Hacker News Reader

Comment by motoxpro | Hacker News Reader

As a commentary on the conundrum, not so much your post.

I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them.

99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

View on HN

> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them.

> 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

Yup, I do think you're right. And honestly, the folks who'd probably most benefit from being able to run one of these tools to empower themselves with data that can help them change their behaviour/privacy settings - they're probably actually the folks least likely to be able to install and run the tool.

I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of motivated attackers that any moderately public queer person will, at some point, be doxed and subjected to some level of internet harassment.

Yeah but this tool just lowered the barrier-to-entry for any motivated attacker. What before was an, oh, 20 hour slog through a bunch of sites looking for the same username, is now a 15 minute run of a script.

For an analogy, consider another tool, an app you can side-load and use to unlock any Prius made between 2010 and 2013. Is this beneficial? Certainly some affected Prius owners will be helped by its release. But affected Prius owners will be (probabilistically) harmed. Even if you're one of the group that was helped (probably arguing the exploit was already well known prior to the tool's release, perhaps?) I think it is dishonest to assert that the release of the tool is "good" from a utilitarian sense.

I wish it weren't so.

I definitely see your point, but when there are, at minimum, dozens of people who are willing to undergo that 20 hour slog, I'm glad there's a tool that makes it take mere minutes to find OSINT leaks myself.

I'm not saying you're necessarily wrong in general. It's possible this is bad for the world. But I maintain that for myself and the people I care about, it's more useful than it is damaging.

I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves.

It will be used for many reasons, but the stalking is the most obvious.

Not all of my usernames are as resistant as this one, unfortunately.

Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field.

If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?

I think the argument is more that this tool by virtue of being easily accessible creates more malicious actors. Similar to how most people wouldn't steal a locked bike, but a larger portion would steal an unlocked one. It isn't that much harder to steal a locked bike vs an unlocked one, but the threshold is just a tiny bit higher so more people will attempt it. Conversely this tool lowers the threshold for stalking, so more people, who otherwise wouldn't, will use it maliciously. That isn't the fault of the tool or its developers, but it is something to be aware of when building any tool. When you release it, it may get abused by people for bad purposes.

Assuming your online identity is secure by obscurity is not a realistic option. If all it takes is a flashlight for everyone to become “vulnerable”, we need to just assume the light is always on. Someone handing out flashlights just highlights the bigger problem.

If this truly causes worry, adopt better opsec and create generative usernames for different sites. If not, assume anyone will easily be able to link your bowel issue subreddit comments to your LinkedIn profile.

I feel this is similar to Firesheep[1], a browser extension from a decade ago that put cookie session hijacking into the hands of everyday users and became wildly popular until its removal. Pre-Snowden it pushed various major sites to implement HTTPS encryption, including Facebook[2].

Granted there the solution was a rather simple one but I feel it's at least worthwhile for more to be conscientious of singular identities online and what info is disclosed publicly with them.

[1] https://en.wikipedia.org/wiki/Firesheep [2] https://threatpost.com/facebook-kills-firesheep-new-secure-b...

If this wasn’t on GitHub, we wouldn’t be aware of it

The more availability this type of tool has, the less professional its users are. As a result, while it makes easier for you to see what “they” can see about you, “they” become much more personal and bitchy than credit bureaus or ads companies who already have it. E.g. a credit bureau would never sell your comments or “private preferences” to your boss to step over you in career. It increases attack vectors enormously.

Is blissful ignorance better?

It is in this case, I believe. It’s like spreading free covert time-travel-enabled surveillance devices among general public. Someone will pat it onto your back just for dark fun.

The actual fix is to not reuse usernames. Does distributing password stuffing tools increase the ease of password stuffing? Yes. Is that the problem? No - people reusing passwords is the problem.

It doesn’t work retrospectively. You either start a new web life or live under a risk of accidentally exposing or linking to one of your already vulnerable accounts.

Also, if we don’t raise issues like this, the next actual fix will be “don’t reuse writing styles and vocabularies on different sites”.

I believe both are inevitable if you want to maintain an unlinked identity.

Realistically, there is nothing you can do to avoid that future. The best thing you can do is choose to accept the risk or act to prevent the issue.

This line of thinking reminds me of a Roko’s basilisk situation. Embrace it and be prepared vs. don’t mind this nonsense and just actively stop creating/spreading it. And if it spreads enough, make it a punishable offense like hacking/piracy (e.g. via “canary” links) for it to live only in underground. I hope this project will just fly under the public radar due to non-ease of use by an average person or for a similar reason.

This project is exceptionally minor compared to all the public hacking tools that exist. Are you advocating to start censoring any tool that can be used for malicious purposes?

You have to squint really hard to see "many reasons". Look at the list of sites it checks. Porn / fetish sites, gambling URLs, photo hosting, hobby forums, etc. It's a tool for doxxing and stalking, and little else.

It's essentially like arguing that releasing open-source ransomware toolkit is beneficial. I mean, maybe it's your right, and one can make some strenuous arguments about how it helps the "defense", but really, it just makes it easier to be a terrible person on the internet.

Wrong approach imho. This means, all the tools developed for ethical hacking are "bad" because they can used for "bad". This is like saying we shouldn't sell knifes because knifes can be used to kill someone. It's just silly.

This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc ...

A knife has many uses, from cutting wood to stabbing people. This tool is very much specialized in the stabbing (not necessarily people, as you said, you could stab a ballistic dummy to see the damage it does). Do you really a think a stab-only knife should be sold with no background checks, with no tracking of who buys it ?

We could debate where they are but surely there are limits? I wouldn't want everyone to have access to things like Pegasus (https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-ide...). You could argue Pegasus could be used to hack a phone of a child predator to save a life, just as you could argue this tool could be used to educate. Maybe for you this username tool falls outside of yours, but it looks more like a switchblade than a butter knife to me.

> This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc

Or just... look yourself up. Like most of the people on this HN thread have done.

Reply on news.ycombinator.com