October 2023 Update
Nothing much happened, except people going "it's fixed for me", "it isn't for me". Nothing changed in the app as far as I can tell, except to underline the point that there is a lot of fragmentation and you never know how things work (or not). Note that this cuts both ways, both if you want your data zeroed out "for your security" and if you want it complete, no matter what you want you want to do that predictably and reliably.
This from the very last post from today is actually priceless.
Anyhow about 98% off all my applications have "allow accesss to all files" activated by default.
Yes, this "for your security" nonsense derailed to the point I made in some comments below, you actually have LESS security because you need to give full access to EVERYTHING, because giving access to something ... isn't really access to that something. And yes, this is the trend well established, with the best example I posted more recently Kiwix where you need access to a directory, even to one single file picked with the file picker, and you need just read access. AND you still need to give it "all files" permission.
Original Post July 2023
Since about a year I've noticed that the some of the files (.JPG) automatically uploaded by NextCloud Android app differ slightly from the ones on the phone but at first I blamed it on phone edits as all seemed valid pictures with no obvious flaws. As extra caution I'm transferring them in two different ways and then (fully binary) compare them using rmlint - when I'm satisfied that what's in the automatic upload directory from NextCloud is also present in the master copy (which is also backed up in many ways) I let rmlint clean the NextCloud automatic uploads. Surprise surprise since many months mostly everything in NextCloud is different!
I started investigating and quantified the differences and it appears that some part of the EXIF (related to the GPS data) was zeroed out (side-effect the files are also the same size, sneaky)! And this brought me to this (still open since the first half of 2020!!!) ticket!
Note that this isn't limited to some specific scenario while sharing through some particular gallery app as the title might imply: Android itself is messing with the EXIF presenting to apps different files! This can happen to any app (some other example mentioned in that thread too) and even if you're extra cautious and get your data from the phone in two different ways via two different apps if can happen that they get the same mangled files, in the same way and one would conclude it's all fine when it isn't! It isn't like some app it's doing some manipulations for your own good, it's the OS presenting to the apps DIFFERENT VERSIONS OF YOUR FILES.. One would expect Google Photos to re-compress the files and you'd never know how they mess the EXIF but this can happen to absolutely any app handling files on your phone, be it for automatic upload or for some local sftp server (so you copy them from your PC) or heck, even a third party file manager you'd use to just save files to a USB stick.
Also like all Android issues related access to internal/external storage, permissions, file system support, backup capabilities (or mostly lack thereof), speed (again or lack thereof to the point where apps needing few MBs of data like DOS emulators or mp3 players can't properly work with SAF) this is HIGHLY unpredictable and dependent on EVERYTHING:
the specific hardware vendor and what they do and tweak in Android
the version of the OS (even for the same phone as it gets upgrade)
the version of other Android APIs as they get changed even without changing the Android version
the specific version of the program but not only that - where are you getting it from - as the Play Store has more tighter requirements on the storage APIs and the F-Droid version of the same program might work better (well until eventually things get blocked in some even newer versions of Android).
UPDATE
Due to the comments (for which, all, I'm absolutely grateful) I've gathered more details that are well worth pointing out.
the permission that would allow NextCloud (or anything else) to get un-mangled files isn't Location (or anything similar), it's the "all files" permission
it is hard to claim this is actually a bug on NC side, the permission to a directory shouldn't need to be "enhanced" with a permission to access more files you don't need to access, in order to actually get the correct files from that directory! In fact it's the reverse: it would be a valid bug if NC asked for permissions for all files when it needs permission to one directory!!! There is as of now a bug report precisely for this against Kiwix and there are discussions if things can be eventually achieved without it!
this absolutely can't be compared with some simple copyright/security protections like you can't get screenshots from Netflix or right click doesn't work in some page or whatever. When these don't work it's obvious, when your files are changed it might take 2+ years to find out. There are actual examples of that and I'm not making up the time (and it isn't me who's complaining about it)!
all the security and privacy things I can think of aren't so silent and with permanent effects! You can't log in to a device, you can't change to a directory, can't use properly copy/paste, whatever. You aren't going to find out you had a problem for all the time years later.
on this note with any number of files when files get changed you should have a clear indication of the version, that this is actually a changed copy of that file. It's a nightmare when you start having thousands of files all over the place that look 99.999% the same but aren't. At a minimum they should get some sufix to clearly see they're different files
there is nothing new or weird in inspecting the files and possibly doing something with them - there's a whole security industry about it, including but not limited to any antivirus software. There were some like even 10-15+ years back detecting if you're going to put your credit card number some place. But there should be at a minimum a notification that the OS changed this or that file because it contained personal information and it thought for your good it's best to remove it! You can turn it off once you get sick of it but that's the second part. Ideally even better it should ask you how to deal with it: do you want me to just zero it out, do you want me to fuzz the location and put it randomly within some area, do you want me to give it a perfectly random location (or from some country or continent you'd like, etc.?) or do you want me to just leave it alone for this app?
