5 ms·

This doesn't seem nearly as clear-cut to me as Path's earlier grabbing of users' address book data. In this case, Path is accessing metadata of photos which the

by Bud 14y ago

This doesn't seem nearly as clear-cut to me as Path's earlier grabbing of users' address book data. In this case, Path is accessing metadata of photos which the user has expressly granted Path access to. This is different from real-time location data.

radicaldreamer 14y ago
Yup, additionally, you don't have to geotag your photos. The issue, however, is basically that most people are not aware that because they provided location permissions to the Camera app, photos used by other applications are able to access that tagged location data.
- sneak 14y ago
  Yeah, that's the issue on the iOS end. The issue on the Path end is that they are circumventing the user's clear intent to not provide locational data to their application. Whether or not that is malicious or just ignorant is unknown. Either way, they are publishing user data that users have taken steps to explicitly avoid publishing.
  - faultbot 14y ago
    Pointing out yet again that you say malicious intent is "unknown," but you claim intentional theft in your article anyway. Libelous.
sneak 14y ago
But the app knows it has been explicitly denied location data, and uses the photo location data to tag the post anyway. The location is then displayed to other users on Path. This is unacceptable behavior. At best it's a terrible and potentially physically dangerous bug. At worst it's complete disregard for user privacy. I'm not complaining on theoretical grounds. I am on a temporary remote assignment, the location of which I wish to keep private due to business considerations. Before I left, I disabled location services for Path. Today I posted a picture that I'd taken yesterday (after cropping out location-identifying features). Underneath, Path posted the name of the city that I'm in, publishing my location to all of my contacts. Again: This is unacceptable behavior.
- baddox 14y ago
  The app also knows that you have given the Camera app location data, and then explicitly given Path access to your photos which were taken with the Camera app. Removing Location Services permission from Path simply means that the Path app cannot directly access your phone's location sensors—nothing more, nothing less. It doesn't mean that Path has to go to every imaginable length to ensure that you don't manage to share your location through other means, like photos or status updates.
  - keyboardP 14y ago
    >It doesn't mean that Path has to go to every imaginable length to ensure that you don't manage to share your location through other means, like photos or status updates. Not sure what you mean here. If my app loaded a user's picture, and they said they don't want location data to be used in my app, a simple if check will decide whether or not EXIF data should be read. This is hardly "every imaginable length". Of course, this may just be a bug, so I don't think we can jump to any conclusions about Path's intentions.
    - baddox 14y ago
      What if someone posts a status update saying "I'm in San Francisco."? What if they post a picture of themselves with the Golden Gate Bridge in the background? Is it reasonable for them to assume that Path will filter these things out, simply because they turned off Location Services? I think it's ludicrous. iOS is quite clear in its explanation of Location Services, and their explanation is not at all "technical" or intimidating to non-technical users. Also, the permission to access your photos is completely separate from the Location Services permission. Maybe you the author would have a point if iOS automatically gave apps access to your camera roll, but that's not the case. I don't doubt that some users will be surprised by the photo's geotag, but I suspect it would be an extremely low number of users (the fact that this if just now being blogged about seems to corroborate this, unless Path have just recently added this behavior).
      - keyboardP 14y ago
joeblossom 14y ago
I agree -- I think this is more Apple's problem than anything. If I disable location data for an app, Apple shouldn't allow any form of my location to be passed to that app.
- dangoldin 14y ago
  I think the solution should lie with Apple as well since it's higher up the stream. Otherwise you'd need to have every app do this check - seems more efficient for Apple to just handle it.
  - thedufer 14y ago
    I agree that Apple should do this. Malicious developers will exploit what they can. But this is just silly: > Otherwise you'd need to have every app do this check Do what check? When you ask for location data, all you have to do is say "you won't give me that? Okay." This app seems to have asked for location data, but instead said "you won't give me that? I'll go out of my way to get it anyway." There is no need for an explicit check. It is less work to do the right thing.
    - dangoldin 14y ago
      I meant that every app would have to do this location data stripping. It's unlikely that apps would bother to do this - more out of an oversight than maliciousness. Having Apple do this would avoid the problem of apps forgetting to implement these types of checks.
- ghshephard 14y ago
  Totally agree with you here. In fact, would any iOS developer like to speculate as to whether an application can even determine if it's authorized to get your location? Or does it just attempt, and then get a failure?
  - Me1000 14y ago
    Apple provides an API for determining permissions.
JulianMorrison 14y ago
Lets put it in human terms. You have an abusive ex who tries to stalk you and has threatened your kids. You turn off the ability of the app to see your location. Your location gets geotagged anyway. Your doorbell rings.
- Evbn 14y ago
  Share data with strangers, strangers share data. Don't use an app whose entire purpose to expose your life publicly.
- RandallBrown 14y ago
  So you should take location access away from the Camera app. The exif data is going to be in the photo even if Path only posts it and doesn't use it in any way.
- deleted 14y ago
  [deleted]

by Bud 14y ago

radicaldreamer 14y ago

Yup, additionally, you don't have to geotag your photos. The issue, however, is basically that most people are not aware that because they provided location permissions to the Camera app, photos used by other applications are able to access that tagged location data.

sneak 14y ago
Yeah, that's the issue on the iOS end. The issue on the Path end is that they are circumventing the user's clear intent to not provide locational data to their application. Whether or not that is malicious or just ignorant is unknown. Either way, they are publishing user data that users have taken steps to explicitly avoid publishing.
- faultbot 14y ago
  Pointing out yet again that you say malicious intent is "unknown," but you claim intentional theft in your article anyway. Libelous.

sneak 14y ago

But the app knows it has been explicitly denied location data, and uses the photo location data to tag the post anyway. The location is then displayed to other users on Path. This is unacceptable behavior. At best it's a terrible and potentially physically dangerous bug. At worst it's complete disregard for user privacy. I'm not complaining on theoretical grounds. I am on a temporary remote assignment, the location of which I wish to keep private due to business considerations. Before I left, I disabled location services for Path. Today I posted a picture that I'd taken yesterday (after cropping out location-identifying features). Underneath, Path posted the name of the city that I'm in, publishing my location to all of my contacts. Again: This is unacceptable behavior.

baddox 14y ago
The app also knows that you have given the Camera app location data, and then explicitly given Path access to your photos which were taken with the Camera app. Removing Location Services permission from Path simply means that the Path app cannot directly access your phone's location sensors—nothing more, nothing less. It doesn't mean that Path has to go to every imaginable length to ensure that you don't manage to share your location through other means, like photos or status updates.
- keyboardP 14y ago
  >It doesn't mean that Path has to go to every imaginable length to ensure that you don't manage to share your location through other means, like photos or status updates. Not sure what you mean here. If my app loaded a user's picture, and they said they don't want location data to be used in my app, a simple if check will decide whether or not EXIF data should be read. This is hardly "every imaginable length". Of course, this may just be a bug, so I don't think we can jump to any conclusions about Path's intentions.
  - baddox 14y ago
    What if someone posts a status update saying "I'm in San Francisco."? What if they post a picture of themselves with the Golden Gate Bridge in the background? Is it reasonable for them to assume that Path will filter these things out, simply because they turned off Location Services? I think it's ludicrous. iOS is quite clear in its explanation of Location Services, and their explanation is not at all "technical" or intimidating to non-technical users. Also, the permission to access your photos is completely separate from the Location Services permission. Maybe you the author would have a point if iOS automatically gave apps access to your camera roll, but that's not the case. I don't doubt that some users will be surprised by the photo's geotag, but I suspect it would be an extremely low number of users (the fact that this if just now being blogged about seems to corroborate this, unless Path have just recently added this behavior).
    - keyboardP 14y ago

joeblossom 14y ago

I agree -- I think this is more Apple's problem than anything. If I disable location data for an app, Apple shouldn't allow any form of my location to be passed to that app.

dangoldin 14y ago
I think the solution should lie with Apple as well since it's higher up the stream. Otherwise you'd need to have every app do this check - seems more efficient for Apple to just handle it.
- thedufer 14y ago
  I agree that Apple should do this. Malicious developers will exploit what they can. But this is just silly: > Otherwise you'd need to have every app do this check Do what check? When you ask for location data, all you have to do is say "you won't give me that? Okay." This app seems to have asked for location data, but instead said "you won't give me that? I'll go out of my way to get it anyway." There is no need for an explicit check. It is less work to do the right thing.
  - dangoldin 14y ago
    I meant that every app would have to do this location data stripping. It's unlikely that apps would bother to do this - more out of an oversight than maliciousness. Having Apple do this would avoid the problem of apps forgetting to implement these types of checks.
ghshephard 14y ago
Totally agree with you here. In fact, would any iOS developer like to speculate as to whether an application can even determine if it's authorized to get your location? Or does it just attempt, and then get a failure?
- Me1000 14y ago
  Apple provides an API for determining permissions.

JulianMorrison 14y ago

Lets put it in human terms. You have an abusive ex who tries to stalk you and has threatened your kids. You turn off the ability of the app to see your location. Your location gets geotagged anyway. Your doorbell rings.

Evbn 14y ago
Share data with strangers, strangers share data. Don't use an app whose entire purpose to expose your life publicly.
RandallBrown 14y ago
So you should take location access away from the Camera app. The exif data is going to be in the photo even if Path only posts it and doesn't use it in any way.
deleted 14y ago
[deleted]