Re:A Comcast Security Flaw Exposed Millions of Customers’ Pe...
by peterwwillis on Thursday August 09, 2018 @02:12AM
(#17721961)
It's still not that difficult to trace an IP back to a person. Besides the private marketing databases you can tap into, geoip, crappy ISP support, DNS cache poisoning, phishing, consumer internet router hacking, web service hacking, and other attacks on an address space itself, there's attacks in a social space that give away much more.
Saying this is a really bad vuln because you aren't as private as you think you are online is like saying lock picking is a really bad vuln because you didn't know door locks could be opened by anyone with a bent piece of metal or a shaved down key. Locks don't actually keep bad people out. They just make people feel safe. Same with this idea that your IP is anonymous. It's really not. It's a literal address.
Re:A Comcast Security Flaw Exposed Millions of Customers’ Pe...
by zenexer on Thursday August 09, 2018 @01:59AM
(#17721909)
> Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing.
While I agree with your general sentiment, I hope you appreciate the irony of this particular example.
> Exposing information about someone that is largely already public
A home address may be public, but the connection between that address and online activity, like posts on reddit / HN / some forum (political? fetish/porn? extremist? etc etc), is very much not public. Last 4 of social is not uniquely identifiable, but a (partial) home address almost is.
> If you have a specific target, you probably know their name
Not if they're being careful, like anyone would be if they don't want their posts online mapped back to them. But now you can DM them a link (or email them an image if you have an email address or redirect) and turn their IP into a home address. That's very bad.
Doxing someone isn't just exposing an arbitrary address, it's connecting a purportedly anonymous online account with personally identifying info.
Going back to the president, what if you could find out that some angry anonymous person posting racial slurs online was actually the POTUS? That is doxing.