Yeah... just like your average creepy little stalker would!
Precisely. Remember, it is literally my profession to inhabit the mind of the bad guy, to think like the bad guy, and to, using his goals, resources, and limitations, develop his best attack.
Once I have an attack that I think is workable, its then my job to figure out what footprints that attack would leave behind, so that I can have a data scientist look for those footprints - and as it turns out, I rarely send them on a wild goose chase. From there, it'll wind up in anti-fraud or anti-crime departments, because that's when I get to the best part of my job:
Given what I've learned, plan the defenses that will stop the attacker in his tracks - even if he knows what those defenses
are.
How does that translate to our example, here?
Yes, exactly, I have to get into the head of the average creepy little stalker. What's his goal? Let's set a benign goal: to learn where his "true love" lives so he can meet her, because if she could only see what a great guy he was, surely she'd fall in love with him. What resources does he have? He's an average Joe, so he has anything he can Google. What are his limitations? He's not a hacker, so he has no skills or tools. He's not a techie, so he doesn't know about EXIF data or anything. He's not rich. He's socially awkward, so he probably has few friends.
Mentally develop his best attack? As OP described, using side-channel information.
What's the footprint? I suspect there would be one that Google could identify, but I don't have access to a Google data scientist to verify, so let's go with plan B.
Proof of concept? True: any random person would do, but its a better POC to use somebody who is clearly security-aware and actively playing defense to the best of her / her management team's ability. And, yes, as stated, the POC works.
Anti-fraud / anti-crime team? ... not really applicable here.
The defense:
Limit information useful to the attacker via the side-channel.
1. Photographic equipment should be better than a simple point-and-click, allowing the photographer to use aperture to control the depth of field.
2. Model/mgmt should instruct photographer that, for any shot from the model's residence, the background should be distinctly out of focus so that no distinguishing characteristics are evident.
3. Model, as curator of her content and personal safety, should review and ensure that standard before releasing any pictures to a member of the public.
That's what I came up with in the context I was considering - at least it was enough for my OCD mind to let go of that as "task complete" and move on to the next puzzle.
TL;DR - if you shoot your own content, learn how to control depth of field using your camera's aperture. A high f-stop setting like f/5.6 or f/8.0 will ensure that the background is blurry enough that it cannot be used to locate you, and is recommended for photo shoots at any of your residences.