
How taking pictures through windows  can inadvertently reveal your location - sebkomianos
http://blog.ioactive.com/2014/05/glass-reflections-in-pictures-osint.html
======
_mulder_
Isn't revealing your location the whole point of taking a picture from your
hotel window and sharing it with the world on Twitter? I wouldn't be too
surprised if I posted "I'm in Miami, and here's a view from my Hotel window"
and someone was able to tell me the Hotel name and which side I was staying
on. Infact, I'd be more surprised if someone couldn't!

The techniques used are not particularly ingenious here, especially as most of
the photo's seem to depict some obvious landmarks to provide an easy point of
reference, especially when given the extra information to focus on a specific
location.

~~~
muyuu
Yep, pretty much. The article's neat, but isn't the point of the kind of
pictures shown in this article to show where you are? I don't think you can
call this "inadvertently".

This is a bit like checking in with Foursquare. If there's a security concern
with showing it real-time and net-wide, then you just shouldn't.

Reminded me of this:
[https://pbs.twimg.com/media/Bm1gMRUCIAA8Y4E.jpg](https://pbs.twimg.com/media/Bm1gMRUCIAA8Y4E.jpg)

~~~
danielbarla
I think they point is that people would be surprised that you can relatively
easily narrow down a vague picture to almost a floor / room number level.

I'm guessing some people may not be comfortable with that.

~~~
powera
You're not going to figure out the room number based on what lamp is in the
room.

~~~
nitrogen
Not from the lamp, from the geometry.

------
arrrg
Using the reflections as additional information is very interesting. However,
I’m not that surprised that views from windows can be relatively easily
located. Andrew Sullivan has been running his View From Your Window contest
for four years now and people have been guessing the locations of the photos
with scary accuracy (as good as in the linked post).

Here is the archive: [http://dish.andrewsullivan.com/vfyw-
contest/](http://dish.andrewsullivan.com/vfyw-contest/)

Still, it’s probably more than 15 minutes work even in the best case scenario
(and much, much longer in the worst case), can probably not be automated in
any meaningful way (but that would be an interesting project, huh!) and is
consequently only of interest to dedicated attackers, not general
surveillance.

~~~
abruzzi
And he doesn't even give a starting city or country. His readers have to
narrow down the location using street signs, building types, car types, and
other subtle hints. So if you don't want people to find you don't post
pictures of where you are.

~~~
saraid216
> So if you don't want people to find you don't post pictures of where you
> are.

This cannot be said enough.

It's definitely worth educating people to the kinds of things they're exposing
when publishing things like vacation photos, but most people shouldn't have a
need for that level of information security.

------
hoggle
"Finally, do not forget that a reflection could be your enemy."

On a tangent - I didn't realize that the google maps 3D rendering has gotten
so good over the last couple of years. I wonder how hard it would be to scrape
the point data and satellite textures to source a GTA map, I'd love to cruise
through actual Vice City with the GTA V engine.

If you haven't checked it out yourselves - breath-taking WebGL view of Miami
(Chrome, OSX):

[https://www.google.com/maps/place/Miami,+FL/@25.7747883,-80....](https://www.google.com/maps/place/Miami,+FL/@25.7747883,-80.1751686,528a,35y,261.17h,71.49t/data=!3m1!1e3!4m2!3m1!1s0x88d9b0a20ec8c111:0xff96f271ddad4f65)

~~~
lookingsideways
If you're on OSX, try it out in Apple Maps, I find their 3D views superior to
Google's and it's been available in more locations that I've looked at.

On the iPad you also get more control over viewing angles, I was surprised
that you lose that on the desktop.

~~~
lelandbatey
Hold the 'Ctrl' key and you can use the mouse to rotate to any angle you like.

------
pjc50
This reminds me, can't find it right now, but there is a picture circulating
on Twitter of a safari park warning sign:

"Please make sure you turn off location and be careful about sharing photos of
our rhino on social media, you may give away its location to poachers"

~~~
user24
[https://twitter.com/robinsloan/status/463343201865048064](https://twitter.com/robinsloan/status/463343201865048064)

~~~
pbhjpbhj
Trying to find the source of that image - Google lists it on a few tumblrs
going back to 2010 (tumblr apparently started in 2007, who knew) - except when
you go to the oldest of them it's only just been posted, today, not 2010.
Google never seem to have been able to do dates reliably.

------
quasque
This reminds me of the child pornography case a few years back, where
detectives were able to identify the hotels where the abuse took place via
imagery of the rooms.

Interestingly, rather than figuring it out themselves (as the search space was
too huge), they crowdsourced it by releasing images with the child
photoshopped out.

------
alkonaut
Point is: when you post a view or a location name that's when you _want_ to
tell the world where you are. I'm not inadvertently revealing my location I'm
very much advertently revealing it.

I assume there are much more creepy techniques to tell where I am when I _don
't_ explicitly reveal it.

------
chatman
If it comes to stalking someone, why just a hotel picture? Any picture, and
previous context (e.g., "Miami, I am here"), can be tracked down to the exact
location.

~~~
nardi
I was going to say the same thing. This has little to do with hotels or
reflections. Any picture at all with a skyline in it, given a good enough 3D
map and some software (maybe the NSA has some already?), should be enough to
pinpoint you pretty closely, depending on the nearness of the skyline and the
quality of the picture.

------
jeroen
Views out the window are also very useful for finding the exact location of
real estate for sale or rent, when the ad only shows an approximate location.

------
clarky07
So, 99.9% of the information was gathered based on the actual photo, and .1%
of it confirmed with reflections. Impressive. Hmm, this picture of a landmark
came from the building near the landmark. How did you get that with just
reflections?!?

------
awjr
I'll be taking this material and creating a tutorial "101: How to stalk a
celebrity and make them feel slightly uncomfortable"

However, in all seriousness, nice levels of deduction going on here and only
slightly creepy tweets :)

------
JTxt
With a set of photos of the same static scene, it's possible to figure out the
camera position, angle, and focal length of every camera, sometimes to
millimeter accuracy. You just have to correlate the same features in each
frame, then solve it.

3d motion trackers do this. (Blender.org has one. You can solve this same
problem using it. Bring in public and street view photos of the area. It's a
bit of manual work to put all the images in a movie then go frame by frame and
tag features... But you could get much more accurate than the article.)

The power is in having access to large databases of photos of everywhere, and
even better if all the photos were taken the same way, like google's street
view... and large amounts of computing resources to index and correlate all of
the features from all of the images automatically.

I would be surprised if there is not a project in some huge company or lab
that can identify features in nearly any public outdoor shot and determine
exactly where it was taken. (perhaps for intelligence or forensics)

I believe this paper introduced me to the idea in 2006:
[http://research.microsoft.com/en-
us/um/redmond/groups/ivm/ph...](http://research.microsoft.com/en-
us/um/redmond/groups/ivm/phototours/PhotoTourism.pdf)

------
SomeoneWeird
This is pretty neat, I wonder how hard it would be to automate using gmaps for
an approx location.

------
berrypicker
This is hardly "inadvertently" revealing your location: (1) they've told you
where they are (extra from the actual Tweets, not the photos) and (2) these
places are all near well-known landscapes.

I mean good job on taking the time to actually do it but I doubt this could be
done for the vast majority of photos like this.

------
ewindisch
As a countermeasure, the article notes turning off lights and so forth. Seems
the author hasn't heard of polarized lenses. Others note that it's not a real
security concern, no, but using a FLD lens will result in better photos when
shooting through glass! Use it!

------
joewee
This only seems useful if it is automated and extremely fast. If you are law
enforcement there are faster ways to do this. Like just calling in the city
the "bad" guy last checked in at.

And if you aren't, there are much easier ways to get info on the room someone
is using, like social engineering. Which I'd actually one if the examples the
author gave when he simply asked the victim in twitter what floor he/she was
on.

I haven't seen criminal scenarios where the bad guy takes a photo if his view
or checks in on four square, that doesn't get rounded up fairly quickly.

------
enscr
Wait till the author can tell what you ate based on spectroscopic analysis of
the reflection from the building across the shore. A la CSI syle.

~~~
laumars
"Zoom in and enhance"

~~~
grkvlt
Techniques like superresolution make this quite possible from a grainy video
image: en.wikipedia.org/wiki/Superresolution

------
bitL
A case for always using polarizing filter ;-)

------
malandrew
There may come a time when indoor pictures could reveal your location as well.
If you were to create a database of lots and lots of architectural plans, you
could conceivably use computer vision algorithms for determining dimensions of
a room as a few more known bits of entropy for identifying an indoor location.

------
jclarkcom
From the title of the article I expected this to discuss a computer vision
related technique for enhancing the camera location using reflections.

Using techniques similar to those in photosythn, you can already determine
camera location fairly accurately and easier than the manual work done by the
article's author.

------
beejiu
Well, unless I know there is somebody out to kill me, why would I care about
giving away my location?

~~~
user24
e.g. "Finally safe from abusive ex, locked my door, staring out the hotel room
window [pic]", or myriad other imaginable scenarios.

~~~
laumars
When you're put into protection (including from abusive spouses), the first
thing the agencies involved do is tell you not to contact friends nor
relatives. Posting a picture of their accommodation on social media would be
the stupidest thing they could do - reflection or not.

So if they proceed to do this even after being advised not to; then I have to
question if subconsciously they really do want to be caught (it's saddening
just how emotionally dependant victims of abuse are on their abusers).

But this is now taking a tangent onto a whole other topic.

~~~
user24
What if they just ran away on their own? Anyway the point is there are plenty
of situations where you'd want to hide your location but might erroneously
think a photo from your window doesn't reveal too much info.

~~~
laumars
_" > What if they just ran away on their own?"_

Happens less often than you'd hope. Usually such victims require support from
others.

 _" > Anyway the point is there are plenty of situations where you'd want to
hide your location but might erroneously think a photo from your window
doesn't reveal too much info."_

I'm sure there might be _some_ fringe examples, but "plenty"? Nobody has yet
suggested even one plausible example so far. And even the examples in the
article were from people who didn't care about revealing their location to
begin with (eg in the first example, the subject announced he was in Miami as
well as taking that picture).

But I'm sure there are some examples of people stupid enough to share a
picture of their location and not realise it might reveal their location to
other people; I'm rarely surprised by the stupidity of the worst case
scenarios. But I also doubt those sorts of people who lack even that level
intelligence would be the kind to people who read articles like these. So
whichever way I look at it, I can't see anyone's life saved (metaphorically
nor literally) by the research conducted by this author (as interesting as it
might be to many of us).

------
mhb
Possibly more interesting:

Research shows eye-reflections in photos could be used to identify criminals:

[http://www.engadget.com/2013/12/29/eye-reflections-catch-
cri...](http://www.engadget.com/2013/12/29/eye-reflections-catch-criminals/)

~~~
uptown
Dual Photography has always been the optical "trick" that's blown me away.
Here's the demo video from Siggraph in 2005:

[http://www.youtube.com/watch?v=p5_tpq5ejFQ](http://www.youtube.com/watch?v=p5_tpq5ejFQ)

Skip ahead to 4:19 for a succinct demo.

------
ilovecookies
You might reveal your location but the person spying on you would have to be a
stalker and a total creep, who basically have no life and nothing interesting
to do. That's more scary than taking pictures with reflections IMO

------
pearjuice
Reminds me of the ridiculous enhancement processes in Hollywood. Except this
time... it's real.

[https://www.youtube.com/watch?v=LhF_56SxrGk](https://www.youtube.com/watch?v=LhF_56SxrGk)

~~~
JetSpiegel
What do you mean, Hollywood? Red Dwarf was made in the UK.

[https://www.youtube.com/watch?v=6i3NWKbBaaU](https://www.youtube.com/watch?v=6i3NWKbBaaU)

------
jack-r-abbit
I would think a person would be more concerned about other things (not
location) being relieved in the reflection. Like the strippers you have in the
room. Or the drugs.

------
richbradshaw
Also, taking photos of meals you are eating can inadvertently reveal your
dietary choices.

Look at that burger - you can see from the menu that this is a vegetarian
restaurant - that means that the 'meat' isn't really meat at all but a bean
and nut mixture.

------
frogpelt
My takeaway: if you want to throw creepers like this guy off your trail,
harvest a hotel picture from the internet and post it to your Twitter account.

------
return0
There is nothing inadvertent here.

------
Yardlink
I was halfway through the article before I realized it wasn't going to be
about a security vulnerability in MS Windows!

------
instaheat
Who cares?

