7 ms·

So if I take a photo with my iPhone and upload the photo using a web form, does the website get the exif data (GPS coordinates) or does Safari strip that prior

So if I take a photo with my iPhone and upload the photo using a web form, does the website get the exif data (GPS coordinates) or does Safari strip that prior to upload?

snoopy_telex 4y ago
I believe the website gets it all.
freedomben 4y ago
The website gets it. Safari does not strip it. IMHO that's the correct thing to do. Maintaining GPS coords is highly desirable when uploading photos to your photo storage solution. It would be very sad if they were all lost. Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it.
- semicolon_storm 4y ago
  Depends who you're worried about having the EXIF data. Sure Facebook strips the EXIF before rehosting the image for others to consume, but given Facebook's nature I'm certain they use the EXIF data to track you. If you don't want Facebook knowing exactly where you were at a given datetime, you'll still want to manually strip the EXIF before uploading.
  - account-5 4y ago
    Or don't upload pictures to Facebook.
- aendruk 4y ago
  Seems like a nice feature of the browser would be to tell you when you’re uploading location data and offer to strip it.
  - blooalien 4y ago
    That *does* seem like it'd be a nice feature, and maybe even not that hard to implement. Mebbe some crafty developer could build a feature like that as a browser "add-on" / plugin.
    - rolph 4y ago
      randomize exif data ? yes please.
  - freedomben 4y ago
    That does sound nice, although it's probably only something we would like. I would imagine the vast majority of people would be like, "Wut" when the dialog popped up. Would make a killer extension though.
- WhyNotHugo 4y ago
  > Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it. Don't worry, Facebook will keep a copy of all the metadata.
Kye 4y ago
Failing to strip exif is traditionally one of the first mistakes most new sites with photo sharing make. Browsers wouldn't strip it since it is useful information that's used by many sites. Sites that keep it on purpose just have the good sense to make revealing it optional or selective.
socketpuppets 4y ago
Browser's does not strip the exif data but websites should remove the exif data. According to Bugcrowd’s Vulnerability Rating Taxonomy, severity of the vulnerability P3-P4 (medium-low) because the vulnerability leak GPS data of anybody.
spzb 4y ago
It appears not. Safari appears to remove the GPS data when you upload. I tested it myself by uploading a photo to https://exif.tools/ https://exif.tools/ and no GPS location was reported. The same image copied to my laptop and then checked locally with exiftool did have the GPS location. Also see this thread https://apple.stackexchange.com/questions/326789/gps-exif-from-iphone-photo-upload-in-safari https://apple.stackexchange.com/questions/326789/gps-exif-fr...
- tppiotrowski 4y ago
  This is what I suspected. There were issues with iPhone photo rotation being incorrect after upload so you had to do it manually. I think this is because the EXIF data was missing. I think people on this thread are confusing uploading in the browser with uploading via the Facebook app
  - spzb 4y ago
    To be clear, exif data was still present when uploaded (including the orientation data) but the GPS location had been removed. I think problems with photos being incorrectly orientated is more to do with the website not correctly interpreting (or completely ignoring) the relevant exif data.

So if I take a photo with my iPhone and upload the photo using a web form, does the website get the exif data (GPS coordinates) or does Safari strip that prior to upload?

snoopy_telex 4y ago

I believe the website gets it all.

freedomben 4y ago

The website gets it. Safari does not strip it. IMHO that's the correct thing to do. Maintaining GPS coords is highly desirable when uploading photos to your photo storage solution. It would be very sad if they were all lost. Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it.

semicolon_storm 4y ago
Depends who you're worried about having the EXIF data. Sure Facebook strips the EXIF before rehosting the image for others to consume, but given Facebook's nature I'm certain they use the EXIF data to track you. If you don't want Facebook knowing exactly where you were at a given datetime, you'll still want to manually strip the EXIF before uploading.
- account-5 4y ago
  Or don't upload pictures to Facebook.
aendruk 4y ago
Seems like a nice feature of the browser would be to tell you when you’re uploading location data and offer to strip it.
- blooalien 4y ago
  That *does* seem like it'd be a nice feature, and maybe even not that hard to implement. Mebbe some crafty developer could build a feature like that as a browser "add-on" / plugin.
  - rolph 4y ago
    randomize exif data ? yes please.
- freedomben 4y ago
  That does sound nice, although it's probably only something we would like. I would imagine the vast majority of people would be like, "Wut" when the dialog popped up. Would make a killer extension though.
WhyNotHugo 4y ago
> Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it. Don't worry, Facebook will keep a copy of all the metadata.

Kye 4y ago

Failing to strip exif is traditionally one of the first mistakes most new sites with photo sharing make. Browsers wouldn't strip it since it is useful information that's used by many sites. Sites that keep it on purpose just have the good sense to make revealing it optional or selective.

socketpuppets 4y ago

Browser's does not strip the exif data but websites should remove the exif data. According to Bugcrowd’s Vulnerability Rating Taxonomy, severity of the vulnerability P3-P4 (medium-low) because the vulnerability leak GPS data of anybody.

spzb 4y ago

It appears not. Safari appears to remove the GPS data when you upload. I tested it myself by uploading a photo to https://exif.tools/ https://exif.tools/ and no GPS location was reported. The same image copied to my laptop and then checked locally with exiftool did have the GPS location. Also see this thread https://apple.stackexchange.com/questions/326789/gps-exif-from-iphone-photo-upload-in-safari https://apple.stackexchange.com/questions/326789/gps-exif-fr...

tppiotrowski 4y ago
This is what I suspected. There were issues with iPhone photo rotation being incorrect after upload so you had to do it manually. I think this is because the EXIF data was missing. I think people on this thread are confusing uploading in the browser with uploading via the Facebook app
- spzb 4y ago
  To be clear, exif data was still present when uploaded (including the orientation data) but the GPS location had been removed. I think problems with photos being incorrectly orientated is more to do with the website not correctly interpreting (or completely ignoring) the relevant exif data.