Hacker News Reader

Comment by lowglow | Hacker News Reader

One shouldn't forget about exif data on images.

Are EXIF tags added by the iOS when taking a picture? Or by the app calling the camera API after the photo is taken? I would guess it's latter.

Yeah, EXIF tags have to be explicitly added to an image by the app (using CGImageDestinationSetProperties()), regardless of how a photo is taken.

As an aside, I'm kind of surprised that there's no easy way to add EXIF data with AssetsLibrary or UIImageWriteToSavedPhotosAlbum(). I would have sworn that there was one before I went and looked just now.

What is interesting is, if a few person in the graph start identifying themselves on their profiles. Then there might be a way to identify the others in a picture based on his nearby graph, other attributes(like gender + common friends).

Others have already shown how easy is to de-anonymize a social graph from public datasets[couldn't find the relevant paper]

Relevant research is at http://www.cs.utexas.edu/~shmat/shmat_oak09.pdf (warning: PDF).

UIImagePickerController, which is used to take photos, does not return EXIF data. Apparently, it is possible to hack around this limitation, but Apple doesn't take too kindly to this sort of behavior.

UIImagePickerController does indeed return EXIF data. In the delegate method:

  - (void)imagePickerController:(UIImagePickerController *)c
  didFinishPickingMediaWithInfo:(NSDictionary *)info

you can retrieve a metadata dictionary from the 'info' dictionary. One of the keys in that dictionary is "{Exif}" which points to another dictionary that has all the EXIF data.

Does it matter though? The iOS app already asks to get your location information. It's that same location info that would go into the putative EXIF tag, so Color already has the info. Or is there something else in EXIF that would be relevant in this case?

The user may have agreed to let the Camera app access their GPS data, but refused to let your app access their GPS data. For the case of Color, no it's not relevant. For the question posed by the (G?)GP, I think it is.

I was going to say also - THEY KNOW YOUR PHONE NUMBER.

Actually, at least on an iDevice with iOS 4, they don't have access to your phone number. Unless the user types it in (or selects themselves from the address book).

Seems like it's easier on Android, but I'm not certain, just googled a bit.

They removed it in 4. It was there before but it was the number from iTunes activation, which wasn't necessarily worth anything (or filled in). Apple wouldn't approve you if you touched it, either, and it was undocumented.

Device ID they don't seem to care about; I send it in my app's User-Agent and I've survived several approvals. That's uniquely identifiable, but at least you can't call the user. As you suggest, most apps pop up contacts and have you pick yourself, it seems.

Reply on news.ycombinator.com