The Dangers of Online Metadata Removers


Warning

This paper discusses the dangers and drawbacks of online metadata removers, the motivations for creating them, and the best and safest alternative. It has been prepared by Digital Confidence, the maker of BatchPurifier™, a completely offline and comprehensive hidden data & metadata removal desktop application for Windows®.


Virtually all popular file formats have hidden data & metadata embedded within them. Removing hidden data & metadata from files before sharing them is essential for preventing private and sensitive data leakage.

There are today dozens of online metadata removers, some are free, some are freemium, and some cost money. They vary in reliability and the range of supported file types and hidden data & metadata types.

To use these tools, the entire files need to be uploaded to a remote server on the cloud where the metadata is removed from the files. Typically, the files are uploaded using a secure encrypted connection, but once the files reach the server, they must be decrypted for processing. The processed files are then downloaded from the server.

There are two types of these tools:

  • Browser-based web applications - these have an online web interface that can be accessed by any web browser, (e.g. Chrome, Edge, Firefox), desktop-based or mobile-based, regardless of the underlying operating system. (e.g. Windows, Linux, macOS, Android, iOS) They don't have to be downloaded and installed locally. These are the vast majority.

  • Interface-only native applications - these need to be downloaded and installed on the device locally, but provide only interface whereas the actual processing of the files occurs on a remote server to which the files are uploaded to

Dangers and drawbacks of online metadata removers

Both types are not ideal for large files, and browser-based tools are not ideal for batch processing of multiple files across different folders.

However, the main drawback is that using online tools means that anyone who have access to the server will have full access to the uploaded files, data and metadata. Technically, they can do with them whatever they please, including sharing them with others. The owners of these tools typically state that uploaded files are automatically deleted shortly after they are processed, but one can never be certain that this is the case.

Such tools can be setup by malicious parties looking to gain access to sensitive information. Even if such tool is setup by a well-meaning party, a rogue employee or a hacker that manages to compromise the server and gain access to it could implant code to silently send uploaded files to another server before they are deleted. These kind of servers can be prime targets for cybercriminals and well-resourced nation-state actors. Using such tool for processing files with private data could also violate privacy laws and regulations.

Motivations for creating online metadata removers

Assuming the owner of the tool honers their commitment not to keep the files, possible motivations for creating online metadata removers include any combination of the following:

  1. A willingness to contribute a useful tool to the public

  2. Financial profit from donations, selling access to the tool, or ads

  3. Tracking and profiling users through the use of the user's IP address, tracking cookies, fingerprinting, or usage statistics

  4. Collection of data of value derived from the files, possibly of personal or sensitive nature, possibly with an intent to share the data with third-parties. Such practice might be against the best interests of the user or the public.

The motivations could change over time.

Offline browser-based metadata removers are not free from dangers

A closely related class of tools are offline browser-based metadata removers. This type of tools employs client-side technologies such as JavaScript and WebAssembly to process files locally, within the user's web browser, and it's not necessary for them to upload the files to a remote server. However, just because it's not necessary, doesn't guarantee they won't do that anyway. Technically, any browser-based metadata removal tool can upload selected files to a remote server, if it has been designed to do so.

Conclusion

Using any online metadata remover that uploads files to a remote server for processing poses significant inherent privacy risks, and is strongly discouraged. Online metadata removers inevitably increase the data exfiltration attack surface - the number of computers that have access to the data - and therefore they increase the risk of data leakage. Whoever creates such tool is irresponsible, at the very least. Offline browser-based metadata removers are not safe either, as technically, they can exfiltrate the files, or sensitive data derived from them. Both types of browser-based tools are a great menace to organizations, and those are advised to educate their members about the dangers of such tools, and to block access to them using web filtering solutions.

One should prefer a completely offline metadata removal native application that is downloaded and installed locally. With a native application, one can ensure it doesn't access the internet by denying such permission or by adding a simple rule to a reliable "airtight" firewall to prevent this.

An example of a completely offline hidden data & metadata removal desktop application for Windows® is BatchPurifier™. BatchPurifier™ can remove hidden data & metadata from multiple types of document, image, and media file formats, including Microsoft Office®, (Word, Excel, PowerPoint) LibreOffice®, PDF, JPEG, PNG, WebP, SVG, AVI, WAV, MP3, and MP4. It supports the selective removal of more than 60 types of hidden data & metadata, including properties, comments, tracked changes, and slide notes. BatchPurifier™ can process thousands of files across different folders at once, with each file size exceeding 1 GB. BatchPurifier™ allows the user to either save the purified files as new files in a specified folder, or to overwrite the original files. BatchPurifier™ integrates with the shell menu, enabling the user to easily send files and folders for purification directly from the Windows file explorer. These features offer the user more comfort, flexibility, and productivity than any browser-based tool can provide.

Related White Papers