people are crazy. one thinks EXIF tags on pictures posted on social networks are a vulnerability. The other thinks being able to increase volume on pulseaudio is a vulnerability...

@ThoriumBR I mean ... EXIF tags can be an issue if certain info is not stripped out of them ... they can also be a vuln if someone is encoding data into EXIF for data exfiltration reasons

pulseaudio volume?!?!?

if someone is encoding data on EXIF, the same data can be encoded on the picture itself

change the resolution, encode in a lossy format, and even with both the original and the copy it would be difficult to "prove" there is data embedded in the picture

according to OP, someone with access to the computer can change the volume to a high value and cause permanent hearing damage... so he wants pulseaudio to limit the volume somehow...

yah ... thats legit dumb

physical access is root access ... dont want someone to increase your volume? dont let them touch your computer.

I don't understand why you don't think GPS data in pictures is not an issue

The background is this: in a forum where people talk about sensitive issues (health-related, politics, etc.) some people have posted some pictures, for example of their pets, scenery, etc.

I thought: is this forum going to strip metadata from those pictures? I thought the answer was obviously YES, until I found pictures that had GPS metadata in it

So now for example I know where three users live

They are definitely not aware that such info can be extracted from their innocent pics. And if we are talking about random people, laymen, not power users or IT professionals, I don't expect most people to be aware of this problem. Especially because this problem seems to be mitigated in popular social media like FB or Twitter

I came here to try to understand if this can be classified as a real vulnerability or not, and why. If it is, it can be reported to the software vendor, who will fix it and then the forum will be updated. If it's not though...

I don't think it's a vulnerability because the social network isn't responsible for removing privacy related metadata from the pictures, right? If they stated that they would remove EXIF but didn't, it would be an issue. If they encoded it somehow and people managed to reverse the encoding, it would be an issue.

people walk around with mobile tracking devices all the time, they cannot disable the tracking and it's not a vulnerability... EXIF tags can be removed by the user, can be disabled by the user, and the social network never said they would remove anything.

People cannot disable tracking in devices because everything is made as confusing as possible (even using so-called dark-patterns), because firms like Google, FB, etc. want all your data. They don't want you to disable stuff, that's against their interests and whole business model

But a forum or social media web app has no interest in having their users leak data to third parties

> People cannot disable tracking in devices

False ... just because something in confusing doesnt mean you cant figure it out. Also, while I agree it could be a vulnerability for some its also a "feature" for some ... and its not the responsibility of the social media app to strip it out.

@CaffeineAddiction no, you cannot. signal triangulation is outside of your power.

if you disable cellphone data, you disable both the tracking and the device data capability...

that's the tracking I am talking about, sorry I didn't made it clear.

cookies and so can be disabled, google services can be disabled, you can have a "degooglified" android device, but the ISP tracking is still possible if you use cellular data

ah, tbh I wasnt even thinking cell phone ... like if I make a picture w/ MS paint I can totaly strip the EXIF data ... could do it w/ a pic I take w/ a phone too ... could spoof it if I wanted too

technically if I got the gps cords, elevation, and timestamp just right ... I could make it appear I was on the moon.

if someone uploads pictures with exif tags to a sensitive forum, it's an opsec failure, not a vulnerability on the forum itself.

just like if you posted your SSN and CC info on a forum ... its kinda not their fault your dumb

how about setting minimum password length? Would it be ok to let users choose a 3-char password? If not, why?

@CaffeineAddiction you say so because you work in this field, and you know about exif and everything. How is a layman supposed to know this stuff? Obviously they dont't, so opsec failure is unavoidable, it seems

that is dealing with account security which the forum is partly has a vested interest in

@CaffeineAddiction altitude is a 2-byte signed integer, so you could have 32768 meters at most... still too far from the moon

@reed you are not in the nuclear physics field how are you reasonably expected to not get cancer and grow a third eye?

@ThoriumBR ./sigh ... no fun

you have 4 bytes for coordinates, 2 for altitude, and 2 bytes for speed

lol @ speed ... speed in reference to what?!?! earth? does it take into account spin?

@CaffeineAddiction, excactly, that applies to every field. You don't know anything about medicine, you need to trust the doctors, who hopefully will follow some practices to protect you. So an online forum / social media hopefully follow every practice to protect its users (by teaching them to use longer passwords, AND removing GPS metadata)

@CaffeineAddiction for the GPS, the Earth is a stationary frame of reference

@reed im assuming your not a lawyer ... neither am I ... but if you punch me there will be legal repercussions (even if neither you nor I know exactly what they are right this moment). Security is the same way ... its your personal responsibility to keep yourself secure (within reason).

the speed is in reference to it... it takes the longitude/latitude on t0 and t1, and calculates the distance between the two and the time between the two...

@ThoriumBR makes sense

but speed implies your going in a direction ... which would require a second set of coordinates for vector

you don't need... you need (x0, y0) and (x1, y1) and (t0, t1)

nifty

you calculate delta-t and the distance between those two points

yep

wonder if anything actually makes use of those irl

they do.navigation apps, sports tracking apps, car management apps... there are a good number of uses for speed

bomb guidance software...

all of those applications HAVE that info ... do you think they actually encode it into the EXIF?

dashboard camera apps may encode speed on the exif

snapchat used the speed filter to put the speed on the picture itself and that made some teenagers with a fast car and slow brains to slam into another car trying to get a speed record and ended up with a criminal one...

I don't know if the speed filter is still a thing because I never had snapchat....

@ThoriumBR that is amusing

npr.org/2021/06/17/1007385955/…

looks like it got removed... and several people died

naw, they moved it to a sticker ;)

"""should be able to sue Snap for being negligent in designing a product that led to foreseeable harm"""

./sigh ... this is why we cant have nice things

also, all those idiots in cars attempting to get new high records ... are doing it wrong

buy a plane ticket ... win

or go to the armed forces and fly a fighter jet

or get a gps spoofer app (or hardware) and do it the easy way

lol

easy way is just loading up an EXIF editor and just faking it

or disassemble the app and make it fake anything

@ThoriumBR - You've handwaved away an important point about weak passwords

Applications could just say "meh, they used a weak password, their fault"

But that's not best practice because we're supposed to defend apps as best we can even in the face of user error

weak passwords are to protect the system, not the user.

Hence filtering EXIF tags

On a public forum with open registration? No, there to protect the user

if the user have the same password everywhere and it leaks, the attacker can use those credentials to abuse its permissions and attack the system... the system does not care about your security

Ok

and if you allow a 3-char password, it will be hammered down day and night... not any admin will like to have

Your systems don't care about your users security

Mine do

Fair enough

I work on enterprise systems... large banks, intercontinental support systems

the user isn't a concern, the damage the user can make is the concern

Well, if you work on bank systems you'll know they care about user security

and don't have the illusion that the systems care about you, they care about the liabilities of a choice and if you will sue them or make them look bad... not on your well being.

They care about your well being because it reflects on them

it's not "the user have a weak password, someone could steal money from them" but "the user have a weak password, someone will steal from them and we will have to reimburse him if he sues us"

Not just liability, there's reputation also

Exactly

My point - we do care about user's security. Whatever route you get there, we do care

so no, your personal security is far from their minds...

I'm going to stop talking to you now

Because frankly you're talking rubbish and contradicting yourself

sure! no problem!

it's all about opinion and we both are entitled to our opinions

we don't have to agree

@paj28 i can see both sides ... on the one hand you have the bleeding heart liberals' point of view "omg users need to be protected from their own stupidity ... foam pad all the things" ... on the other side you have the voice of reason "our users are going to do dumb things ... we need to protect ourselves from libaility from their stupidity"

./shrug its prob somewhere in the middle ... but yah

I have access to systems in both sides... one is "do whatever you want, you will be held responsible" and one if full of controls and requests and logs and everything else...

for example, I have a scheduled change to renew a certificate that we are trying to execute for 3 weeks (and counting) because we have to get so many approvals, and one of them got rejected and we had to start from scratch... and the certificate expires Monday...

the other just gives us superuser powers and we just have to document what we did because if something breaks they know who to blame

one we have to change our passwords every 30 days, with all those nice password rules and some invented ones, the other does not care a bit about our passwords, but if something is done with our credentials we got offboarded.

curious, how the f did the convo go from EXIF info to 3 char passwords?

these 2 things seem to be totaly unrelated

we got from exif to teens throwing their cars on trees...

I'm not saying we have to agree. I just can't discuss a complex issue if you say "banks don't care about their users security" then "oh well, they do, but only cos they might get sued". That's just obfuscation

Doesn't matter if it's "foam pad all things" or "protect ourselves from liability"

Whichever motivation - same outcome - do what you can to protect users

The point about weak passwords was that it's a widely accepted security control that exists only because users don't always do the right thing security wise

I think ultimately the way the original question was worded invited an academic discussion about what exactly constitutes a vulnerability, but the questioner's intention was more like "does it need to be fixed?"

maybe, imo passwords : exif is a bad analogy

passwords are all about security

exif could in theory have other use-cases

its kinda like saying stripping email and phone numbers out of all users posts is good in the name of security ... but doing that for chat on something like a dating app would srsly break functionality

very much grey area

banks care about their money... not usability, resources, easy of use or your well being... we used to have lots of meetings with c-level bank employees and the question we heard most was "and what it will cost?"

if they had an issue on their systems that they could safely blame the user and not the system, they blamed the user

if they cared about the user, they would have paid and fixed the flaws, but as they could "prove" it was an user related error, damned be the user