Re: EXIF support in PNG - MAJOR security issue

On Sun, Jan 15, 2017 at 11:11 AM, Adeluc <png-8CwYj0sA/[email protected]> wrote:

> Then someone found that eXIf may contain thumbnail and preview
> images.


The thing here is that you are trying to kill the messenger.  The
discussion is about formally approving a chunk to preserve EXIF data in a
PNG file, the issue you are addressing is unrelated; it is about the
consequences of embedding EXIF data in PNG and any attempt to fight against
that has been lost.

If you were to succeed in killing the proposal, killing the messenger, then
the way EXIF is embedded in PNG will remain obfuscated and the chance for
problems will be increased.

When Glenn original suggested adding a specific comment about one very very
specific security issue raised by EXIF in PNG (not by the proposal) I
argued against that comment because it is misleading; I think your message
proves my point.

I think most informed people care a lot more about the GPS information, at
least in the US; given access to your downloaded photo archive in the cloud
anyone has an instant travelogue of where you were and when.  With the
appropriate warrant, or suitable payment to someone in one of the relevant
companies, or a competent hacker, any resourceful organization can track
someone in my close family because they keep posting photographs to each
other, all day.

ISO-PNG is not a final format in these cases; it is an intermediate format
in an image editing pipeline.  By documenting the issues the people who can
actually make a difference, the application software writers, at least have
a lesser excuse for not doing their job.  That could be done without
formalizing an eXIf chunk, but then PNG would be much less useful in those
pipelines.

-- 
John Bowler <[email protected]>
+1 (541) 450-9885
PO BOX 3151
KERBY OR 97531-3151
USA

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi

_______________________________________________
png-mng-misc mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/png-mng-misc