Skip to content
Naked Security Naked Security

Microsoft age-guessing tool goes on a metadata-slurping, viral spree

It will presumably get more accurate with time. But for now, you can see how well it does with your selfies. Or your cat's selfies. Or a snapshot of that face on your toast that sort of looks like a panda.

I don’t know why everybody’s complaining about the tiny tool that guesses your age based on a photo, built to demonstrate the face recognition capabilities of Microsoft’s Azure cloud computing platform and infrastructure.

Who cares about accuracy? This 53-year-old thinks it’s GREAT!

Lisa 13

(I assume the age was meant for me, not the sandwich!)

Microsoft corporate vice president Joseph Sirosh described the How Old tool while he was onstage at Microsoft’s Build conference in San Francisco on Thursday.

Venture Beat quotes him:

It's a really fun API [application programming interface] that allows you to submit pictures, detect faces in that, and tells you an estimate of their age and gender.

Sirosh told everyone at the conference to check out the app.

Hilarity ensued, as did a huge viral payoff as people got swept up in the age-guessing game – Microsoft proceeded to suck up metadata from the all the images uploaded to its website

Microsoft says it hoped that “perhaps 50 users” would give it a go, but within 3 hours, over 35,000 users had hit the page from all over the world.

Yow! Machine learning can sure be fun, project cheerleaders Corom Thompson and Santosh Balasubramanian, Engineers in Microsoft’s Information Management and Machine Learning, said in a post.

It’s particularly fun for Microsoft itself when it gets to slurp up metadata without telling anybody what it’s going to do with it, or how long it will be retained.

The Register reached out to the engineers to find out whether the page was sponsored by Microsoft or if it was a personal project that just happens to lend itself to viral marketing of Microsoft’s stream processing service.

The engineers said that with the newly released face detection API they created a pipeline from the web page to the Machine Learning APIs to the real-time streaming analytics and real-time business intelligence.

Thompson and Balasubramanian explain that it’s not the images themselves that get saved, no matter how wrinkly/adorable/not quite human the pictures may be.

Rather, it’s the sweet metadata they were looking to suck up:

We collect all the data using Azure Event Hubs, a highly scalable publish-subscribe ingestor that can intake millions of events per second. We use the Event Hubs API to stream the JSON document from the web page when the user uploads a picture. Note that the picture is not saved, just the metadata extracted in the JSON file gets streamed to Event Hubs.

That means that everybody who succumbed to the viral spread of the tool gave up metadata that included not only age and gender, the writers said, but also geolocation data:

In addition to age and gender, we also got additional information such the User Agent string of the users of the web site, the latitude and longitude of location from where the picture was uploaded and more.

They gave an example of a JSON document – note how the tool picks up on the fact that this file was uploaded using Apple’s Safari browser and an iPhone:

[ { "event_datetime": "2015-04-27T01:48:41.5852923Z",
"user_id": "91539922310b4f468c3f76de08b15416", "session_id": "fbb8b522-6a2b-457b-bc86-62e286045452",
"submission_method": "Search",
"face": { "age": 23.0, "gender": "Female" },
"location_city": { "latitude": 47.6, "longitude": -122.3 },
"is_mobile_device": true, "browser_type": "Safari", "platform": "iOS", "mobile_device_model": "IPhone"

Those people who were having their metadata drained out of them were laughing at rather than applauding the machine-learning demo, given how far off its guesses were.

But it seems as though Microsoft is having the last laugh on this one. Nothing like creating a viral hit to flood your machine learning tool with useful data to analyse and learn from and steadily get better and better facial recognition out of.

Not coincidentally, Microsoft was also busy at Build touting its new “Hello” authentication protocol, which supports three types of biometric authentication: fingerprint, iris and yes, facial recognition.

All of those are flavors in the brave, new and likely to be fragmented “passwordless authentication” world, where Apple has already made fingerprint authentication popular in the mobile market, Google’s put out its “Face Unlock” starting in version 4.0 of Android, and now, Microsoft has pitched its banner with iris recognition.

Already, Apple is going its own way while Google and Microsoft have pitched in with the advanced authentication standard Faster IDentity Online (FIDO) – though, as Naked Security’s John Hawes outlined recently, Microsoft seems to be expecting FIDO to bend around it, as opposed to accommodating its products to fit FIDO.

Creating a viral metadata-slurping tool sure did help Microsoft get a lot of attention for its new products – even if people only made fun of it.

All I can do now is wonder whether the How Old tool misreading my age to this degree is going to wind up with some really age-inappropriate marketing attempts somewhere down the line!

Lisa 23


I got my age at 26 for one of my photos and I am 24 so thats not too bad after all…


I’m 24, the bot guessed 37. Better luck next time! :)

(Also, as some people commented, this badly needs some user feedback. If the bot simply makes silly statements without accepting user disagreement, how is it going to ever improve?)


All of the photos I submitted – of myself, friends, family (all with permission of course, except for those who have passed on) were grossly overcalculated – no “guess” was below 30 years older than the person in the photo – except for one photo of myself at 17, which it said was 7.


The only way this program gonna get better is if you can tell the program the real age. Where it says the guess, it should have a box to input the right age so the program learns.

We are all just helping make it easier to track us, but we kind of screwed there anyways.

I think the program needs square on shots with minimal distractions for best results. I used the win snipping tool of various people whom I knew there age at the time of said photos. I cut only the face. The face was a square on shot, In those instances the program was with in a 5 to 10 years. Any side or angled shots I got extreme variables.

The shots you used are not the best shots for facial recognition. As a security expert you probably knew this, But in the sandwich shot you look very pretty for 53 years old.


Mmmm, delicious Metadata. Most people I know have no idea what metadata is or that it gets added to pictures, or any inkling why a company’s resident marketing monster would want to feast on it. I’d say user education is the problem, but the real problem is that we’ve created a world too complicated to understand the consequences of.


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!