134 lines
7.9 KiB
Markdown
134 lines
7.9 KiB
Markdown
# Privacy Tools
|
|
|
|
Privacy Tools is a standalone, local-first browser workbench for inspecting
|
|
image metadata and producing deliberately re-encoded sharing copies. It is part
|
|
of the [add·ideas Toolbox](https://git.add-ideas.de/lotobo/toolbox-portal), but
|
|
the static release also runs independently at any nested path.
|
|
|
|
Selected files stay in the browser. There are no accounts, analytics, remote
|
|
lookups, telemetry, or runtime network calls. A source file is never modified.
|
|
|
|
## Version 0.1 workflow
|
|
|
|
1. Select or drop a bounded batch. Every file gets a safe display/download name,
|
|
SHA-256 hash, byte-signature type detection, and claimed-vs-detected type
|
|
result.
|
|
2. Review categorized findings, parser coverage, dimensions, animation or
|
|
multi-image status, and warnings.
|
|
3. For a supported static JPEG, PNG, or WebP, explicitly re-encode the decoded
|
|
pixels. EXIF orientation is normalized; source container blocks, embedded
|
|
thumbnails, trailing bytes, and source profiles are not copied.
|
|
4. An independently parsed output is mandatory. The result states what was
|
|
removed, preserved, generated, unsupported, or incompletely checked, and
|
|
includes source/output SHA-256 hashes and a bounded decoded-pixel sample
|
|
comparison.
|
|
5. Download generic sequentially named outputs, a pseudonymized safe-share
|
|
report, or a ZIP containing both. The separate detailed report preserves
|
|
source filenames and metadata values and may itself be sensitive.
|
|
6. Apply a reusable selective-removal policy to the scan evidence. The policy
|
|
matrix records remove, preserve, and review categories for every input,
|
|
distinguishes verified full re-encoding from inspect-only formats, and can
|
|
be exported without source names or raw metadata values.
|
|
|
|
The safe-share report deliberately omits source names, timestamps, hashes,
|
|
exact byte sizes, metadata values and offsets. It retains scanner coverage,
|
|
format/dimension facts and categorized counts; unusual combinations can still
|
|
be identifying, so the report remains subject to human review.
|
|
|
|
Policy evidence is a decision aid, not a surgical metadata editor. Current
|
|
JPEG/PNG/WebP output is a complete decoded-pixel re-encode; it does not preserve
|
|
selected source metadata. For TIFF, GIF, HEIF-family, JPEG XL, PDF, archives,
|
|
Office and unknown inputs the policy honestly reports `inspect-only` or
|
|
`policy-not-executable` rather than promising a cleaned file.
|
|
|
|
## Format support
|
|
|
|
| Format | Inventory | Deep project scan | Secondary scan | Pixel re-encode |
|
|
| ------------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------ |
|
|
| Static JPEG | Yes | EXIF/TIFF, IPTC/Photoshop, XMP, JFIF, ICC, COM, MPF, selected JUMBF/C2PA and trailing bytes | ExifReader | JPEG |
|
|
| Static PNG | Yes | tEXt, zTXt, iTXt/XMP, eXIf/TIFF, iCCP, pHYs, tIME, private/unknown ancillary chunks, selected caBX/C2PA and trailing bytes | ExifReader | PNG |
|
|
| Static WebP | Yes | RIFF/VP8 dimensions, EXIF/TIFF, XMP, ICC, META, animation and trailing bytes | ExifReader | WebP where the browser encoder supports it |
|
|
| TIFF, HEIC/HEIF, AVIF, JPEG XL | Yes | No | Best-effort ExifReader inspection | No |
|
|
| GIF | Yes | No | No supported deep adapter | No |
|
|
| PDF, ZIP/Office, OLE/legacy Office, unknown | Yes | No | No | No |
|
|
|
|
Animation, multi-picture JPEG/MPF, and malformed or partially scanned
|
|
JPEG/PNG/WebP inputs are inspect-only. Secondary coverage depends on what
|
|
ExifReader can establish for the particular container. A browser may decode a
|
|
format it cannot encode; that still does not make it eligible for output.
|
|
|
|
Findings are grouped as location; people/authorship/rights; dates; device,
|
|
serial and lens; software/history; document identifiers; comments/titles/
|
|
keywords; embedded previews; colour profiles; provenance; technical; or
|
|
unclassified. Raw XMP is shown only as bounded inert text—never injected as
|
|
markup.
|
|
|
|
## Security boundaries and limits
|
|
|
|
Inputs are untrusted. Container parsing runs in a terminable worker and checks
|
|
declared lengths, CRCs, offsets, TIFF cycles/depth/counts, chunk/segment counts,
|
|
compressed metadata expansion, dimensions, and aggregate batch size before
|
|
continuing. Defaults are 100 files, 128 MiB per file, 512 MiB per batch, 4,096
|
|
metadata blocks/findings, 8 MiB per metadata block, 4 MiB decompressed metadata,
|
|
512-character labels, 16,384-character values, 256 KiB normalized finding text
|
|
per file, 40 megapixels, a 32,768-pixel edge, and a 256 MiB ZIP payload.
|
|
|
|
The pixel decode/encode step uses browser-native image and Canvas APIs. It runs
|
|
only after a complete project scan and bounded dimensions. The output gate does
|
|
not trust successful encoding: it hashes and scans the newly encoded bytes
|
|
again. C2PA/JUMBF provenance is authenticity information rather than ordinary
|
|
tracking metadata; pixel re-encoding removes or invalidates it, and the report
|
|
calls that out.
|
|
|
|
This is not an anonymity tool. Metadata removal does not remove visible faces
|
|
or text, steganography, invisible or forensic watermarks, reverse-image
|
|
matching, sidecar files, filesystem history, application caches, or cloud and
|
|
recipient copies. JPEG and lossy WebP output may alter pixels. Colour profiles,
|
|
resolution metadata, and provenance may be lost. Inspect the actual output and
|
|
report before sharing it.
|
|
|
|
See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and
|
|
[docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md) for the implementation and
|
|
threat model.
|
|
|
|
## Browser and accessibility support
|
|
|
|
Current evergreen Chromium and Firefox are exercised in the browser gate;
|
|
current Safari is an intended target. JavaScript modules, Web Workers, Blob,
|
|
Canvas 2D, `createImageBitmap` where available, and Web Crypto are used. WebP
|
|
output follows browser encoder support. The application supports the shared
|
|
Toolbox system/light/dark themes, keyboard file selection, native table and
|
|
disclosure semantics, visible focus, live progress, and non-colour status text.
|
|
|
|
## Development
|
|
|
|
Requirements: Node.js 22 or newer and npm 11 or newer.
|
|
|
|
```sh
|
|
npm ci
|
|
npm run check
|
|
npm run test:browser
|
|
npm run dev
|
|
```
|
|
|
|
Vite uses `base: './'`, so `dist/` can be hosted at `/` or below a nested
|
|
Toolbox path. `toolbox-check` validates the production manifest and bundle.
|
|
|
|
## Release
|
|
|
|
```sh
|
|
npm run release:artifact
|
|
```
|
|
|
|
This checks the manifest, types, lint, formatting, unit fixtures, production
|
|
build, Toolbox contract, and Chromium/Firefox workflows, then creates the
|
|
deterministic `release/privacy-tools-0.2.0.zip` plus its SHA-256 sidecar. The
|
|
archive contains the static application, project documents, and exact runtime
|
|
dependency licence texts.
|
|
|
|
## Licence
|
|
|
|
Privacy Tools is free software under `GPL-3.0-or-later`; see [LICENSE](LICENSE).
|
|
Runtime dependencies keep their licences, including ExifReader under MPL-2.0.
|
|
See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
|