The Dangers of Offline Browser-based Metadata Removers


Warning

This paper discusses the dangers and drawbacks of offline browser-based metadata removers, the motivations for creating them, and the best and safest alternative. It has been prepared by Digital Confidence, the maker of BatchPurifier™, a completely offline and comprehensive hidden data & metadata removal desktop application for Windows®.


Virtually all popular file formats have hidden data & metadata embedded within them. Removing hidden data & metadata from files before sharing them is essential for preventing private and sensitive data leakage.

An offline browser-based metadata remover is a type of tool that employs client-side technologies such as JavaScript and WebAssembly to process files locally, within the user's web browser, and it's not necessary for it to upload them to a remote server. It can run on any web browser, (e.g. Chrome, Firefox, Edge) desktop-based or mobile-based, regardless of the underlying operating system, (e.g. Windows, Linux, macOS, Android, iOS) and it doesn't have to be downloaded and installed locally.

There are today dozens of offline browser-based metadata removers, some are based on open-source projects. The vast majority are completely free to use, while some are freemium or cost money. They vary in reliability and the range of supported file types and hidden data & metadata types.

To use these tools, the files need to be loaded onto the browser app, where the metadata is removed from the files, within the browser. The processed files are then "downloaded" from the browser.

Dangers and Drawbacks of offline browser-based metadata removers

These type of tools are not ideal for batch processing of multiple files across different folders.

However, the main drawback is that, technically, any browser-based metadata removal tool can upload selected files, or data of value derived from them, to a remote server, if it has been designed to do so. It might be designed to do so regularly, or only when certain conditions are met. (e.g. when some keywords are present in the files) This is true even if the tool is installed as a progressive web application. (PWA) Even if the tool is based on an open-source project, the user can never be certain that the web-accessible app actually running is, and always will be, built out of that code and nothing else.

Such tools can be setup by malicious parties looking to steal sensitive information. Even if such tool is setup by a well-meaning party, a rogue employee or a hacker that manages to compromise the server that hosts the app, and gain access to it, could implant subtle malicious code to silently send selected files to a remote server. Servers that hosts such apps can be prime targets for cybercriminals and well-resourced nation-state actors.

The only way the user can be certain an offline browser-based metadata remover will not send selected files, or data derived from them, to a remote server, is to open the app in an incognito window, turn off the internet connection before selecting the files in the app, and closing the incognito window before re-connecting to the internet. This is quite a nuisance, and could easily be forgotten.

Motivations for creating offline browser-based metadata removers

Assuming the owner of the tool honers their commitment not to send the files to a remote server, possible motivations for creating offline browser-based metadata removers include any combination of the following:

  1. A willingness to contribute a useful tool to the public

  2. Financial profit from donations, selling access to the tool, or ads

  3. Tracking and profiling users through the use of the user's IP address, tracking cookies, fingerprinting, or usage statistics

  4. Collection of data of value derived from the files, possibly of personal or sensitive nature, possibly with an intent to share the data with third-parties. Such practice might be against the best interests of the user or the public.

The motivations could change over time.

Conclusion

As the primary purpose of a web browser is communicating with remote servers, using any offline browser-based metadata remover poses significant inherent privacy risks that one should consider. Any offline browser-based metadata remover is just a turn-of-a-key away from sending selected files to a remote server. One should prefer a completely offline metadata removal native application that is downloaded and installed locally. With a native application, one can ensure it doesn't access the internet by denying such permission or adding a simple firewall rule to prevent this.

An example of a completely offline hidden data & metadata removal desktop application for Windows® is BatchPurifier™. BatchPurifier™ can remove hidden data & metadata from multiple types of document, image, and media file formats, including Microsoft Office®, (Word, Excel, PowerPoint) LibreOffice®, PDF, JPEG, PNG, WebP, SVG, AVI, WAV, MP3, and MP4. It supports the selective removal of more than 60 types of hidden data & metadata, including properties, comments, tracked changes, and slide notes. BatchPurifier™ can process thousands of files across different folders at once, with each file size exceeding 1 GB. BatchPurifier™ allows the user to either save the purified files as new files in a specified folder, or to overwrite the original files. BatchPurifier™ integrates with the shell menu, enabling the user to easily send files and folders for purification directly from the Windows file explorer. These features offer the user more comfort, flexibility, and productivity than any web browser-based tool can provide.

Related White Papers