Is it safe from a privacy and security point of view to display identifiable EXIF data on a public web site?

Question

Whenever I compare the exif data displayed by Flickr or the data on Lightroom (3.4), I can't avoid getting my mind blown for the simple fact that I never come to a software tool (for windows) with a nice interface that can display all the exif data that flickr does.

Related to that I have a bit of an uncomfortable feeling on this matter and wanted your opinion on this:

Is it safe from a point of view of privacy and security to display the lens serial number on the exif data?

I ask this because for one side I think it's secure to have this info on the picture, but I found a bit of privacy evading having that info displayed. Since I can not see this info in Lightroom I've no idea on how to edit or hide it.

Answer 1

I'm answering the more general question about EXIF data, rather than the specific question about the lens serial number.

It probably depends on how paranoid you are, and how much you have to hide (for example if you have a security clearance or are committing activities that might be illegal (or could become illegal in the future) or violate social norms, such as trespassing to take pictures inside an abandoned building). If you regularly post your activities on sites like Facebook, Twitter, or FourSquare, you probably don't need to be worrying about what the EXIF data in your photos might reveal. If you're more jealous of your privacy, you may care.

Time and date info in EXIF data can be an issue: someone mining your EXIF data could establish patterns (you go for a photo walk, away from your home, every Saturday afternoon; you regularly pass through an out-of-the-way place on your way to work/school/church; the length of your typical photo vacation could be calculated), or prove that you were at one location when you were supposed to be somewhere else (your boss or HR checking up on your activities when you call in sick; an insurance company questioning why you were on a moderately-strenuous trail when you're supposed to be resting after a workplace accident; a potential employer looking to see if you frequently take photos that would interfere with your working hours).

Someone could identify targets that carry lots of expensive photo equipment by looking at the range of focal lengths used or perhaps lens-identification in EXIF data, or by deeper analysis like, "this shutter speed at this time of day requires a tripod and filters, and since the wind was clearly gusting it must have been a high-quality tripod").

I'm sure that more sophisticated analysis (such as learning about your personality or habits based on commonly-used focal lengths, white balance, or other settings) could be done, too, but that's not something I understand well enough to be able to comment on.

If you regularly include EXIF data and then one time you don't include the EXIF data, that could indicate that you're trying to hide something.

If you're concerned enough about privacy or security that you want to strip EXIF data, you may also want to consider falsifying the EXIF data, which of course is a lot more work.

Answer 2

If you maintain multiple not obviously connected accounts (Flickr or otherwise) and wish to keep those accounts independent of each other - for whatever reason - then this is a potential weakness. If the same serial numbers are displayed, then those serial numbers could be used as a way to connect those accounts (Flickr to Flicker, or perhaps Flicker to some other account where you have your photos posted).

This method doesn't prove the connection between the accounts (rented/borrowed/sold lenses) but it could be enough that the connection would be shown with more investigation.

That said, I personally don't worry about posting that information along with my images - but all my accounts are fairly obviously tied together. If I had a "special" account that I wanted anonymous for whatever reason, I would likely strip out this data - using the methods other answers have provided.

Answer 3

If you're concerned, this is a great command-line tool for stripping EXIF data en masse:

http://www.yafla.com/papers/purejpeg/filter_unnecessary_jpeg_info_such_as_exif.htm

I strip EXIF data from my jpegs not because I'm concerned about security, but because the EXIF is a big chunk of the overall file size. My pictures display faster on my site when they're smaller. Conversely, I can display higher resolution photos with the same performance as lower res ones that contain EXIF.

Answer 4

I kind of understand your feeling, but can't really find any problems with it. "What could possibly go wrong?".

As for viewing/editing EXIF-data under Windows, there are numerous options:

• I'm a Lightroom rookie, but in 3.5, in Library view, you can see an image's metadata (EXIF and IPTC) in the right pane, by expanding the "Metadata" header
• ExifTool is a fantastic free command-line tool for batch processing metadata. It understands most image formats, inlcuding various RAW formats. If you run it against an image without additional parameters, it will list all metadata it can understand.
• The dated Exifer is not particularly pretty, but gets the job done too.

I myself use ExifTool extensively to:

• Geotag images using exported GPX files
• Add photographer to Copyright info
• Rename photos to an uniform format based on time and date, regardless of camera (YYYYMMDD-HHmmSS-Initials)
• Offset time, if I forgot to change timezone when travelling

It's great!