<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr; font-family: Verdana; color: rgb(0, 0, 0); font-size: 13px;">
<div style="">It's easy enough to test if Facebook is doing it. Just download your photos and compare the downloaded to the originals via exiftool and diff.<br>
<br>
I'm on an assignment now, so I'm not going to launch Facebook, but someone else should be able to test with minimal effort.<br>
<br>
So far as privacy goes, yes, you should be careful about what you post online, but I wouldn't be overly worried about kids. The vast majority of abduction cases of young children are by people that already know the child. The bad guys aren't scoping the Internet
looking for just any kid. They usually are going after a specific kid. Sharing settings and exif data control won't protect against that threat.<br>
<br>
The more serious risk is when the kids get older and start using the Internet themselves. At 13-17, there ARE people out there looking for easy targets. The best way to protect against this is to share data on the Internet when the kids are 0-12, but do so
making sure they understand what you are doing and why. That way, when they hit 13, they already have a decent chance of being responsible with the data that they're sharing on the Internet themselves.<br>
<br>
At the age of 10-12, I would suggest working with a kid and showing them how to insert false metadata into photos and videos. They can have fun making up stupid stuff and watching their photos appear on the map in Uzbekistan, but along the way they'll learn
about hidden data and how to protect themselves.<br>
</div>
<div><br>
<div style="font-family: Tahoma; font-size: 13px;">
<div style="font-family: Tahoma; font-size: 13px;">
<div style="font-family: Tahoma; font-size: 13px;">
<div style="font-family: Tahoma; font-size: 13px;">
<div style="font-family: Verdana; font-size: 13px;">
<div style="font-size: 13px;">
<div style="font-size: 13px;">
<div style="font-size: 13px;">
<div style="font-size: 13px;"><font size="3"><span style="font-weight: bold;">Josh More</span></font> | Senior Security Consultant - CISSP, GIAC-GSLC Gold, GIAC-GCIH<br>
<span style="font-weight: bold;">Alliance Technologies</span> | <a href="http://www.AllianceTechnologies.net" style="color: rgb(255, 0, 0);">
www.AllianceTechnologies.net</a><br>
400 Locust St., Suite 840 | Des Moines, IA 50309<br>
515.245.7701 | 888.387.5670 x7701<br>
<br>
Blog: Don't just blame the bad guys, it's your fault too<br>
<a href="http://www.alliancetechnologies.net/blogs/morej" style="color: rgb(255, 0, 0);">http://www.alliancetechnologies.net/blogs/morej</a><br>
<br>
How are we doing? Let us know here:<br>
<a href="http://www.alliancetechnologies.net/forms/alliance-technologies-feedback-survey">http://www.alliancetechnologies.net/forms/alliance-technologies-feedback-survey</a><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF942891"><font color="#000000" size="2" face="Tahoma"><b>From:</b> cialug-bounces@cialug.org [cialug-bounces@cialug.org] on behalf of Matthew Nuzum [newz@bearfruit.org]<br>
<b>Sent:</b> Wednesday, March 02, 2011 08:48<br>
<b>To:</b> Central Iowa Linux Users Group<br>
<b>Cc:</b> Zachary Kotlarek<br>
<b>Subject:</b> Re: [Cialug] Security issue with geotagging your photos<br>
</font><br>
</div>
<div></div>
<div>
<div class="gmail_quote">On Tue, Mar 1, 2011 at 10:52 PM, Zachary Kotlarek <span dir="ltr">
<<a href="mailto:zach@kotlarek.com" target="_blank">zach@kotlarek.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im"><br>
On Mar 1, 2011, at 8:19 PM, Matthew Nuzum wrote:<br>
<br>
> This may seem obvious to you but believe me, it's not obvious to everyone.<br>
><br>
> When you enable geotagging of your photos on your smartphone it may give strangers the ability to know exactly where you (and your kids or friends) like to hang out. You may want to consider disabling it by default.<br>
><br>
> <a href="http://www.cybersalt.org/general-news/smartphone-pictures-pose-privacy-risks" target="_blank">
http://www.cybersalt.org/general-news/smartphone-pictures-pose-privacy-risks</a><br>
<br>
<br>
</div>
I think that is the wrong battle. Don't get me wrong -- I think controlling image metadata is important and people should be made aware -- but I think it's an awfully subtle thing to sell to people who are intentionally broadcasting their images on the Internet.<br>
<br>
For this to be a problem you have to already be exposing pictures of you, your cohorts, your surroundings and probably some bits of your behavior to the world at large. The fact that there are GPS coordinates in the photo just make your location easier to index,
but that is far less data than you're exposing already with the image itself.<br>
<br>
I think the right answer is to only share images with people you explicitly want to see them. While that's contrary to the way that many image-sharing services work, and perhaps even contrary to the way people want to conduct themselves, it would all but eliminate
the problem described here. It's also a consistent, easy-to-understand message about privacy, as opposed to some technical detail related invisible data your phone may or may not put into the private-data-rich photo you're already intentionally sharing with
all of FaceBook.<br>
<br>
</blockquote>
</div>
<div><br>
</div>
<div>I don't disagree, I myself am cautious about posting pictures, especially of kids. However, by their very nature, photos ask to be shown around. Even someone who is cautious will probably make mistakes.</div>
<div><br>
</div>
<div>I just downloaded a picture that I had uploaded to facebook and found the exif data was all stripped. Can someone confirm that it is the exif data that is important here? Anyone else care to confirm that facebook is actually doing this?</div>
<br>
-- <br>
Matthew Nuzum<br>
newz2000 on freenode, skype, linkedin, <a href="http://identi.ca" target="_blank">
identi.ca</a> and twitter<br>
<br>
"An investment in knowledge pays the best interest." -Benjamin Franklin <br>
<br>
</div>
</div>
</div>
</body>
</html>