News for hackers. Stuff that matters.
Re:Sherlock: Hunt down social media accounts by username acr... by Tepix on Wednesday December 25, 2024 @12:46PM (#42509966)
And this makes it obvious why you should use a unique username everywhere!

It makes pervasive tracking a lot harder.

Also when you do any research on health related topics, be extra privacy conscious.

Re:Sherlock: Hunt down social media accounts by username acr... by karlzt on Wednesday December 25, 2024 @02:43PM (#42510701)
Or better yet, be extra privacy conscious with everything you do.
Re:Sherlock: Hunt down social media accounts by username acr... by w4ffl35 on Wednesday December 25, 2024 @04:37PM (#42511333)
I strongly suggest the opposite. Collect everything and do on a personal site, do good seo on your pages, expose your content. Go totally anon for anything you don't want exposed of course. But you should expose as much of yourself as you're able and control the conversation.
Re:Sherlock: Hunt down social media accounts by username acr... by idontlikeirc on Wednesday December 25, 2024 @10:13PM (#42512878)
This reminds me of a friend who was a steam moderator, and they had an alternate account on twitter pretending to be mexican. The amount of times they got people thinking they found their real name was larger than "juan".
Re:Sherlock: Hunt down social media accounts by username acr... by nurettin on Wednesday December 25, 2024 @01:25PM (#42510258)
This is why I try to use the same name across websites. I want to be identified as the same person. Just resist the urge to post information you don't want others to have.
Re:Sherlock: Hunt down social media accounts by username acr... by prophesi on Wednesday December 25, 2024 @02:31PM (#42510639)
We often don't know what is or isn't information we don't want others to have, and it will be a lot harder, if not impossible, to delete it after-the-fact. Especially when you consider how it only takes a few innocuous data points to derive what might be information you'd rather not disclose.
Re:Sherlock: Hunt down social media accounts by username acr... by betaby on Wednesday December 25, 2024 @01:39PM (#42510339)
> Just resist the urge to post information you don't want others to have.

Self-censor you mean?

I personally like that information anonymous account `William Shakespeare` posted around 1585–1613.

Re:Sherlock: Hunt down social media accounts by username acr... by derektank on Wednesday December 25, 2024 @09:37PM (#42512763)
I don't understand what point you're trying to draw here. William Shakespeare was by no means anonymous in his day and age and he almost certainly had to consider the views of the aristocracy and other elite figures that might watch his plays i.e. self censor. Ben Johnson, a contemporary playwright, was imprisoned for writing "The Isle of Dogs".
Re:Sherlock: Hunt down social media accounts by username acr... by eks391 on Thursday December 26, 2024 @12:55AM (#42513408)
I think parent is saying that by self-censoring, expression others enjoy is lost, with the example of Shakespear as an expresser whose impact would have been lost if he'd decided to be anonymous instead.
Re:Sherlock: Hunt down social media accounts by username acr... by cruffle_duffle on Wednesday December 25, 2024 @01:40PM (#42510344)
The secret is multiple accounts. I too have a Brand Name Account(tm) I like to float around but it sure as heck isn’t this one.

Doing the multiple account thing isn’t as easy as it sounds though. Some sites like Reddit make switching between accounts incredibly easy while others aren’t so much. Plus laziness kicks in and soon enough your Brand Name Account gets tainted and you have to consider taking it out back to the dumpster.

Such is life I guess.

Re:Sherlock: Hunt down social media accounts by username acr... by moehm on Wednesday December 25, 2024 @05:43PM (#42511695)
> Doing the multiple account thing isn’t as easy as it sounds though. Some sites like Reddit make switching between accounts incredibly easy

And it's as easy to dox yourself by responding with the wrong account, as I have seen multiple times on Reddit.

Re:Sherlock: Hunt down social media accounts by username acr... by idontlikeirc on Wednesday December 25, 2024 @10:15PM (#42512885)
This happens a lot with viral-bait accounts. One of the top posts on the UFO board just got caught sockpuppeting this week.
Re:Sherlock: Hunt down social media accounts by username acr... by john_the_writer on Thursday December 26, 2024 @09:08PM (#42519406)
trick here.. create different chrome profiles, with different color schemes. Peach is my "nice person" account. Red is for accounts that I want to be a little more argumentative.

I do this at work too.. where I have to have different user profiles to emulate working as an admin, staff, client, sub-client. Blue seems adminny :)

Re:Sherlock: Hunt down social media accounts by username acr... by CRConrad on Tuesday December 31, 2024 @04:58AM (#42557687)
I do a similar thing with my terminal emulator: Different background colours in PuTTY depending on which server it's connected to. Green for Dev, red for Prod...
Re:Sherlock: Hunt down social media accounts by username acr... by sangnoir on Wednesday December 25, 2024 @07:02PM (#42512093)
> The secret is multiple accounts.

There was a "show hn" many months ago that did stylometry on HN commenters to show which accounts were most stylistically similar; I ran a throwaway account of mine through it, and it showed my account in the top 3 - which was impressive.

Having multiple accounts won't save you when your own word choice, grammar and style can uniquely identify you to anyone sufficiently motivated to link your disparate identities at any point in the future. The author even said their tool was rather basic; IIRC the basis was all pairs similarity on n-grams

Re:Sherlock: Hunt down social media accounts by username acr... by malfist on Wednesday December 25, 2024 @07:49PM (#42512335)
You wouldn't happen to have a link to that would you? I'd really like to check that out
Re:Sherlock: Hunt down social media accounts by username acr... by sangnoir on Wednesday December 25, 2024 @07:57PM (#42512366)
Re:Sherlock: Hunt down social media accounts by username acr... by 01HNNWZ0MV43FF on Wednesday December 25, 2024 @08:48PM (#42512574)
Then I wouldn't be able to talk about my kinks anywhere
Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Wednesday December 25, 2024 @01:03PM (#42510090)
just to be slightly pedantic as there are still sites that have screen names vs account names where the screen name the public sees has no correlation with the account name (typically an email account).

so don't re-use email accounts across sites. SecOps matter

Re:Sherlock: Hunt down social media accounts by username acr... by Tepix on Wednesday December 25, 2024 @01:05PM (#42510110)
Yes, another thing you can do is use email subadressing for every account you create, ideally with a non-default separator (i.e., not "+").
Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Wednesday December 25, 2024 @02:25PM (#42510609)
Doesn't this subaddress all just resolve to the same account? The accounts are free, so just make up a completely different account. Yeah, it might get a bit of a mess for a user to manage, but that's what password managers are for.

let's face it, we're not talking about Joey Beercan doing this. Anyone even tossing around the term SecOps is already moved out of mass populace and into the somewhat informed. Someone practicing SecOps would definitely be the type to use some sort of credentials management. So I don't think unique totally unrelated emails is too much of a burden. Using different free email providers is even better.

Re:Sherlock: Hunt down social media accounts by username acr... by immibis on Wednesday December 25, 2024 @08:11PM (#42512429)
Gmail accounts aren't free: I believe they only allow up to 4 to be linked to the same phone number (which is mandatory).

Microsoft is worse: they'll let you create an account, then lock it the next day, after you've already used it for something, if you don't link your phone number.

Phone number is used because it costs money to get, is hard to get in bulk, and in many countries is always tied to your identity.

I wonder what the market for throwaway phone number verification is worth.

Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Wednesday December 25, 2024 @09:10PM (#42512648)
I’ve never provided a phone number for any of the gmail accounts I have. When was this mandated?
Re:Sherlock: Hunt down social media accounts by username acr... by eks391 on Thursday December 26, 2024 @12:41AM (#42513359)
Very recently. I only noticed it about 2 years ago when I went to make a throwaway gmail account exactly for the above opsec purposes.
Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Thursday December 26, 2024 @10:32AM (#42515758)
You claim OpSec, but if you’re using such bad opsec, then I’d suggest you’re not actually doing opsec. Tying a throw away account to actual data that can directly identify you is just such bad opsec, you might as well use your actual name as your user name.
Re:Sherlock: Hunt down social media accounts by username acr... by immibis on Thursday December 26, 2024 @10:34AM (#42515770)
Opsec can be a relative term. Yes, some people are selling drugs or spying for the Russian government but other people just don't want to be OSINTed by scripts like this. Then creating a new Gmail account from the same IP address is enough. It's a lot easier to hide your identity from people who don't have the power to issue subpoenas.
Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Thursday December 26, 2024 @04:50PM (#42518130)
IP address != phone number
Re:Sherlock: Hunt down social media accounts by username acr... by john_the_writer on Thursday December 26, 2024 @09:03PM (#42519380)
I think his point was that he wasn't looking to be totally invisible. Just less obvious to people who won't spend a pile of time looking for you.

If you're adding your phone number to a throw away account you use on Target or Walmart, it's likely okay.

The IP comment was likely because if someone can get your phone number from the Walmart service (via subpoena), to track you down, they can also get your IP address too.

Re:Sherlock: Hunt down social media accounts by username acr... by packtreefly on Wednesday December 25, 2024 @11:59PM (#42513220)
> I wonder what the market for throwaway phone number verification is worth.

I pondered this recently, and it seems to top out at a couple bucks per shot.

The problem is that the phone number tends to need to be persistent for the sake of security. You can't typically sign up for something that requires a phone number and then expect to be able to keep the account safe without maintaining exclusive access to that number.

I'm sure if it were cost effective, one of the password managers would have some kind of SMS integration, like Apple's hide my email, but for phone numbers.

Re:Sherlock: Hunt down social media accounts by username acr... by immibis on Thursday December 26, 2024 @12:29AM (#42513330)
If you're the kind of person who doesn't want to provide their own phone number to make an account, you probably also wouldn't be using any account long-term.
Re:Sherlock: Hunt down social media accounts by username acr... by dylan604 on Thursday December 26, 2024 @04:49PM (#42518121)
That’s not true. None of my Gmail accounts have a phone number, and I’ve used them for their discrete purposes continuously since their creation. I doubt I’m the edge case
Re:Sherlock: Hunt down social media accounts by username acr... by eks391 on Thursday December 26, 2024 @12:49AM (#42513389)
There are several cheap (not free) email providers that allow you to create unique emails per service for this precise purpose, and do not require a phone number, however they are lacking significantly in every other way, like an easy to use inbox, so not great for your main contact. One I tested out I found to be good for these random sites that want emails as your username. Then I set the custom email to forward the mail thereby maintaining unique usernames on each site. If the site does not use an email for the username and does not make the provided email public, you could use your regular email with the handy features that come with a Google/Microsoft suite, or air on the side of caution by still having the unique email.
Re:Sherlock: Hunt down social media accounts by username acr... by sizzle on Thursday December 26, 2024 @12:59AM (#42513423)
This functionality is built into iCloud subscriptions with throw away Apple addresses that resolve to your AppleID registered email.
Re:Sherlock: Hunt down social media accounts by username acr... by stuffoverflow on Thursday December 26, 2024 @08:09AM (#42514961)
It is still possible to register Gmail accounts without a phone number. I suppose they primarily use IP reputation to determine when they allow it but device seems to matter too.

In the past you could use BlueStacks android emulator to register Gmail accounts without sms verification even with VPN IPs. This year I've created a few Gmails without sms verification, once on desktop chrome (with Firefox they would've required sms) and a couple of times using the Gmail app on an Android phone.

Re:Sherlock: Hunt down social media accounts by username acr... by stult on Wednesday December 25, 2024 @08:17PM (#42512452)
> Doesn't this subaddress all just resolve to the same account?

Not in OAuth/OIDC compliant identity providers. As one example, I frequently use + email addresses for testing on auth0-secured apps, where I use the + text to tag a role or some other user attribute that identifies what makes the test account special. eg [email protected] or [email protected]. Each plus variant resolves to its own separate account with its own password (which I do in fact manage via a credential manager), without requiring me to set up multiple full email addresses to simulate multiple users with verified email addresses.

Re:Sherlock: Hunt down social media accounts by username acr... by mazambazz on Wednesday December 25, 2024 @09:18PM (#42512675)
It depends on the underlying email server. But strictly speaking, the "+" is a valid identifier, and "[email protected]" is a completely different address than "[email protected]".

It just so happens that email servers tend to recognize the usage of "+" as a "tag" and route incoming mail using the tag to the root email that precedes the plus and tag.

But, as the sender, you cannot assume that this is always the behavior. You must assume that those are two different emails.

Re:Sherlock: Hunt down social media accounts by username acr... by jpollock on Wednesday December 25, 2024 @10:50PM (#42512997)
As a sender, that's entirely true. As a flag to identify correlated emails and accounts, it can be a very useful assumption to make.
Re:Sherlock: Hunt down social media accounts by username acr... by sizzle on Thursday December 26, 2024 @12:47AM (#42513381)
I use periods and they work fine like for [email protected] or [email protected] which surprisingly resolves to my main email and I’ll block spam from any sender spamming that period address. Anyone know why this works?
Re:Sherlock: Hunt down social media accounts by username acr... by purkka on Thursday December 26, 2024 @05:47AM (#42514400)
This is a Gmail-specific feature. I'd guess it's there for user convenience and some protection against typos (accidental or malicious).

https://support.google.com/mail/answer/7436150?hl=en

Re:Sherlock: Hunt down social media accounts by username acr... by d3VwsX on Thursday December 26, 2024 @06:50AM (#42514682)
I have a somewhat common [email protected] and others with the same name use it pretty often. Surprisingly often it seems as if sites allow accounts to exist without email confirmation. I estimate at least 50% of the accounts out there that use my gmail is actually not me, and I like the idea of anyone trying to make sense of that data, if they can even guess that I am the Firstname Lastname that the address belongs to.
Re:Sherlock: Hunt down social media accounts by username acr... by 112233 on Thursday December 26, 2024 @10:42AM (#42515827)
Where I am, it is official government agencies that seem to not verify email (and send me sensitive documents meant for others with the same name — a chore to call and ask them to correct their stuff regularly, sigh)

Any comercial sites - dating, gambling etc. end with verification attempts

Re:Sherlock: Hunt down social media accounts by username acr... by quaddo on Thursday December 26, 2024 @02:22PM (#42517121)
I’m in a similar situation and hadn’t thought of it that way. My take on the email I receive is that they fall into one of these categories: a) genuinely intended for me (and not spam), b) spam, c) genuinely intended case of mistaken address (they forgot to include another character), d) someone using mine as their throwaway (site sending verification email), and e) someone using mine as their throwaway (no verification process, ergo not altogether different from spam).
Re:Sherlock: Hunt down social media accounts by username acr... by morkalork on Wednesday December 25, 2024 @04:27PM (#42511278)
In what kind of dystopia would one need to hide doing research on health related topics? Oh, right.
Re:Sherlock: Hunt down social media accounts by username acr... by w4ffl35 on Wednesday December 25, 2024 @04:36PM (#42511319)
Actually, this makes it obvious why you should keep a page that contains all your links. It's easy to just make an account and pose as someone in order to destroy their reputation. It's also difficult to get unique accounts, often times my accounts overlap with existing names. Even my real name is shared with many people. Employers who use technology like this are actually quite foolish to do so.
Re:Sherlock: Hunt down social media accounts by username acr... by mrtksn on Wednesday December 25, 2024 @04:49PM (#42511407)
>And this makes it obvious why you should use a unique username everywhere!

Actually I was disappointed by the post, I was hoping it will be able to find the same person regardless of the username through analyzing the writing style, what they are talking about, the timezone etc.

The username doesn't prove anything, anybody can take any username anywhere. If someone targets you, they can take usernames on platforms you haven't claimed your username yet and pretend being you and damage your reputation.

Re:Sherlock: Hunt down social media accounts by username acr... by portaouflop on Wednesday December 25, 2024 @04:59PM (#42511445)
That’s why you should claim your main handle on all platforms, just don’t use it if you want privacy.
Re:Sherlock: Hunt down social media accounts by username acr... by throwaway519 on Wednesday December 25, 2024 @07:25PM (#42512220)
I have no interest on some platforms.

Whatvabout the platformsthat I don't know of? Or that don't exist yet?

Even major corporations don't bother with all TLDs.

It's far more plausible to not seek to have the same identity behind the same handle.

Re:Sherlock: Hunt down social media accounts by username acr... by portaouflop on Thursday December 26, 2024 @07:30AM (#42514801)
You don’t need every single one obviously, just the major ones.

And I’m saying you should reserve your main handle - you can still have a unique one that you actually use.

Re:Sherlock: Hunt down social media accounts by username acr... by 542354234235 on Thursday December 26, 2024 @09:35AM (#42515400)
>I was hoping it will be able to find the same person regardless of the username

>Sherlock: Hunt down social media accounts by username

I don't know why you would have been hoping for this. The title isn't exactly ambiguous.

Re:Sherlock: Hunt down social media accounts by username acr... by mihaaly on Wednesday December 25, 2024 @04:52PM (#42511420)
Using online services require so much special attention it starts to weight up to the benefits given. Considering the risks, it is already in pair with the value delivered.
Re:Sherlock: Hunt down social media accounts by username acr... by deadbabe on Wednesday December 25, 2024 @06:02PM (#42511787)
Actually it should be the opposite. Claim one handle everywhere that you want people to associate as your “real” persona and then use unique names in places where you want to be controversial.
Re:Sherlock: Hunt down social media accounts by username acr... by cookiengineer on Wednesday December 25, 2024 @07:25PM (#42512219)
Doesn't matter for the next day's witch hunt

They are just gonna make fake accounts that look like yours and shitpost ahead anyways.

Social media has multiple problems, including authenticity, transparency, validity and verifiability. All of which don't exist and make it the optimum propaganda machine (referring to the criteria that Chomsky described) because it can be corrupted through multiple attack vectors.

If we want to survive this hellhole of misinformation, the mentioned criteria has to be implemented for the "next big platform" so that censorship and other legislative processes can be encountered with increased transparency and openness.

On a network/society scale it can't be driven by financial incentives to prevent corruption, ergo it must be financed by taxes. Preferably on an EU or UN legislative level to prevent political corruption of single state actors.

Re:Sherlock: Hunt down social media accounts by username acr... by inerte on Wednesday December 25, 2024 @08:02PM (#42512381)
A state funded platform with a focus on authenticity, transparency, validity and verifiability, is the best thing against censorship? I don’t get how.
Re:Sherlock: Hunt down social media accounts by username acr... by cookiengineer on Wednesday December 25, 2024 @08:15PM (#42512443)
Well, on a political level the EU is based on federalistic principles, meaning that many states have many opinions on censorship; and a compromise between those states' opinions is what's likely best for the citizens of said states/nations.

I mean, that is if we wouldn't have capitalism as the bug of democracy.

On a technological level a lot of things can be solved already through cryptographic means. Technically, it doesn't even need to be hosted anywhere if it's fully peer-to-peer without a gatekeeping server/backend in between.

Re:Sherlock: Hunt down social media accounts by username acr... by gopher_space on Wednesday December 25, 2024 @09:56PM (#42512827)
L’etat c’est vous.
Re:Sherlock: Hunt down social media accounts by username acr... by TacticalCoder on Thursday December 26, 2024 @05:23AM (#42514303)
But then at this point we can take a username, take a user's posts on one site, train a LLM with these posts and ask the LLM to write comments in the style of that user on another forum/subject.

How do you even determine anymore if something is really written by someone?

Websites are already for a huge part written by bots/LLMs and we all know to take them with a huge grain of salt.

How long until we consider users posts aren't to be trusted anymore either?

It already started (impersonating usernames) for sure.

So what is this even tracking?

Heck, at this point it's nearly a guarantee we already have bots trained on outputs of other bots.

I wonder what the implication of all this is going to be.

Re:Sherlock: Hunt down social media accounts by username acr... by blitzar on Thursday December 26, 2024 @06:25PM (#42518674)
And this makes it obvious why you should use the same username everywhere!

When maintaining an official online public presence, or if you are privacy minded you likely want to "plant the flag" to stop others from impersonating you.

Re:Sherlock: Hunt down social media accounts by username acr... by mystified5016 on Friday December 27, 2024 @11:35AM (#42523550)
This is like preventing identity theft by putting your SSN on the side of a truck