14.3 Social Media Safety and Information Sharing
The Image File Carries a GPS Pin
Phones write EXIF blocks into every photo: GPS latitude and longitude, timestamp, camera model, lens settings, orientation, sometimes software paths and embedded thumbnails. A geotag resolving to a street number turns a casual sunset post into a confirmed home address, or names the hospital where you spent Saturday. Many upload pipelines strip EXIF from feed posts, but direct file transfers -- email, chat apps set to send originals, synced camera rolls -- preserve it, and video containers carry their own metadata. Export, screenshot, or verify stripping before sharing outside the platform.
The Background Will OCR for You
Before shooting, scan the frame the way an adversary would. Addressed mail, work badges, a driver's license corner, QR codes, and boarding passes -- whose PDF417 barcode decodes to your name and record locator -- are all readable at normal resolution. Screenshot hygiene matters equally: URL bars, chat context panes, notification banners, and one-time-code popups leak credentials and personal data in one upload. Even reflections in glasses and monitor glass, street signage, and skyline angles feed manual geolocation.
Metadata Is Also the Post
Captions, hashtags, location stickers, check-ins, tagged photos, and timestamps are structured, searchable fields. Tagging and resharing networks widen distribution beyond the audience you curated: a reshared post keeps the original's visibility settings yet inherits a much larger readership. Contact-sync and "find me by phone number" settings convert your handle into a phone-number lookup available to strangers.
Aggregation, Not Any Single Post
Any one item is deniable; OSINT tooling joins them -- reused handles, recurring places, sunlight angles, vacation timestamps that imply an empty house -- into a physical-world profile used for pretexting, targeted phishing, and reconnaissance. Lock audience lists, strip location before posting, review tags before they index, and treat every upload as evidence in someone else's file on you.
Architecture Diagram
Key Takeaways
- EXIF GPS can turn a photo into a confirmed home, work, or clinic address; export before sharing files.
- Background text -- mail, badges, QR codes, boarding-pass barcodes -- stays readable at normal resolution.
- Screenshots leak URL bars, notification banners, and one-time codes along with the intended content.
- Tags, reshares, and contact-sync settings widen visibility far beyond your curated audience.
- OSINT risk comes from joining many small posts, so treat each post as evidence in a file on you.