-
-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Options to strip EXIF metadata from media uploads. #4426
Comments
(Given we already have the ability to mangle file-uploads before sending them to the server, when we do E2E encryption on them clientside before sending, this isn't impossible, although could be quite fiddly to get right and not pose performance problems). |
http://jsfiddle.net/mowglisanu/frhwm2xe/3/ has a relatively plausible looking example of stripping exif metadata from JPEGs. The right place to insert this is around https://github.com/matrix-org/matrix-react-sdk/blob/443ab1add73390176478fc7ecd1a334aa157e833/src/ContentMessages.js#L293 - either replacing the file with a new file object pointing to the updated data stream, or changing all the downstream code to work on data streams rather than file objects. |
actually, https://github.com/matrix-org/matrix-react-sdk/blob/443ab1add73390176478fc7ecd1a334aa157e833/src/ContentMessages.js#L237 is another option: just before we do the upload, we could check the mime type here for image/jpeg etc and then load the file into RAM and mangle it before sending (and then pass the same buffer to the e2e code as needed). |
another complication is that if we strip off EXIF colour profile metadata we should be re-compressing the image to 'bake in' the correct profile first. the right solution here is probably to leave colour profile meta intact. |
One concern with loading it into RAM would be issues like #4264 |
For some reason i couldn't get this out of my head, so i've pushed a totally untested and almost certainly broken proof-of-concept to matrix-org/matrix-react-sdk@a0eea2a. If someone felt like picking it up and testing/finishing it it'd be hugely appreciated, as I should be focusing on organisational stuff atm rather than writing code, sadly :( |
matrix-org/matrix-react-sdk#1307 ended up being the PR for this, but we couldn't get it to work, and it bitrotted and got closed :( It should still be resurrectable by some kind soul in future though. |
Just some 2ct: I want to use matrix as a kind of shitty dropbox for sharing files including photos with perfectly crafted exif metadata. I wouldn't want matrix to mangle the files in any way, they should be bit for bit identical when I download them again. ➡️ so IMHO stripping exif should be configurable, although probably enabled by default. |
after a brief 3 year hiatus, matrix-org/matrix-react-sdk#1307 now implements this. |
Slack is now offering something similar: https://yro.slashdot.org/story/20/05/11/2051209/slack-now-strips-location-data-from-images . Does it make any sense at all to also allow this in synapse, so that every client wouldn't have to implement it separately? There are toolkits designed for this: https://0xacab.org/jvoisin/mat2 |
This is to prevent even your synapse knowing the metadata |
@t3chguy I get that it's better to remove it on client than server. But as with many things in matrix, there can be different levels of doing stuff (not only e2e, but unencrypted rooms with ssl encryption between servers) and I think it could help many clients if there was a synapse fallback for clients that don't support removing metadata from all different media formats. |
Oh and of course the fact that if you use synapse to do it for in an encrypted room then you'll leak that media. |
Sure, but aren't also url previews disabled for encrypted rooms. I think public/unencrypted rooms may actually benefit more from having the publicly available media scrubbed of metadata |
Huh? This is for media uploads, not URL previews. |
it was a comparison |
I thought Elemet was supposed to be private and secure, but not removing metadata goes completely against that. |
Dear fellow user, private and secure is not the same as anonymous 😉. My general user expectation would be that element does not "mess" with the content of the files I send, unless I specifically tell it to do so. Now if anything gets implemented, then it has to be clear how to enable/disable that, and when it is active. Regardless, stripping won't ever be perfect, because there are many many file types in the wild that can carry meta data and you'd need a custom stripper for each format, and moreover what is meta data at all and what is sensitive meta data in that regard is also not well specified and may differ for different people. Anyway, a good place to start I'd expect would be with
|
matrix-org/matrix-react-sdk#1307 is a partial solution for JPEGs, partial because it also strips some EXIF metadata which is kinda important, like orientation and colour space. |
I do have to agree with @RealDolos here, matrix (unbrella) shouldn't mangle files at all, and even if something like that is ever done, it needs to be very clear and opt-in. |
100% agree. |
A really useful privacy feature would be to be able to strip off any metadata from images (or audio or video) before uploading them to the server. This could be done at the server itself, but then the server would be able to sniff it and it wouldn't work with E2E uploads which are probably the most important ones anyway.
So instead we should probably implement it as an option for the client to mangle the image before uploading to strip it out.
The text was updated successfully, but these errors were encountered: