Hacker News Reader

Comment by tppiotrowski | Hacker News Reader

So if I take a photo with my iPhone and upload the photo using a web form, does the website get the exif data (GPS coordinates) or does Safari strip that prior to upload?

View on HN

The website gets it. Safari does not strip it.

IMHO that's the correct thing to do. Maintaining GPS coords is highly desirable when uploading photos to your photo storage solution. It would be very sad if they were all lost.

Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it.

Depends who you're worried about having the EXIF data. Sure Facebook strips the EXIF before rehosting the image for others to consume, but given Facebook's nature I'm certain they use the EXIF data to track you.

If you don't want Facebook knowing exactly where you were at a given datetime, you'll still want to manually strip the EXIF before uploading.

Or don't upload pictures to Facebook.

Seems like a nice feature of the browser would be to tell you when you’re uploading location data and offer to strip it.

That *does* seem like it'd be a nice feature, and maybe even not that hard to implement. Mebbe some crafty developer could build a feature like that as a browser "add-on" / plugin.

randomize exif data ? yes please.

That does sound nice, although it's probably only something we would like. I would imagine the vast majority of people would be like, "Wut" when the dialog popped up. Would make a killer extension though.

> Most web apps (such as facebook, slack) will strip the exif data though, so you don't always need to worry about it.

Don't worry, Facebook will keep a copy of all the metadata.

It appears not. Safari appears to remove the GPS data when you upload. I tested it myself by uploading a photo to https://exif.tools/ and no GPS location was reported. The same image copied to my laptop and then checked locally with exiftool did have the GPS location.

Also see this thread https://apple.stackexchange.com/questions/326789/gps-exif-fr...

This is what I suspected. There were issues with iPhone photo rotation being incorrect after upload so you had to do it manually. I think this is because the EXIF data was missing.

I think people on this thread are confusing uploading in the browser with uploading via the Facebook app

To be clear, exif data was still present when uploaded (including the orientation data) but the GPS location had been removed. I think problems with photos being incorrectly orientated is more to do with the website not correctly interpreting (or completely ignoring) the relevant exif data.

Failing to strip exif is traditionally one of the first mistakes most new sites with photo sharing make. Browsers wouldn't strip it since it is useful information that's used by many sites. Sites that keep it on purpose just have the good sense to make revealing it optional or selective.

Browser's does not strip the exif data but websites should remove the exif data. According to Bugcrowd’s Vulnerability Rating Taxonomy, severity of the vulnerability P3-P4 (medium-low) because the vulnerability leak GPS data of anybody.

I believe the website gets it all.

Reply on news.ycombinator.com