News for hackers. Stuff that matters.
Re:Ask HN: Can Google aggregate everything you've ever poste... by randomwalker on Monday December 29, 2008 @10:49PM (#413887)
I believe I can offer some help because this is in the rough area of my Ph.D thesis (see http://33bits.org/ for more on that.)

Everyone does have a writing fingerprint, contrary to what another person claimed. However, it is an open question whether it can be efficiently extracted.

The basic idea for constructing a fingerprint is this. Consider two words that are nearly interchangeable, say 'since' and 'because'. Different people use the two words in a differing proportion. By comparing the relative frequency of the two words, you get a little bit of information about a person, typically under 1 bit. But by putting together enough of these 'markers', you can construct a profile.

The beginning of modern, rigorous research in this field was by Mosteller in Wallace in 1964: they identified the author of the disputed Federalist papers, almost 200 years after they were written (note that there were only three possible candidates!). They got on the cover of TIME, apparently. Other "coups" for writing-style de-anonymization are the identification of the author of Primary Colors, as well as the unabomber (his brother recognized his style, it wasn't done by statistical/computational means).

The current state of the art is summarized here. http://www.stat.rutgers.edu/~madigan/AUTHORID/bibliography.h... If you're going to do any work on this, you should read as many of those papers as you can. Or else you'll invent something feindishly clever only to find that some academic already wrote about it 20 years ago and showed why it doesn't work.

Now, that list stops at 2005, but I'm assuming there haven't been earth shattering changes since then. I'm familiar with the results from those papers; the curious thing is that they stop at corpuses of a couple hundred authors or so -- i.e, identifying one anonymous poster out of say 200, rather than a million. This is probably because they had different applications in mind, such as identification within a company, instead of Internet-scale de-anonymization. Note that the amount of information you need is always logarithmic in the potential number of authors, and so if you can do 200 authors you can almost definitely push it to a few tens of thousands of authors.

The other interesting thing is that the papers are fixated with 'topic-free' identification, where the texts aren't about a particular topic, making the problem harder. The good news is that when you're doing this Internet-scale, nobody is stopping you from using topic information, making it a lot easier.

So my educated guess is that Internet-scale writing style de-anonymization is possible. However, you'd need fairly long texts, perhaps a page or two. It's doubtful that anything can be done with a single average-length email.

Another potential de-anonymization strategy is to use typing pattern fingerprinting. The timing between our keystrokes fingerprints each of us (yes, this works even for non-touch typists.). This is already used in commercial products as an additional factor in password authentication. However, the implications for de-anonymization have not been explored, and I think it's very, very feasible. i.e, If google were to insert javascript into gmail to fingerprint you when you were logged in, they could use the same javascript to identify you on any web page where you type in text even if you don't identify yourself. Now think about the de-anonymization possibilities you can get by combining analysis of writing style and keystroke dynamics...

By the way, make no mistake: the malicious uses of this far overwhelm the benevolent uses. Once this technology becomes available, it will be very hard to post anonymously at all. Think of the consequences for political dissent or whistleblowers. The great firewall of China could simply insert a piece of javascript into every web page, and poof, there goes the anonymity of everyone in China.

As for who's doing this? Google would be the least likely candidate, IMO. The PR consequences of such experiments, were it ever to come out, blow up in proportion to the size of the company. Not a good idea. On the other hand, I do know a guy who was trying to start an 1-person company based on similar ideas when I last heard from him. Well, de-anonymization of web sessions, although writing style was not involved. That's the closest I can think of.

I am myself very, very interested in looking into this. My main interest is to write a paper and possibly build tools to take a chunk of writing and try to remove your fingerprint from it, i.e, protect anonymity, but if in the process of collaboration someone else were to build a de-anonymization tool, I have no problem with that. I've built (if I can say so), some of the current best de-anonymiztion tools/techniques (check my website), so if you're interested feel free to drop me a line.

Re:Ask HN: Can Google aggregate everything you've ever poste... by Create on Tuesday December 30, 2008 @07:17AM (#414162)
"possibly build tools to take a chunk of writing and try to remove your fingerprint from it, i.e, protect anonymity,"

The standard procedure to do this, is to chain translations to other languages and back. The message remains, but the wording will pick up some noise.

Re:Ask HN: Can Google aggregate everything you've ever poste... by eyeraw on Tuesday December 30, 2008 @06:48AM (#414149)
Maybe someday it will be illegal to copy and paste to avoid being authenticated.
Re:Ask HN: Can Google aggregate everything you've ever poste... by Anon84 on Tuesday December 30, 2008 @08:08AM (#414183)
Humm... maybe this is why iPhone's don't allow copy paste! ;)
Re:Ask HN: Can Google aggregate everything you've ever poste... by Devilboy on Monday December 29, 2008 @11:22PM (#413908)
I guess it would be possible to fool any such system if you know your message might be subjected to this type of analysis?
Re:Ask HN: Can Google aggregate everything you've ever poste... by randomwalker on Monday December 29, 2008 @11:30PM (#413912)
I think it's likely, but it will need a lot of work to build software to hide your traces. Note the caveats, however: most ordinary people will not have the foreknowledge to find and use such a tool. Second, think of all the compromising posts -- rants about employers, accounts from cheating spouses, political dissent, etc. -- that have already been written. The day will come when some kid will download a script, let a crawler loose on the web, and post the de-anonymized results for all to see. There will be interesting consequences.
Re:Ask HN: Can Google aggregate everything you've ever poste... by Retric on Tuesday December 30, 2008 @07:53AM (#414181)
Unless your comparing novels worth of text the accuracy is going to be poor for most situations.

PS: Changed "extremely low" to poor just in case.

Re:Ask HN: Can Google aggregate everything you've ever poste... by Devilboy on Tuesday December 30, 2008 @05:37AM (#414125)
I'm suddenly worried...
Re:Ask HN: Can Google aggregate everything you've ever poste... by time_management on Tuesday December 30, 2008 @11:00AM (#414310)
Here's a question for you, and I don't know the answer:

It seems true that everyone has a "writing fingerprint" but is it not the case that it would change over time? For example, is it not likely that my writing style at present is more similar to that of another person on the Internet than it is to my own style 7 years ago? Moving targets would complicate Internet-scale de-anonymization considerably, because you'd have to take "ancient" Usenet posts with a grain of salt. This would be even harder if people learned to mask their writing style, perhaps using "translators" designed to thwart the de-anon technologies.

Note that the amount of information you need is always logarithmic in the potential number of authors, and so if you can do 200 authors you can almost definitely push it to a few tens of thousands of authors.

This makes sense from an information-theoretic, big-picture standpoint, but I'm guessing that the amount of actual data (measured in text, not information content) per candidate required to identify an author among N candidates is somewhere between O(log N) and O(N)-- my bet would be O(N^k) where 0 < k < 1. The reason is that, while your "since/because" example might be a great fingerprinting measure, there are only a small number of great (high information content) measures like this, then there are some few higher-hanging fruit, then a lot of scraps. It seems that any attempt to identify an unknown person among 1M+ candidates is going to require using the scraps, and it's not clear how much information content there is in them.

Re:Ask HN: Can Google aggregate everything you've ever poste... by ph0rque on Tuesday December 30, 2008 @12:43PM (#414418)
I know for myself that my writing style changes in response to what (and how much) I am reading for the given period (which lasts on the order of a many months/few years).