Abstract
With the rising popularity of cameras and people’s increasing desire to share photos, an overwhelming number of photos have been posted all over the Web. A digital photo usually contains much information in its metadata. Once published online, a photo could disclose much more information beyond what is visually depicted in the photo and what the owner expects to share. The metadata contained in digital photos could pose significant privacy threats to their owners. Our work aims to raise public awareness of privacy risks resulting from sharing photos online and subsequent photo handling conducted by contemporary media sites. To this end, we investigated the prevalence of metadata information among digital photos and assessed the potential privacy risks arising from the metadata information. We also studied the policies adopted by online media sites on handling the metadata information embedded in the photos they host. We examined nearly 100,000 photos collected from over 600 top-ranked websites in seven categories and found that the photo handling policy adopted by a site largely varies depending on the category of the site. We demonstrated that some trivial looking metadata information suffices to mount real-world attacks against photo owners.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
By photographer we mean the person who took the photo rather than who works as a professional photographer.
- 2.
“Classified” refers to the classified advertisements sites such as Craigslist.
- 3.
We crawled the site twice and collected over 1,000 photos.
- 4.
A serial number is unique within a camera brand. Combined with camera make and model, a serial number can uniquely identify a camera.
- 5.
Smartphones typically do not store their serial numbers in their photos.
References
Number of photos uploaded to Flickr. https://www.flickr.com/photos/franckmichel/6855169886/
ExifTool library. http://www.sno.phy.queensu.ca/~phil/exiftool/
Site stolencamerafinder: Find your camera. http://www.stolencamerafinder.com/
Alexa top sites by category. http://www.alexa.com/topsites/category/Top
McAfee’s location is leaked with photo metadata. http://www.wired.co.uk/news/archive/2012-12/04/vice-give-away-mcafee-location
Facebook: https://www.facebook.com/
Twitter: https://twitter.com/
Google+: https://plus.google.com/
500px: https://500px.com/
Flickr file size limits. https://www.flickr.com/help/photos/
Clark, J.W., Snyder, P., McCoy, D., Kanich, C.: I saw images I didn’t even know I had: understanding user perceptions of cloud storage privacy. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI) (2015)
Ahern, S., Eckles, D., Good, N., King, S., Naaman, M., Nair, R.: Over-exposed? Privacy patterns and considerations in online and mobile photo sharing. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI) (2007)
Besmer, A., Lipford, H.R.: Poster: privacy perceptions of photo sharing in facebook. In: Proceedings of the 4th Symposium on Usable Privacy and Security (SOUPS) (2008)
Henne, B., Smith, M.: Awareness about photos on the web and how privacy-privacy-tradeoffs could help. In: Adams, A.A., Brenner, M., Smith, M. (eds.) FC 2013. LNCS, vol. 7862, pp. 131–148. Springer, Heidelberg (2013)
Friedland, G., Sommer, R.: Cybercasing the joint: on the privacy implications of geo-tagging. In: Proceedings of the 5th USENIX Conference on Hot Topics in Security (HotSec) (2010)
Mahmood, S., Desmedt, Y.: Poster: preliminary analysis of Google+’s privacy. In: Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS) (2011)
Pesce, J.P., Casas, D.L., Rauber, G., Almeida, V.: Privacy attacks in social media using photo tagging networks: a case study with Facebook. In: Proceedings of the 1st Workshop on Privacy and Security in Online Social Media (PSOSM) (2012)
Fang, L., LeFevre, K.: Privacy wizards for social networking sites. In: Proceedings of the 19th International Conference on World Wide Web (WWW) (2010)
Ra, M., Govindan, R., Ortega, A.: P3: toward privacy-preserving photo sharing. In: Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2013)
Ilia, P., Polakis, I., Athanasopoulos, E., Maggi, F., Ioannidis, S.: Face/Off: preventing privacy leakage from photos in social networks. In: Proceedings of the 22nd ACM Conference on Computer and Communications Security (CCS) (2015)
Henne, B., Szongott, C., Smith, M.: SnapMe if you can: privacy threats of other peoples’ geo-tagged media and what we can do about it. In: Proceedings of the 6th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) (2013)
Besmer, A., Lipford, H.R.: Moving beyond untagging: photo privacy in a tagged world. In: Proceedings of the 28th SIGCHI Conference on Human Factors in Computing Systems (CHI) (2010)
Zerr, S., Siersdorfer, S., Hare, J., Demidova, E.: Privacy-aware image classification and search. In: Proceedings of the 35th International ACM Conference on Research and Development in Information Retrieval (SIGIR) (2012)
Acknowledgement
We would like to thank our shepherd Chris Kanich and the anonymous reviewers for their insightful and detailed comments. This work was partially supported by ARO grant W911NF-15-1-0287 and ONR grant N00014-13-1-0088. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the funding agencies.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Ethical Consideration
A Ethical Consideration
In our study, we leveraged several methods to collect photos, including: (1) soliciting “fresh” photos from crowdsourcing workers, (2) crawling photos from Flickr using its API, (3) random Google Image Search, and (4) crawling top websites for limited amounts of photos. Note that our crowdsourcing study has been vetted and approved by the Institutional Review Board (IRB) at our institution. During our photo collection, we did not receive any concerns or get warnings from those involved sites and did not interfere with their normal operations. In addition, with the collected photos, we anonymized the metadata information embedded before using them for study. We strictly abide by the copyright licenses if present.
Rights and permissions
Copyright information
© 2015 Springer International Publishing Switzerland
About this paper
Cite this paper
Xu, H., Wang, H., Stavrou, A. (2015). Privacy Risk Assessment on Online Photos. In: Bos, H., Monrose, F., Blanc, G. (eds) Research in Attacks, Intrusions, and Defenses. RAID 2015. Lecture Notes in Computer Science(), vol 9404. Springer, Cham. https://doi.org/10.1007/978-3-319-26362-5_20
Download citation
DOI: https://doi.org/10.1007/978-3-319-26362-5_20
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-26361-8
Online ISBN: 978-3-319-26362-5
eBook Packages: Computer ScienceComputer Science (R0)