Lewies Blog

I’ve started to have a look at the tags in other MP3 sources other then the files that I make myself for DreamyAudio. The purpose is to test the compatability of my software with MP3 files. It’s like throwing a monkey wrench into a running motor. I started off with DarkCompass and found a few bugs that I had fixed quickly.

During this time, I stumbled upon four ID3v2.3+ tags that I hadn’t seen before (PCST, TDES, TGID) in the DarkCompass podcast. I haven’t found any documentation on these tags when googling them, but from the content within, they appear to be related specifically to podcasts. I came upon similar tags (TID, TDS, WFD, TDR) in another podcast that was using ID3v2.2 tags. Thankfully, the 2.2 tags were documented on many sites on the internet.

One thing that grabbed my attention was the content withing the tags of an old podcast that I grabbed off of Odeo. It actually had the URL of my feed in it. I started thinking a bit about this and realized that if I redistributed the MP3 file to friends and such, that eventually it could be traced back to me. It seems that Odeo had dynamically threw in its own ID3 tags that identify my account.

Perhaps in the future, ID3 tags (or any embedded metadata) could become a privacy concern. Imagine if more sensitive data was stored within those tags such as email addresses, phone numbers, or any sort of contact information without your knowledge and you let your friends get a copy and listen to it. Further down the line after friends sending friends sending their friends the MP3 file, someone gets a hold of it who knows how to read all of that data. Now a stranger has your personal data and could sell it or make use of it in malicouse ways.

Ok, so I’m really going over the edge here and blowing a little thing up to infinite proportions. Who cares if the alien Captian Zorgon from the planet TH-87w discovers our planet and designates you as the offender of the careless audio. What if he makes use of a tool specifically crafted for him to carry out his will of removing any source of that aweful sound and targets you just because your email address was in a small tag in the file.

Back to reality. It’s just a little thing really. I’m just a bit unsettled that someone had inserted some information with my account name as part of a url feed into the ID3 tags without my knowing.  Still, maybe it isn’t Odeo that did it.  Maybe iTunes inserted this data in there behind my back when it downloaded the MP3 file from the feed.  If that is the case, iTunes is the culprit for exposing that extra information.

This entry was posted on Tuesday, May 9th, 2006 at 1:09 am and is filed under Programming. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.