Member Avatar for A_6

Online file hosting. I click "Upload File". I select correct file. I click "Open". File gets uploaded. I log out.

What else does hosting get to know?
(besides name, modification timestamp, creation timestamp, content, extension and length of upload file etc.)

Assuming running Linux Ubuntu/Arch/Whatever, on Mozilla Firefox or any other open-source browser with no obvious exploited vulnerabilities.

Edited by A_6
  • 3 Contributors
  • 2 Replies
  • 371 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by Reverend Jim

Dani AI

Generated

Quick primer for : is right to flag hidden metadata, and is right that encryption changes what the host can read. Beyond the bytes you upload, the hosting service and any systems it uses will typically log or create a number of additional pieces of information that are easy to overlook.

A hosting operator (and any third-party processors) will normally see network- and request-level data such as your public IP, TLS/client-hello details, and the HTTP headers your browser sends (User‑Agent, Referer, cookies/session tokens). They also get the filename your browser supplies (modern browsers send the base name only), the MIME type reported by the browser and whatever type-sniffing the server performs, plus timestamps for the upload. On top of that the service usually generates derived data: thumbnails/previews, OCRed or indexed text, checksums/hashes for deduplication, virus-scan results, and copies in backups or CDNs.

Practical risks from those facts: embedded EXIF geolocation or document revision/comments can leak sensitive context; preview or OCR pipelines may expose content to other systems or contractors; deduplication and hashing can link uploads to other accounts; misconfigured servers can allow uploaded scripts to be executed; retention, backups, and legal requests mean “delete” is not always immediate or final.

Reasonable precautions and a short workflow: sanitize names, remove file metadata, encrypt before sending, then verify what the site actually exposes (preview link, public access). Example commands (Linux) that are useful as a starting point:

# strip EXIF from an image (requires exiftool)
exiftool -overwrite_original -all= image.jpg

# create an encrypted tar (hides filenames inside the encrypted blob)
tar -cf - secret.pdf | gpg --symmetric --cipher-algo AES256 --output secret.tar.gpg

Prefer client-side encryption (or a zero‑knowledge provider) when confidentiality matters, avoid sensitive data in filenames, and verify the host's retention/privacy terms before relying on deletion.

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

That's a vague question. But the file was sent as it was uploaded so all that's there is there. That is, the old meta data in files have been a curse to some. Example:

Your electronic files may include "metadata"—previous drafts, revisions, and even comments meant for exclusively internal use. The metadata associated with your documents may contain confidential or privileged information. It may also include information damaging to your position in the matter at hand.

In addition to basic information such as your name, initials, firm name, names of previous authors, and where the file was saved, the metadata may include "redline" revisions in the document, hidden text, and comments. This article tells you how you can protect yourself from metadata issues in Microsoft Word and WordPerfect.
http://www.americanbar.org/newsletter/publications/gp_solo_magazine_home/gp_solo_magazine_index/june01_07.html

Edited by rproffitt
Member Avatar for Reverend Jim

If the file isn't encrypted (you did not specify) then they have access to the entire contents. I the file is encrypted but the file name is not then perhaps inferences can be made from the file name.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.