Did you know Signal automatically strips EXIF metadata from every image you send? A quick way to "sanitize" a photo before posting it publicly is to forward the picture to your own "note to self" chat—Signal will strip the metadata and give you a clean copy.

How do you use "note to self"? Share your favorite tricks!

#signal #privacy #exif #infosec

@ilyess But this compresses the image resulting in quality loss. There are dedicated tools for this.
@jdw That's a fair point. For a truly loss‑less clean copy, a dedicated EXIF-removal tool is the better choice. But in a pinch, when image quality isn’t critical, this little trick works nicely.
@ilyess @jdw https://f-droid.org/packages/code.alimiracle.image_meta_cleaner might fit the bill (I have not checked what specifically it removes/leaves)
Image Meta Cleaner | F-Droid - Free and Open Source Android App Repository

a cross-platform application designed to Show and Remove metadata from images

@ilyess @jdw yeah, that's a great tip, if you need to remove exif data unexpectedly and don't have any other tools on hand

If you don't want any compression and want to remove the data directly on your android phone, I like this app: https://github.com/Tommy-Geenexus/exif-eraser (repo contains links to the apk itself and Google Play Store)

GitHub - Tommy-Geenexus/exif-eraser: Permissionless image metadata erasing application for Android

Permissionless image metadata erasing application for Android - Tommy-Geenexus/exif-eraser

GitHub
@jdw @ilyess not only that, but aren’t there ways to include attribution and alt-text in the metadata? I’d rather not reflexively remove those

@ShadSterling I agree. For more granular EXIF data manipulation needs, a dedicated tool would be a better option.

@jdw

@jdw @ilyess yeah it also uses bandwidth for something where it really doesn't make sense to
@ilyess - Diaspora do the same
@katharsisdrill Do you know if they strip EXIF metadata on the client side or on the server?
@ilyess @katharsisdrill Assuming it's properly E2EE as it claims, it would only be possible to do at the client end.

@me It doesn’t seem like this is happening on the client side, and I don’t see how a server could manipulate encrypted images if they truly fall under E2EE.

I’m pretty sure the image is first uploaded to a Diaspora server, which then strips the EXIF metadata (let me know if I'm wrong!). That means you’d have to trust the Diaspora server. I would recommend avoiding this approach, since there are alternatives that don’t require trusting any particular entity to strip EXIF data.

@katharsisdrill

@ilyess @katharsisdrill

It doesn’t seem like this is happening on the client side


How did you make this determination? I can't think of an easy way to do that.

@me It was from the PR that @katharsisdrill linked prior to your message. It wasn't on the same thread though, so you might have missed it. Here's the link: https://github.com/diaspora/diaspora/pull/5510

As you can see, EXIF stripping takes place in .rb files which are executed on the server. I would have expected client-side EXIF manipulation-or any other logic for that matter-to be in JS, Webassembly, or another language that can run on the browser-not Ruby. But I could be wrong.

#779 Strip EXIF data as user preference by margori · Pull Request #5510 · diaspora/diaspora

My solution for issue #779 including Strip EXIF data from uploaded images. Privacy user preference to allow not striping. DB migration for new user pref. Testing both cases. I need a review of ph...

GitHub
@ilyess I'd recommend not relying on that method. It creates a poor habit. I suggest getting in to the habit of using a dedicated strip tool.
@ilyess The "note to self" might be the thing I use the most in my phone.
From sharing links to later open on the computer, to reminder of things to do, it has become absolutely necessary for me.
@ilyess it also has an automatic face blurring feature in the edit function
@ilyess any time someone gives me a number at the pizza place or any other temporary price of info I pop it into note-to-self so that I don't have to remember to delete it later when it is no longer important.
@kdacar I take it you enabled disappearing messages on the note-to-self chat as well, right?
@ilyess if im sending an image from my phone and need to strip exif i take and crop a screenshot of it from my gallery