- About
- Metadata
- Inconsistencies
- Caveats
- Privacy
Tutorial: Service Information
FotoForensics permits users to upload an image by specifying a URL. However, sometimes users upload URLs that point to web pages that contains images, rather than the direct URL to the image. When this happens, FotoForensics tries to automatically identify the primary image on the page.- Many web sites identify the primary image using meta fields (<meta> tags) in the HTML code. If this defines the primary image, then it is used by FotoForensics.
- If the web page (HTML) only links to one image (e.g., one <img> tag), then that is accepted as the primary image.
- In the worst case, FotoForensics will parse the web content for possible image URLs.
The meta fields can be very information since the HTML code often contains more than just image links. For social media and news outlets, it often identifies applications, authors, text descriptions, "tags" for search labels, and much more.
Meta Uses
'Metadata' is information about information. Some metadata is embedded in images. With HTML meta tags, the extra information is about the image but not stored in the image; meta tags are embedded in the web page that displays the image.The HTML meta tags are not needed for displaying the web page. These tags are never directly seen by users with web browsers. Instead, this information is often used for other purposes:
- Some HTML meta tags provide recommendations for how web browsers should display content. (If you've ever visited a web site on a mobile device and been prompted to install or run a site-specific app, then you've seen the outcome from a meta tag.)
- Some HTML meta tags are interpreted by web bots (e.g., search engines) to recommend crawling activity.
- HTML meta tags can be used by applications (not web browsers) to specify content or activity. For example, if you use the Reddit app to read content at Reddit.com, then the meta tags provide additional information to the app.
- HTML meta tags can be used by web services to specify recommended content. E.g., when you post a URL to Twitter or Pinterest, HTML meta tags on the page can specify how Twitter and Pinterest should display the URL.
- HTML meta tags can be used to collect analytics and metrics for web services and web site owners. Google, Facebook, Microsoft Bing, Yandex, and many other online services allow sites to register and receive analytic information.
Inconsistencies
All HTML meta tags contain a 'content' parameter that specifies the value. However, the field can use a variety of terms. For example, to specify the site's description, I could use:<meta name='description' content='FotoForensics: Digital photo analysis' />
<meta property='description' content='FotoForensics: Digital photo analysis' />
<meta itemprop='description' content='FotoForensics: Digital photo analysis' />
Different sites may use different meta tag formats.
Beyond the tag format, there is a significant lack of consistency across web sites. For example:
- While most of the larger web sites include metadata, many smaller sites do not. Even among the sites that include HTML meta fields, the specific fields may vary per page. Do not expect every web page to contain the same HTML meta fields.
- Some web pages include links to one primary image. However, other pages may list multiple primary images. For example, a tweet with three attached pictures will have three primary images listed.
- Web pages with pictures listed in HTML meta tags may not list the best quality image. The URL may return an image that is scaled, cropped, or resaved by the web service. Even the primary picture (as defined by the web page) may not be the best picture. These post-processed pictures may not be useful for analysis.
- When users do not tag a primary picture, some web services automatically tag the first picture as the primary picture. In some cases, we have even seen the site's logo or ads tagged as the primary picture.
- There are many competing HTML meta formats. The standardized Open Graph protocol (tags that begin with "og:") is very common. Dublin Core is another standardized format that is primarily used by news outlets. However, Apple, Android, Twitter, Pinterest, Buzzfeed, Facebook, Instagram, and many other sites have their own custom tags.
- The content of descriptions can vary widely. Twitter includes the full tweet. Media outlets, like CNN and ABC News, include short sentence summaries. Instagram includes the first few words and an ellipses (...). Some sites include emoticons, while others strictly display text.
- Even though a web page may predominantly feature one type of content, that may not be reflected by the HTML meta tags. For example, a web page may contain a video but the meta fields only describe an image.
- There are many different meta fields for the same type of content. For example, a descriptive summary can use 'description', 'og:description', 'dc.decription', 'dcterms.abstract', or other fields. Often, a web service will have multiple HTML meta tags that contain the same description. However, some services include different summaries for different descriptive fields.
- While fields that contain date and time information are defined, the date and time format is arbitrary. Most sites use a standardized format, such as "2024-05-02T15:48:30+00:00" or "Thu, 02 May 2024 09:48:30 -0600", but others do not.
- Most web pages are encoded using a system called UTF-8. However, the text descriptions in meta tags are not always UTF-8 compliant. Some services include HTML entities, ISO-8859-1, or other encoding options. Even if the web page is explicitly marked as UTF-8, the content may not be in UTF-8.
- About
- Common
- Dublin Core
- Open Graph
- PRISM
- Ads.txt
- Android
- Apple
- Flickr
- Microsoft
- Link Rel
HTML Metadata Fields
The HTML meta tags include a field name (name, property, or itemprop) that defines the type of data. The tag also contains the field's value (content). Some fields use descriptive content, while other fields use the content to control activities.- Descriptive fields provide additional information about the web page or content. This information is not not visible to users who access the web page with a web browser. However, descriptive fields can be used by web crawlers, search engines, applications, and related automated systems.
- Active fields impact how the content is displayed or handled. The activity may control how the browser displays the page, how a specific app displays the page, how another web service handles the page, or how web crawlers or bots index the page. Active fields are labeled with the type of activity:
- Analytics: Used for web service analytics and metrics.
- App: Recommended application activity.
- Bot: Recommended bot activity.
- Browser: Recommended browser functionality.
- Display: Recommended display settings.
- Service: Recommended processing options for specific web services.
This is not the full list of HTML meta fields. Some of these are defined by standards organizations, such as Dublin Core or Open Graph, while others are provided by specific companies or services. You will almost certainly encounter other fields that are application, service, or site specific.
Common Fields (standardized, common)
Various specifications define a small set of well-known HTML meta fields that are widely used. Most of the common fields use a short word for the field name.| Field | Type | Purpose |
|---|---|---|
| author | Descriptive | Identifies the page's author. This could be a name, email address, login handle, or other information. |
| copyright | Descriptive | A short summary of the web page's copyright terms. |
| description | Descriptive | A short summary of the page contents. |
| generator | Descriptive | Identifies the application that created the web page. |
| keywords | Descriptive | A list of keywords for search engines. |
| lastmod | Descriptive | The timestamp indicating when the page was last modified. |
| revised | Descriptive | The timestamp indicating when the page was last updated. |
| referrer | Browser | Defines the preferred cross-origin security for the web browser. |
| robots | Bot | Informs web crawlers, such as search engines, how to index the site. |
| theme-color | Display | This color is used to help match the browser with the page coloring. (Typically only used by mobile devices.) |
| thumbnail | Descriptive | The URL to a thumbnail image presenting the image. This is usually (but not always) a smaller version of the primary image. |
| url | Descriptive | The direct URL to the web page's content. |
| viewport | Display | Informs web browsers how to display content. This is almost exclusively interpreted by mobile devices. |
Dublin Core (standardized, common)
Dublin Core (DC) defines a set of standardized HTML meta fields that describe information resources. Every DC field begins with "dc." or "dcterms." (including the period). These are often seen with web pages from media outlets.| Field | Type | Purpose |
|---|---|---|
| dc.creator | Descriptive | Photographer, author, reporter, or person who created the content. |
| dc.date | Descriptive | Date when the content was created or last modified. |
| dc.description | Descriptive | A short description of the content. |
| dc.publisher | Descriptive | Identifies who (person or company) that published the content. |
| dc.source | Descriptive | Identifies who (person or company) that originated the content. |
| dcterms.abstract | Descriptive | A summary of the content. |
| dcterms.created | Descriptive | Date and time the content was created. |
| dcterms.modified | Descriptive | Date and time the content was last modified or updated. |
Besides defining hundreds of meta fields (of which few are commonly used), DC also defines a structured format for meta information. All meta tags that follow the DC format use a heirarchical labeling system that uses dots (".") as separators. For example, "dcterms.abstract" defines the "abstract" under the "dcterms" definition.
Open Graph (standardized, common)
The Open Graph Protocol (OGP) defines a set of standardized HTML meta fields that are widely used. Every OGP field begins with "og:" or some type specific information, such as "music:", "video:", "article:", or "book:".| Field | Type | Purpose |
|---|---|---|
| og:title | Descriptive | Web page title |
| og:type | Descriptive | Type of data for the primary object, such as "video.movie", "audio", "image", "book", "article", etc. |
| og:image | Descriptive | The primary image that represents the web page's content. |
| og:image:height | Descriptive | The primary image's height (in pixels). |
| og:image:width | Descriptive | The primary image's width (in pixels). |
| og:image:secure_url | Descriptive | When present, this is the primary image via an HTTPS connection. Since HTTPS has become commonplace, the URL is usually the same as og:image. |
| og:url | Descriptive | The permanent URL for the web page. |
| og:audio | Descriptive | The primary audio URL that represents the web page. |
| og:video | Descriptive | The primary video URL that represents the web page. |
| og:see_also | Descriptive | URL to related content. |
| og:site_name | Descriptive | Web site's common name |
| og:pubdate | Descriptive | When the web page's contents were published. (This can be the first publication date or the last update.) |
| article:author | Descriptive | Author of the article. |
| article:publisher | Descriptive | Publisher of the article. |
| article:section | Descriptive | Section of the publication (e.g., "Technology" or "Science"). |
| article:tag | Descriptive | Keywords associated with the article. |
| book:author | Descriptive | Author of the book. |
| book:isbn | Descriptive | Book ISBN. |
| book:release_date | Descriptive | Date when the book became available. |
| book:tag | Descriptive | Keywords associated with the book. |
| video:tag | Descriptive | A list of keywords associated with a video. |
Besides defining hundreds of meta fields (of which few are commonly used), OGP also defines a structured format for meta information. All meta tags that follow the OGP format use a heirarchical labeling system that uses colons (":") as separators. For example, "og:title" defines the "title" under the "og" definition. And "og:image:width" specifies the image width that goes with an "og:image" definition.
Many other services use the OGP format with proprietary (non-standard) meta fields. For example, Twitter uses the prefix "twitter:". Facebook uses "fb:" for some tags, and "al:" for Facebook's preferred 'application link' information. But in each of these cases, the information after the prefix is proprietary and defined by a specific service or application. While the format is standardized, the purpose of these proprietary meta fields are not standardized.
Twitter (common, non-standardized, proprietary)
When a user tweets a link to a web page, Twitter often displays a custom "card" that includes images and text about the web page. Meta tags found on the web page can control how Twitter displays the web page's link. Twitter renders content based on data found in both "twitter:" and "og:" fields.Of all of the non-standard HTML meta tags, Twitter's tags are the most common. However, because these 'twitter:' fields are defined by Twitter, the definitions may change when Twitter makes a major site change. (So far, a major change has only happened once.)
| Field | Type | Purpose |
|---|---|---|
| twitter:app:name:ipad | App | Defines a preferred iPad app for accessing the web page content. |
| twitter:app:name:iphone | App | Defines a preferred iPhone app for accessing the web page content. |
| twitter:app:name:googleplay | App | Defines a preferred Android app for accessing the web page content. |
| twitter:app:url:ipad | App | If you are using the iPad app, then this is the preferred URL. |
| twitter:app:url:iphone | App | If you are using the iPhone app, then this is the preferred URL. |
| twitter:app:url:googleplay | App | If you are using the Android app, then this is the preferred URL. |
| twitter:card | Service | Defines how Twitter should display the content summary. (Similar to og:type.) |
| twitter:creator | Analytics | Twitter handle (@name) for the user who created the page content. (E.g., a reporter at ABC News will use their own Twitter handle.) |
| twitter:creator:id | Analytics | An alternate form of twitter:creator. |
| twitter:description | Service | Text to display with the Twitter Card. (Uses og:description if this is not defined.) |
| twitter:image | Service | An image to include with the display on Twitter. This is usually (but not always) a smaller version of the primary image. (Uses og:image if this is not defined.) |
| twitter:image:src | Service | An alternate form of twitter:image. |
| twitter:site | Analytics | Twitter handle (@name) for the site or service. (E.g., ABC News may use @ABC) |
| twitter:site:id | Analytics | An alternate form of twitter:site. |
| twitter:title | Service | The web page title to display on Twitter. (Uses og:title if this is not defined.) |
Facebook (non-standardized, proprietary)
Facebook includes a service called "Audience Insights" for collecting marketing metrics and analytics. This service is primarily used to track user interactions. When a user posts the web page's URL to Facebook, or when a user clicks on a link that is retrieved by Facebook's proxy system, this information is received and processed by Facebook's Audience Insights.| Field | Type | Purpose |
|---|---|---|
| fb:admins | Service | A list of Facebook user ids that have the ability to view the market research information for this page. |
| fb:app_id | Analytics | Identifiers for collecting traffic analytics related to your site from Facebook. The application identifier must be registered with Facebook. When a user clicks on a link posted to Facebook, Facebook performs a proxy request to retrieve the web page content. If Facebook sees this identifier, then it assigns credit to the registered application. (Mostly used for advertisers and marketing metrics.) |
| fb:pages | Service | (Deprecated: May 2019) A list of Facebook pages that are related to this page. |
Facebook's mobile app also supports application link ("al:") tags. These recommend preferred applications for viewing the web page.
| Field | Type | Purpose |
|---|---|---|
| al:android:app_name | App | The name of the preferred application for viewing this web page on Android devices. |
| al:android:package | App | The identifier for the preferred Android application at the Google Play store. If you use a mobile browser, then this meta tag may prompt you to install or run this specific application. |
| al:android:url | App | The preferred Android application should use this URL for viewing this web page. |
| al:ios:app_name | App | The name of the preferred application for viewing this web page on Apple iOS devices. |
| al:ios:app_store_id | App | The identifier for the preferred iOS application at the Apple App store. If you use a mobile browser, then this meta tag may prompt you to install or run this specific application. |
| al:ios:url | App | The preferred iOS application should use this URL for viewing this web page. |
Instagram (non-standardized, proprietary)
These are used when a user posts the web page's URL to Instagram.| Field | Type | Purpose |
|---|---|---|
| instapp:hashtags | Descriptive | List of hashtags associated with the picture. |
| instapp:owner_user_id | Analytics | The Instagram user id for the web page's owner. |
Android (non-standardized, proprietary)
These are used when viewing the web page with an Android web browser.| Field | Type | Purpose |
|---|---|---|
| mobile-web-app-capable | Display | The web site can control whether the page is displayed full-screen on Android devices. |
PRISM (standardized, uncommon)
The Publishing Requirements for Industry Standard Metadata (PRISM) defines meta information used by publishers. This standard includes general PRISM information (using the "prism" prefix). Less common are prefixes such as PRISM Usage Rights (pur) and PRISM Rights Language (prl).| Field | Type | Purpose |
|---|---|---|
| prism.copyright | Descriptive | A short copyright statement. |
| prism.doi | Descriptive | The Digital Object Identifier specifies the publisher's unique ID for the content. |
| prism.publicationDate | Descriptive | Date of publication. |
| prism.publicationName | Descriptive | Name of publication. |
| prism.startingPage prism.endingPage | Descriptive | For print publications, these are the starting and ending page numbers. |
| prism.url | Descriptive | If the publication, chapter, or article is available online, then this is the direct URL. |
| prism.volume | Descriptive | For print publications, this is the volume number (when applicable). |
PRISM defines hundreds of meta fields. However, the format is only used by publishers, and most publishers rarely use more than a dozen PRISM tags -- if they use any at all.
The PRISM standard roughly follows the Dublin Core format, using periods to separate fields. However, if it were fully compliant, then it would not use run-on words to define fields. (E.g., prism.startingPage and prism.endingPage should probably be prism.page.start and prism.page.end.)
Ads.txt (standardized, uncommon)
An organization called IAB has attempted to standardize declarations for "Authorized Digital Sellers" (ads). They include links to preferred applications and identifiers for collecting analytics. Their HTML meta fields begin with "appstore:".| Field | Type | Purpose |
|---|---|---|
| appstore:bundle_id | App | The preferred application for viewing this web page. This could be an Android or iOS application. |
| appstore:developer_url | App | Link to the developer's web site. This site should have "/ads.txt" and "/app-ads.txt" files. |
| appstore:store_id | Analytics | Identifies the associated app store. |
Apple (non-standardized, proprietary)
These are used when viewing the web page with an Apple web browser.| Field | Type | Purpose |
|---|---|---|
| apple-itunes-app | App | The preferred application for viewing this web page on an Apple devices. |
| apple-mobile-web-app-capable | Browser | The web site can control whether the page is displayed full-screen on Apple mobile devices. |
| apple-mobile-web-app-status-bar-style | Browser | The web site can control how the status bar is displayed on Apple mobile devices. |
| apple-mobile-web-app-title | Browser | The title to display in the iOS app. |
| apple-touch-icon | Display | For applications, this is the recommended icon. |
| apple-touch-startup-image | Display | For applications, this is the recommended icon to show when the application is started. |
Flickr (non-standardized, proprietary)
Yahoo's Flickr service includes a variety of links about the photo.| Field | Type | Purpose |
|---|---|---|
| flickr_photos:by | App | A link to other photos posted by this user at Flickr. |
| flickr_photos:camera | App | Flickr tracks pictures based on the picture's metadata. If the metadata names a camera model (e.g., Nikon), then this is a link to other photos by the same camera model. |
| flickr_photos:groups | App | Flickr permits tagging picture by groups. This is a list of links to related groups. |
| flickr_photos:set | App | Flickr permits users to place groups of photos in sets. This URL points to the user's set that contains the picture. |
Google (non-standardized, proprietary)
These fields are provided for customizing Google's access to a site.| Field | Type | Purpose |
|---|---|---|
| google-site-verification | Analytics | Web site owners can register with Google. When Googlebot crawls the site and sees this tag, it associates the page with the registered owner for analytics and metrics. |
| googlebot | Bot | The common "robots" tag specifies how generic bots should crawl and index web pages. The googlebot tag is used when sites want googlebot to act differently from generic bots. |
Microsoft (non-standardized, proprietary)
These are used when viewing the web page with a Microsoft web browser.| Field | Type | Purpose |
|---|---|---|
| msApplication-ID | App | Identifier for the preferred application at the Microsoft App store. |
| msApplication-PackageFamilyName | App | Identifier for the preferred application family at the Microsoft App store. |
| msapplication-navbutton-color | Display | The web server can define the web browser's navigation button colors. |
| msapplication-square70x70logo | Display | For applications, this is the recommended 70x70 pixel icon.
Microsoft supports dynamic logo sizes. This includes 'wide' and 'square' with variable dimensions. (E.g. "msapplication-square150x150logo" or "msapplication-wide310x70logo"). The supplied logo image does not need to be the specified size. Often, the actual image is much larger. For example, the 70x70 logo may link to an image that is 100x100. |
| msapplication-TileColor | Display | Microsoft's version of the standardized 'theme-color' field. |
| msapplication-TileImage | Display | Microsoft's version of the standardized 'thumbnail' field. |
| msapplication-window | Display | Microsoft's version of the standardized 'viewport' field. |
| msvalidate.01 | Analytics | Web site owners can register with Microsoft Bing. When Bing's web-bot crawls the site and sees this tag, it associates the page with the registered owner for analytics and metrics. |
Pinterest (non-standardized, proprietary)
These are used by Pinterest to control the web page's link and the Pinterest app.| Field | Type | Purpose |
|---|---|---|
| p:domain_verify | Analytics | Identifies content from sites that register with Pinterest. Used by Pinterest for searches. |
| pin:description | Service | Description used when the web page is pinned on Pinterest. |
| pin:media | Service | Image shown when the web page is pinned on Pinterest. |
| pinterestapp:pinboard | App | Link for use by the Pinterest app to the pinned item. |
| pinterestapp:pinner | App | Link for use by the Pinterest app to the Pinterest user who pinned the item. |
| pinterestapp:repins | App | Number of times the item was re-pinned. This is displayed by the Pinterest app. |
| pinterestapp:source | App | Link to the source of the pinned item. |
Link Rel (standardized)
Beyond the <meta> tags, services may include pictures using <link> tags. For example:<link rel='type' href='url'>
<link rel='icon' href='https://fotoforensics.com/favicon.ico'>
These <link> tags are typically images related to the service. (E.g., The service logo or icon.) However, sometimes the images represent the primary picture on the web page.
| Field | Type | Purpose |
|---|---|---|
| link rel=image_src | Descriptive | While rarely encountered, this tag should represent the primary image on the page. This tag serves the same purpose as 'og:image'. |
| link rel=icon | App | Identifies the 'favorite icon' (favicon) for use by the web browser. This is the tiny service logo that typically appears in the browser's address bar, next to the URL. Web services often define multiple icons with different dimensions. |
| link rel=apple-touch-icon | App | Similar to the 'icon' image, this is the preferred icon for use on Apple mobile devices. The mobile device may add shadows or rounded corners to the icon when it is displayed on the desktop. |
| link rel=apple-touch-icon-precomposed | App | A variation of apple-touch-icon, the 'precomposed' informs the device that the icon should not have shadows or rounded corners applied. |
Caveats
The wide variety of HTML meta fields and their per-service uses can make interpreting the results difficult. In particular:| Issue | Description |
|---|---|
| Ambiguous Purpose | Some meta information may refer to the image on the web page, while other information may refer to the page, service, or other content. |
| Non-Standard Fields | Different fields can be used for different purposes by different services. Well-defined fields are not immunite from repurposing. Even different pages from the same service may be used differently if the content is filled out by different people. |
| Language Encoding | Most text fields are encoded using a convention called 'UTF-8'. However, some web sites use other encoding methods (ISO-8859-1 is common). While this won't impact English text, non-English characters can appear as garbled text. Even if the web service specifies the use of UTF-8, the encoded language may use an alternate encoding. (It is common to see Instagram pages using non-UTF-8 characters even if the web page claims to be encoded using UTF-8. This happens when users post non-UTF-8 text into their profiles or postings.) While FotoForensics attempts to identify these language issues, there may be corner cases where characters are not displayed properly. |
| Ad Blockers 1x1 Pixel Images | FotoForensics will attempt to display any image URLs. However, some ad blockers interpret images from other sites as possible advertisements, resulting in a blocked request. For example, the popular uBlock Origin and Disconnect plugins will misinterpret links to images at Twitter as possible ads, replacing them with 1x1 pixel images. This does not mean that there is no picture; it only means that it cannot be displayed on the current web page.
With the Disconnect plugin, you can disable filtering on a page-by-page and case-by-case basis. In contrast, uBlock Origin requires disabling the plugin on the current web page. While the only external content included by FotoForensics are pictures, disabling ad blockers does pose a risk in general. If you see 1x1 pixel images, then it may be due to your ad blocker. The choice to temporarily disable your ad blocker in order to see the images is strictly up to you. |
| Alterations | Linked images mentioned in the meta information is often processed by the web service. Cropping, scaling, re-encoding, and resaving are all common. The images may no longer have useful artifacts for evaluation. |
| Availability | FotoForensics does not control the type or quality of HTML meta information. This is information defined and provided by the remote web service. Often the people who post the content on the remote web serivce provide the content, so the quality and quantity can vary by web page. (E.g., If it's Instagram, then the content is provided by the Instagram account holder. |
Privacy
The HTML meta information is supplied by the web service; it does not come from FotoForensics. Some services, such as Facebook, Instagram, and Twitter, include account names, human names, and other potentially personal information.There are two things to remember about this information:
- The FotoForensics URL retrieval system never logs into any services. This means that the URL must be publicly accessible. Anyone anywhere can retrieve the same content. (Sometimes people submit URLs to their private emails or protected profiles or closed forums. Since FotoForensics is not logged in as the user, it cannot retrieve the web pages or pictures.)
- These social networks provide this information to everyone. If FotoForensics retrieved the information, then it is not private. If you don't want these services to tell everyone your name, then don't give them your real name.
If you are concerned about potentially leaking personal information to FotoForensics, then you have a few options:
- Submit a URL to the picture, rather than a URL to the web page containing the picture. (Then again, finding the URL to the picture can be difficult.)
- Save the picture to your computer and perform a file upload. (Assuming the web site permits you to save; again, this can be difficult with some web services.)
- Login to the social media site and tighten your privacy settings. If you don't want it to disclose your name, then don't provide your real name to the social media site. And if you already provided your name, then see if you can change it.
- Use the commercial FotoForensics Lab service since it provides privacy. You will see the personal information, but other users at FotoForensics will not see it. And Lab automatically deletes content after 24 hours of inactivity.
To date, we have not encountered any web services that supply phone numbers, home addresses, or private email addresses. (Then again, we have not tested every web service.)
Copyright 2012-2024 Hacker Factor, All Rights Reserved. • System Status • Blog • FAQ • Contact