to jump on the bashing train, this tracking might not be for advertising purpose only right, this could be put in place for copyright protection.
- qrbLPHiKpiux 7y agoIt's Facebook. FB doesn't give 2 licks about an individual.
- sound_and_form 7y agoThere's a simple solution to any problem related to Facebook. Stop using it.
- cageface 7y agoNot as easy as that if your friends are posting photos with your face in them but it’s definitely a very positive first step.
- zerr 7y agoAny alternatives for maintaining remote friendships? EDIT: with passive updates.
- chii 7y agoemail and video calls every now and then.
- tadzik_ 7y agoAny other form of communication – email, IMs, phones etc. If you're not having a conversation but just "like" each other's photos it's not "maintaining a remote friendship" anyway.
- zerr 7y agoPassively receiving some updates, i.e. where they've checked in, some new photos, posts/comments, etc... is also useful I think.
- megous 7y agoBlogs used to be/are good for that.
- tadzik_ 7y agoYeah, good point. I often find myself wanting to follow what some people are up to (friends or not), and it's always frustrating how it requires you to be a part of a certain platform to do that – you can't follow anyone's instagram, facebook, twitter etc without an account, and even then you still need to go on instagram/facebook/twitter to actually check it out. I recently created myself a Pixelfed (a federated instagram, basically) and was pleasantly surprised how my profile has a plain, old RSS feed, so that anyone can "track" me without ever visiting a website (which is something that ActivityPub itself also allows, but AP still forces you to be a part of the "system", so to say). I'd much prefer that kind of Federated world, but I don't see how we can get there in any other way than spreading awareness about it and basically nagging our friends (at the risk of isolating ourselves) – “I wish I could follow your adventures and thoughts, but I don't want a facebook account”. This of course requires a critical mass for basically each person, and probably a way of automatically updating the locked-in platforms (for each post you push to pixelfed/blog it updates your instagram/facebook) so that the ones who take a step out don't need to leave their locked-in friends behind.
- baybal2 7y agoOne should note that they went to quite a length to hide it from mainstream EXIF readers It is not in a comment field, nor it reuses any EXIF guid equivalent A much more grievous thing they may be doing is speculated to be them encoding tracking into photo's hue channel. There was time when you was able to see a stripe of odd pixels in the right bottom side of some photos. Later, I read a blog post saying that if you upload a solid grey picture, you will see weird subtle colour banding patterns on it if you download it back. I tried myself now, and it did not work for me.
- cookiecaper 7y ago"Mainstream EXIF readers" are mostly derivatives/wrappers around Phil Harvey's ExifTool, which has supported IPTC tags for a very long time. Whatever may be interesting about this, the fact that the data is stored in an IPTC tag is not really part of it. IPTC/IIM structures predate Exif by decades: https://en.wikipedia.org/wiki/IPTC_Information_Interchange_Model https://en.wikipedia.org/wiki/IPTC_Information_Interchange_M...
- unilynx 7y agoDoes this 'IPTC' tag survive common image editing? Or are they targeting it towards an external application? If it was just for recognizing re-uploads, they could have just stored the sha-256 hash serverside..
- lucb1e 7y agoIt's up to the editor to keep metadata. In Gimp you can choose in the advanced export settings, but I don't know the default. Re-encoding will definitely change any hash, but editors may (not sure how commonly) keep these tags. You'd have to do steganography if you want it to be more persistent than a metadata tag. Edit: I just saw it's not a normal EXIF tag, this is something else. I'm not sure how this is handled, might be interesting to do some empirical testing!
- pmlnr 7y agoAs a hobby photographer who dealt with some image metadata manipulation, I find this quite interesting. Interesting enough to question if this could be something we ourselves can be using, say, for a WordPress plugin, so tracking down copyright abuse would be more simpler. Does anyone know existing, working solutions for this? Is IPTC purged as well by CMS systems, similarly to XMP or EXIF?
- wil421 7y agoCertain providers will strip your exif data completely. I’ve seen email providers, I think yahoo, and other websites do it. The geotagging has definitely been removed as well as the exif camera data. It might be hard to track images this way if everyone is manipulating it including FB/Insta.
- Stubb 7y agoExifTool is the standard app for playing with photo metadata: https://www.sno.phy.queensu.ca/~phil/exiftool/ https://www.sno.phy.queensu.ca/~phil/exiftool/ Looks like Facebook is adding IPTC field Original Transmission Reference, which you can view with: exiftool -IPTC:OriginalTransmissionReference image.jpg It seems different for each picture.
- lelf 7y agoIt is exiftool -IPTC:SpecialInstructions (it will be a string starting with FBMD.) And while it’s obviously (can be used for) for tracking, it’s just a exif tag, “Special instructions” is a text for humans, not machine instructions. So s/Structural abnormality IPTC special instruction/a standard exif tag/ for less click-bait.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- zetor 7y agoFBMD01000ab5030000930700008b130000ae130000011400005d3f00009b740000ce750000f1750000277600005eaa0000
- eqtn 7y agoIndian government has asked whatsapp to make all messages traceable to it its origin. From the twitter thread, whatsapp isn't currently doing it though. But this can be used to find the origin of images. https://thenextweb.com/security/2019/06/18/india-is-still-hounding-whatsapp-to-make-its-messages-traceable/ https://thenextweb.com/security/2019/06/18/india-is-still-ho...
- tjpnz 7y agoShouldn't a privacy friendly browser/extension be able to defeat this technique by passing said images through exiftool (or similar) and then caching it?
- kadira 7y agoif you are working for facebook then you are part of the problem.
- cbzbc 7y agoI think this may well have been found a while back: https://stackoverflow.com/questions/31120222/iptc-metadata-automatically-added-to-uploaded-images-on-facebook https://stackoverflow.com/questions/31120222/iptc-metadata-a...
- blumomo 7y agoWhat you thought one hour ago, had been already replied 4 hours earlier to the tweet. I'm not sure if you copied it from there?
- luxuryballs 7y agoperhaps that’s why he thought it
- gmueckl 7y agoLooking at some examples given in the linked pages on this here, it stands out that there is a structure to each of the 32 bit records in this data. The first 16 bits are nearly random, but the second set obeys some rule: the third octet is a low number and the hole set of records is sorted by that. The fourth is always zero. If this is intended to be a kind of tracking identifier, this structure is a bit odd. Intuitively, I would rather interpret this as a list of tags that are stored in-band with the image.
- shawnz 7y ago> The take from this is that they can potentially track photos outside of their own platform with a disturbing level of precision about who originally uploaded the photo (and much more). How is it any more powerful in that regard than just hashing the photo?
- shakna 7y agoUploaded photos on many sites undergo postprocessing that may change the hash of the image, different compression technique, etc. without modifying the EXIF data.
- shawnz 7y agoNot if you use a perceptual hash, which is a well established technique that Facebook already uses for other purposes
- doubleunplussed 7y agoFurthermore, plenty of platforms will remove EXIF data. I made a LaTeX equation rendering script that embedded the source LaTeX in EXIF data, the idea being that you could edit the equation after the fact without having to save the source. But practically every tool I used would strip the EXIF data - so I moved to storing the source in the least significant few bits of the pixel values. This worked much better with the places I was uploading the images to (google docs mostly). Obviously fragile to image format conversion though.
- zild3d 7y agoLove that idea for LaTeX. For anyone interested, storing information/messages inside another file is called steganography (https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography)
- mceachen 7y agoUnfortunately, most phashes are trivial to circumvent. Imperceptibly rotating saturation or leveling brightness will result in a new phash. (If you've found a robust, patent-unencumbered phash, please share, I'd love to use it for PhotoStructure!)
- bastawhiz 7y agoI can see this being an extremely valuable tool for preventing identity theft on the site. One of my teachers had been the victim of a scammer who had cloned her profile and was reaching out to everyone on her friend list. When the fake profile was reported, it was taken down very quickly, which I imagine could have been done programmatically with this data on the photos. There's speculation that FB could infer relationships with this. If you've ever shared memes, you'll know this this is unlikely to be effective. At the end of the day, in an age of reverse image search and public profiles and commodity facial recognition, what is actually the threat model here? That someone is able to tie an unattributed photo back to the URL it was downloaded from? That if someone downloads your photo without permission (why did you upload it in the first place?) and they share it but don't say where they got it, someone else can potentially find out where it came from? It's unclear whether this ID even uniquely identifies the uploader or downloader publicly. If it's a random UUID, then what? Facebook doesn't reasonably need it to track you (they could use the hash, face recognition, your session, etc). I honestly can't think of a case that would make this valuable to a malicious third party. Beyond content moderation (and maybe saving some CPU time), I can't see much of a use case for Facebook either.
- spunker540 7y agoYeah I can't tell what the harm is from the metadata and would appreciate someone actually explaining, rather than seeing some metadata and immediately jumping to the conclusion that there's definite harm and "tracking" going on.
- fbi-director 7y agoI suspect if you're logged into Google or Facebook, that's uniquely added to the exif data. So if there is later a question of who keeps anonymously uploading that banned photo, they can trace you as the person (at least being the first link in the chain). Also, statistics how many images are downloaded and then later found online again by Facebook at other places.
- tmaly 7y agoI think if you email a photo on gmail it strips the meta data from the photo. I had this problem when I was trying to use the meta data to get the orientation.
- TazeTSchnitzel 7y agoIt's good practice for any website that takes image uploads to strip unnecessary metadata, as people can inadvertently reveal their location (geotags) or identity (serial numbers etc) otherwise.
- mschuster91 7y agoFor websites in general yes but I do not want an e-mail client that, unbeknownst to me, manipulates data in transit. Time to pgp-sign the attachments on mails, too? :/
- mceachen 7y agoIt depends on how you email it. If you attach the file, it won't. If you drag the image into the body of the email, it will.
- modzu 7y agowhen i read the headline i thought stenography. is it possible to know if they are using such techniques? making exif data a red herring
- Tharkun 7y agoYou could try uploading a bunch of images and downloading them again, finding out where they differ. This should be reasonably straightforward. However, FB likely modifies the image in various ways (resizing, maybe they recompress the image to save space, etc). Showing the presence or absence of steganography will probably require a large sample size.
- quotz 7y agoFacebook is probably even worse than the Chinese government
- bitdeveloper 7y agoOther than the convict organ harvesting and such.
- dang 7y agoMaybe so, but please don't post unsubstantive comments here.
- snek 7y agoIf anyone who works at Facebook reads this, I am so very curious, when you're asked to build something like this, how do you approach that morally? I really want to know the opinion of someone actually working there.
- nine_k 7y agoRecently there was a number of articles like [1], saying that a a lot of good engineers stays away from working for FB, having misgivings about its practices. So maybe people who agree to do such things are a result of a (long) selection process. [1]: https://www.theguardian.com/technology/2019/may/17/facebook-job-offers-shunned-by-top-talent-after-cambridge-analytica-scandal-report https://www.theguardian.com/technology/2019/may/17/facebook-...
- usbseeker 7y agoThat would make sense, the reason they have to pay so much is because the work is sketchy, if this was truly rewarding engineering work the market would see falling salaries. Doctors still want to be doctors even if they are paid less. You have to pay me 5x to do shitty work.
- smsm42 7y agoDoctors are not exactly known for having low (or falling) salaries, so maybe your logic is not that solid. And there are many well-paid positions in hi-tech not involving working in surveillance part of Facebook or in Facebook at all.
- jammygit 7y agoRight after that $5B fine too
- wolco 7y agoNormally this would make everyone stop uploading photos to facebook. But most have already. My facebook usuage has gone from every second to maybe once a day. There is a rot happening and this will become a dangerous time for anyone who used facebook as facebook will slowly sell them out and in the end exort them. Want to keep these photos private you uploaded 10 years ago and deleted? Pay..
- johnchristopher 7y agoWhy don't they encrypt that kind of payload? I suppose tampering with it is easy enough that it would prevent using this data in litigation issues, right?