Page MenuHomePhabricator

Option to strip some metadata on upload (GPS/geolocation privacy)
Open, LowPublicFeature

Description

Geotagging photos is great, but we should make it easy to strip it out in some cases.

There's no reason to have GPS metadata in pictures of e.g. common household items that some unsuspecting Wikipedian has taken in their living room, and then found that their house's full GPS co-ordinates are now on the internets.


Version: 1.16.x
Severity: enhancement

Details

Reference
bz20326

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:55 PM
bzimport set Reference to bz20326.
bzimport added a subscriber: Unknown Object (MLST).

Ideal interface is probably something like:

  • pick your file
  • hit 'upload'

*chug chug chug it uploads*

  • Confirmation screen shows thumbnail of your file, its name, description, and

metadata

  • If GPS location data is included, display a notice with the coordinates *and

a map*

  • Give option to complete the upload, complete the upload but strip the

location data, or cancel the upload.

Listing bug 16437 (interstitial upload preview) as a dependency.

  • Bug 35514 has been marked as a duplicate of this bug. ***

Check out my dupe bug for a description of why more than just GPS EXIF data needs to possible to remove. (The keywords "EXIF" and "EXIF data" are now in this bug report, so it'll turn up for people searching for dupes.)

For me it would be nice if if it actually get the GPS data and use it in the location template, right now I need to add GPS to images from my phone (I take pictures with DSLR without GSP) and then use in upload, extract the GPS coordinate and put it as {{location}} string in more info, since putting just numbers in input field, give error that number need to be between 180 and -180 event that I put proper GPS floating point number.

So basically I need to manually add location even that the upload can use data from EXIF which should be trivial to add, it can have option and warning about privacy but require an action to strip off GPS data, or force to select an option. For Wikimedia Commons I take pictures mostly of architecture and I want GPS data to be inside the file and inside the page with the file, so there should be an option to include them.

I can help with development of this feature, but I'm new to phabricator and media wiki and don't know where to start. I'm not sure where to search for upload wizard. Is it in MediaWiki repo or is this extension?

Aklapper added a subscriber: Bawolff.

@Jcubic: Hi and thanks for your interest! In general, I'd point to https://www.mediawiki.org/wiki/How_to_become_a_MediaWiki_hacker , probably in the /includes/upload/ folder of MediaWiki Core.

Also see T37514 for some more background.

Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 11:01 AM
Aklapper removed a subscriber: wikibugs-l-list.

What's the current solution for this problem? Download the image, remove the data, reupload the image, delete old version?

I don't think it will work. I wanted to change the GPS data. I've uploaded a new file but the GPS didn't change.

+1, we need a solution for this. It's been 10 years, and in my opinion, it should not be considered a low priority. Privacy is paramount, and asking to manually remove GPS metadata is counterproductive

There was some discussion about this in the Wikipedia weekly Facebook channel. I'm summarizing the conversation here so it's not lost so please don't shoot the messenger :-). I've anonymized all this feedback - but if you want me to credit you for any of this please drop me a note in Facebook:

  • Most phones these days can strip GPS metadata so the message could point to tooling or documentation around how to do that.
  • Client side software (phone OS) has implemented a lot of this making it less pressing
  • there is a big contingent that finds this data useful and isn't excited about the prospect of it being stripped, even though they probably wont say that publicly as it is very hard to justify that view in light of the privacy issues.
  • Editing the source file would be much harder due to quirks with MediaWiki architecture, nothing in our stack does that. Patches for this are unlikely to make much progress. Refactoring the code would be incredibly risky relative to the benefits of this bug.
  • The easiest thing to do here would be to make sure the end user knows that they should strip location data before uploading. Apparently we already do this in UploadWizard but not other upload workflows. This is very much a case of patch-welcome if somebody wants to do that. It could be a warning box or note on the uploading workflow (perhaps during the upload itself "This contains location data are you sure you want to upload it?" for example.

The easiest thing to do here would be to make sure the end user knows that they should strip location data before uploading. Apparently we already do this in UploadWizard but not other upload workflows. This is very much a case of patch-welcome if somebody wants to do that. It could be a warning box or note on the uploading workflow (perhaps during the upload itself "This contains location data are you sure you want to upload it?" for example.

One complicating factor is that uploadwizard refuses to upload any files with warnings on them afaik. [afaik this isnt true anymore]

I just tested upload wizard. There is a warning beside the geolocation data with a link to more instructions on how you can use other software to remove this. It then shows the geolocation data and allows you to edit it or blank it. I blanked the geo location data and contained to upload the file. The file still contains the geolocation data. This is so not initiative for a lay user.https://commons.wikimedia.org/wiki/File:Wikimania2025atAirport.jpg

IMG_7447.PNG (2×1 px, 350 KB)

Basically blanking this does not remove the EXIF data. I want a button that says "Remove location data" within the upload wizard. Right now we basically allow commons contributors homes / word to be often be easier found.

Relatedly: the software already has the functionality to show what metadata is present in a file: it shows this information on the File: page. So as a minimum step, we could at least also show that information to the user during file upload (before they finalize the upload and the file and its metadata go live and public), T338288, so they could at least know what metadata their file had and decide whether to proceed with the upload or whether to back out and pursue a non-wiki-based means of removing the metadata, even if we don't add an in-wiki way for them to remove that metadata. (At present, the software simply shows a generic "EXIF metadata in this file may contain location or other personal data" message on all uploads, even if the upload contains no EXIF data or metadata.)

IMG_7447.PNG (2×1 px, 350 KB)

Basically blanking this does not remove the EXIF data. I want a button that says "Remove location data" within the upload wizard. Right now we basically allow commons contributors homes / word to be often be easier found.

So i guess there are two separate issues kind of being grouped together here:

  • an ability to strip gps from the upload
  • poor UI leading users to misunderstand what that particular step does. The intention of that step is not to allow users to remove or change location data in the file. However i could see how it would be really easy to misinterpret it that way.

So i guess there is a question of if stripping the GPS is actually needed or if clarifying the UI would solve the underlying concern. Maybe we need to do both.

We definitely need both for people who want to remove location data. We do
not want people having to go to other software to do it. And we need a
mechanism to help those out who uploaded location data by mistake without
having to publicly broadcast it on Conmons

J

Sent from Gmail Mobile

There are two separate cases:

  1. Privacy. In this case is better to remove GPS from exif, but most users don't know how to do it.
  2. irrelevant coordinates. In this case is no need to remove it from EXIF, but is good to remove it from maps. For this case exists {{GPS EXIF ambiguous}}, but there should be possibility to add it during upload

For me is not solution make photos without GPS, because 95% of my uploads are geographical features and only few are photos of food, books etc.

Let's focus conversation on the most technically reasonable way to reflect a user's choice to remove lat/long (and other data extracted from the EXIF) at upload time from the form, and reflect those choices in the EXIF data of the resulting publicly available image.

While it is possible to remove geolocation with certain software tools on PCs, there is little possibility to remove the geolocation stamp when you upload from a mobile device.
A checkbox to remove the geolocation not only in the description page, but also in the metadata would be very appreciated.

The problem I see is that UploadWizard would habe to be able to change the EXIF information of the image.

Yes @HangmansDeath the plan is for the Upload wizard to be able to change the EXIF for the image itself.