Find a person's profile across 350 social media sites
github.com
github.com
I personally like running my username through tools like this and aggregating my digital presence. When I was younger, I signed up for lots of sites that were the cool, new thing. Checking myself years later, I am shocked by the wide berth I left. Fitness accounts. Accounts from that time I was getting into studying chess. I’m the type of person who is always on to the next hobby. I go 100% in on something, then pop to the next thing. It was a big wake up call to me looking back seeing how much presence I left. Many accounts are so old I can’t even get into them anymore to clean up what’s out there. Tools like this can be used for good.
That said, I totally understand the cyber stalking/bullying concerns. I am also astounded by the cyber sleuth types. In the documentary, Don’t F* with Cats, people spent 100s of hours carefully walking through streets in Google Maps to match a location to a photo they had of a guy who killed a cat on YouTube. It seems to me where there’s a will, there’s a way. It’s scary, and unfortunately a lot of tools we can use to protect ourselves are the same tools that can be used against us. Look at cyber security in general. A black hat and a white hat are people with the same skills, but ethics draw a line between them.
But I don't think the "it can be abused" argument is compelling. Most of the tools we have today can and have been abused. As you point out, we know bad actors use infosec tools and run the same POCs that researchers produce when they find new exploits and vulnerabilities (after disclosure); they check the same CVEs and read the same papers. But this information has to be released and these tools have to be out in the open. Security through obscurity is a disaster.
Besides the other intended goals of these tools, I am hoping they will raise awareness and get many people to realize how easy it is to identify and deanonymize them online.
> could help in investigating profiles related to suspicious or malicious activities such as cyberbullying, cybergrooming, cyberstalking, and spreading misinformation.
It will much more likely be used to aid cyberbullying and cyberstalking. Those types love digging for more information by finding their targets' profiles on other social media sites.
Those types of trolls are much more adept at using randomized usernames, disposable e-mail addresses, and VPN clients because they know what they're doing is potentially illegal.
BUT, this may bring awareness to regular folks. You can also use it to remove your own stuff from said networks because people do not catalogue their online activity and it can be hard to remove your digital footprint.
1. Find my digital footprints on social media
2. Compare that to my desired level of public activity, e.g., do not share photos of me
3. Provide tools to delete, scrub, send takedowns, etc.
It is not the first tool in that spirit, there's a lot more available in Kali Linux for example, including Maltego.
This tool is recipe for stalking.
It’s a tool, much like a knife is a tool. They can be used for good or bad. The tool is indifferent.
The other thing you can do is not allow your API to iterate over the set of all users by user-set identifier. It's an extreme flaw of the telephone numbering system. You would think by the 2020s we'd have learned to use a unique UUID designation for every user for any public facing APIs. If users want to link to it on their public pages, that would be on them.
It’s a heck of a lot easier for me to tell my GitHub username to someone, than it would be to tell them a random UUID like 3ffdf0d2-b9a5-4fff-9f38-75afae67dbea.
Even a shorter random-looking username like the one that you have chosen as your HN username, is difficult to relate to for me and I suspect for a lot of people.
And even if you made a human readable version that would hand out usernames like “magnificentwalrus”, it would be generating usernames that most users weren’t identifying with. As much as I like walruses I don’t have a personal connection to them, and any other random name is likely to fare the same. Sure you could let users generate names until they come across one that they do like, but mostly I think that would be a lot of hassle. And there is no guarantee for how long it takes before you find a good name that way. Perhaps even never, as adjective + noun or whatever else the site uses as rule for generating names might not be a rule that the user likes.
Names matter a lot to a lot of people.
Aside from this I think it’s also only a matter of time before similar services to the one in the OP show up but where instead of trying to cross-reference usernames it would work similar to Google Reverse Image Search, and would be able to link accounts across different social media platforms based on the facial features in the photos and/or videos that people post, even when the images and videos are not the same ones but are depicting the same person.
If you want to protect user privacy, a unique identifier is not enough. If they posted a gay profile somewhere, a professional profile somewhere else, they will be forever linked.
Completely agreed. If I were to ever set up a forum, I'd find whatever "adjective-adjective-noun" generator that Gfycat uses to generate their URLs and present new users with a list of 100 of these to choose from.
HN probably is the only "social media" sites I use that you can't do that. This can't be good for users' privacy or "right to be forgotten".
If this were any other website, it'd be decried as a dark pattern
Like, if I email them and say "hey, I want to remove these 340 comments I made out of 2000", and I do it every other day, would they still be as responsive? Even if they do, collecting and emailing all these links is still a big hassle compared to just clicking "delete" as I go through my own timeline like other social media platforms.
But remember to break your social graph on occasion with a new phone number and email address, and never sharing your number or stored contacts with the social media network. not that hard just something to be conscious of.
a lot of people dont know how or why they get the same suggestions of people and dont want that.
That would be especially useful for censorship services across competitors: Although Google Facebook and Twitter compete, sharing the flagged accounts would allow recognizing the same user coming back with a different email address.
but sure? probably if you just alternate between a backup email tied to an email you use everywhere
To cycle against entity resolution tools for a regular company, that'd mean things like full simultaneous reset of:
* cookies
* browser user agent
* potentially sequence of sites/services you use
* IP address/location
* linked accounts
* contact info
Even one miss/overlap can void your efforts.
The big sites have much more to work with than that, making it especially hard. Likewise, if a team takes a specific interest, there are even more correlations that can be done, e.g., behavioral analytics.
Social media sites (Facebook products) might drive ads based on fingerprinting but they aren't re-linking social graphs this way. Sticking with the reliability of shared phone numbers and emails (and people friending/inviting the same people and having the same name theyve seen before)
Pretty troubling statement.
Does this tool help repressive governments track people across accounts? That’s sure what it looks like.
Bad actors can make such tool themselves (if they can't, they are not really that good) and have incentive to do that, so non existence will only slow them down. I don't care about analyzing other people for any purpose so I don't. Having this tool readily available lets me analyze myself and people I care about to protect them from bad actors and educate them in the process.
I'm not familiar with the phrase "invalid thinking." Can you elaborate on how a person's thoughts can be invalid?
Invalid line of thought sounds good ?
Try DDG next time.
I like to think that humans have an inherint right to engage in creative work that pleases them.
Anything we can do to make it easier for them.
But who is making the technology?
Circles. Circles everywhere.
Perhaps you should not anthropomorphize technology.
And yet there are hundreds of laws, conventions, and treaties regulating all kinds of weapons. The idea that humans can pick and choose what exists in their society is ridiculous.
I think we should rather demand the platforms to enforce better measures against this kind of usage, rather than blaming this tool.
I take an issue with the argument that bad actors can make their own tools. Bad actors can also build their own nuclear weapons, genetically engineer their own deadly diseases but there's certainly value in not making this any easier. If you take the time, money and effort away from bad actors by forcing them to reinvent the wheel, that's a good thing.
Granted, this logic can't be viably applied to most things, but there are projects where you can assume that most of the use-cases will be shady.
Bad actors with a $150 laptop out of a dumpster and a free wifi connection CAN make cyberstalking tools in their spare time
This specific thing, for example.
> ... but there are projects where you can assume that most of the use-cases will be shady.
An assumption is a poor basis for an argument. Even in the case where the assumption turns out to be correct, I don't buy this line of reasoning, because it would apply generally to security tools. Such reasoning also makes it far easier to attack things even where the assumption is known to be wrong (e.g. bittorrent).
It's not the missile that's the problem, it's the guy who launches the missile.
Why not both?
So there's a difference between "this is possible" and "this is a tool that makes it really easy"
List out all the IPs and countries that are state IPs using it.
Well said. If a saw blade is sharp and you can cut yourself with it, you build safety systems around that. You don't blunt the saw–render it useless.
Everything you've ever posted can be used against you. Plus your more likely to make friends / meet partners in this place called real life.
Unlike shodan, this can be run locally, making doxing trivial, and with little to no consequences when done seldom enough.
I like this idea!
It's sort of like a "social media site" (if the broadest possible definition of one is permitted!) that "aggregates all other social media sites"... (how meta!)...
But, I like this idea a lot!
If I were creating such a thing -- I'd add the ability for a person (once their identity is verified) to remove their results from one or more social media sites.
That is, standard opt-in and opt-out.
This would permit the shown functionalities for people that desire such functionalities, while also preserving opt-out, aka, "the right to be forgotten" -- for other people that desired that, specifically...
HackerRank (the coding challenge/interview platform) allows viewing profiles even without logging in - While it doesn't show things you do for specific employers, still not something I realized the site was doing and could have ramifications if you use it to play around.
7Cups, the online therapy/talkspace site, allows viewing profiles even without logging in. Far more dangerous and worrisome than a lot of the other sites on here because of stigma around mental health; it's easy for me to imagine an employer or insurance salesman running a username through here and finding out that a candidate has been (likely) dealing with MH issues.
Tinder(!) lets allows viewing a user's public pictures despite not being logged in - seems like a not great privacy measure - not sure how resistant this is to crawlers and the like but a tad bit concerning.
Won't need it for me, though. Just Google "ChrisMarshallNY."
Most of them are placeholders, though. This is really where I participate. I do little bit on Facebook, and almost nothing on Twitter.
The results were underwhelming. It fails to find obvious links between sites, makes completely incorrect correlations while claiming 100% matches, and has no way of figuring out if it's the same person. The "useful" features seem to be username generator based on your original input, e.g. you input "john doe" and it suggests usernames like "jdoe", "johndoe", etc.
Edit: Also you can't Ctrl-C to kill it midway through running so don't fat-finger it if you don't want to waste 30 seconds waiting for it to finish.
Any recommendation?
2. Download the zip file from the repo and unzip
3. Open a terminal windows and cd to the folder containing the README
4. Type docker-compose up
(Not tested. Just based on what's in the repo.)
The "never put information about yourself on the internet" mantra from before social media needs a comeback and it will not happen if no one shines a light on how easy it is to track people online.
Right, if only cutting edge nuclear/bio/chemical/cyber technology was a github repo away.
We’re talking about a tool here that attempts to aggregate all of a particular person’s social medial accounts. Social media is public. Everyone knows this, your are saying things and posting things with the expectation that everyone will be able to see them.
What you said is something totally different. Doxing someone’s private information is heinous. Nobody is arguing that is okay. I think the parent comment made a good point.
If tech can allow a tool like this to be possible, I think it is arguably better that everyone have access to it, instead of just bad actors keeping it to themselves.
For whatever reason, techies that are in the information discovery space can't help themselves from showing off how clever they are despite there being very real security risks to random bystanders.
"url": "https://news.ycombinator.com/user?id={username}",And try as you may, so long as you have a phone number you will end up in someone's harvested contacts list.
maybe email is social media?
IRC and twitch would be too.
Don’t make shit like this. I could do it too, but I’m not gonna.