Hacker News Reader

Comment by Tepix | Hacker News Reader

And this makes it obvious why you should use a unique username everywhere!

It makes pervasive tracking a lot harder.

Also when you do any research on health related topics, be extra privacy conscious.

This is why I try to use the same name across websites. I want to be identified as the same person. Just resist the urge to post information you don't want others to have.

We often don't know what is or isn't information we don't want others to have, and it will be a lot harder, if not impossible, to delete it after-the-fact. Especially when you consider how it only takes a few innocuous data points to derive what might be information you'd rather not disclose.

The secret is multiple accounts. I too have a Brand Name Account(tm) I like to float around but it sure as heck isn’t this one.

Doing the multiple account thing isn’t as easy as it sounds though. Some sites like Reddit make switching between accounts incredibly easy while others aren’t so much. Plus laziness kicks in and soon enough your Brand Name Account gets tainted and you have to consider taking it out back to the dumpster.

Such is life I guess.

> Doing the multiple account thing isn’t as easy as it sounds though. Some sites like Reddit make switching between accounts incredibly easy

And it's as easy to dox yourself by responding with the wrong account, as I have seen multiple times on Reddit.

trick here.. create different chrome profiles, with different color schemes. Peach is my "nice person" account. Red is for accounts that I want to be a little more argumentative.

I do this at work too.. where I have to have different user profiles to emulate working as an admin, staff, client, sub-client. Blue seems adminny :)

I do a similar thing with my terminal emulator: Different background colours in PuTTY depending on which server it's connected to. Green for Dev, red for Prod...

This happens a lot with viral-bait accounts. One of the top posts on the UFO board just got caught sockpuppeting this week.

> The secret is multiple accounts.

There was a "show hn" many months ago that did stylometry on HN commenters to show which accounts were most stylistically similar; I ran a throwaway account of mine through it, and it showed my account in the top 3 - which was impressive.

Having multiple accounts won't save you when your own word choice, grammar and style can uniquely identify you to anyone sufficiently motivated to link your disparate identities at any point in the future. The author even said their tool was rather basic; IIRC the basis was all pairs similarity on n-grams

You wouldn't happen to have a link to that would you? I'd really like to check that out

https://news.ycombinator.com/item?id=33755016

I can't get the site to load

> Just resist the urge to post information you don't want others to have.

Self-censor you mean?

I personally like that information anonymous account `William Shakespeare` posted around 1585–1613.

I don't understand what point you're trying to draw here. William Shakespeare was by no means anonymous in his day and age and he almost certainly had to consider the views of the aristocracy and other elite figures that might watch his plays i.e. self censor. Ben Johnson, a contemporary playwright, was imprisoned for writing "The Isle of Dogs".

I think parent is saying that by self-censoring, expression others enjoy is lost, with the example of Shakespear as an expresser whose impact would have been lost if he'd decided to be anonymous instead.

Then I wouldn't be able to talk about my kinks anywhere

Actually it should be the opposite. Claim one handle everywhere that you want people to associate as your “real” persona and then use unique names in places where you want to be controversial.

Actually, this makes it obvious why you should keep a page that contains all your links. It's easy to just make an account and pose as someone in order to destroy their reputation. It's also difficult to get unique accounts, often times my accounts overlap with existing names. Even my real name is shared with many people. Employers who use technology like this are actually quite foolish to do so.

just to be slightly pedantic as there are still sites that have screen names vs account names where the screen name the public sees has no correlation with the account name (typically an email account).

so don't re-use email accounts across sites. SecOps matter

I have a somewhat common firstname.lastname@gmail.com and others with the same name use it pretty often. Surprisingly often it seems as if sites allow accounts to exist without email confirmation. I estimate at least 50% of the accounts out there that use my gmail is actually not me, and I like the idea of anyone trying to make sense of that data, if they can even guess that I am the Firstname Lastname that the address belongs to.

I’m in a similar situation and hadn’t thought of it that way. My take on the email I receive is that they fall into one of these categories: a) genuinely intended for me (and not spam), b) spam, c) genuinely intended case of mistaken address (they forgot to include another character), d) someone using mine as their throwaway (site sending verification email), and e) someone using mine as their throwaway (no verification process, ergo not altogether different from spam).

Where I am, it is official government agencies that seem to not verify email (and send me sensitive documents meant for others with the same name — a chore to call and ask them to correct their stuff regularly, sigh)

Any comercial sites - dating, gambling etc. end with verification attempts

Yes, another thing you can do is use email subadressing for every account you create, ideally with a non-default separator (i.e., not "+").

Doesn't this subaddress all just resolve to the same account? The accounts are free, so just make up a completely different account. Yeah, it might get a bit of a mess for a user to manage, but that's what password managers are for.

let's face it, we're not talking about Joey Beercan doing this. Anyone even tossing around the term SecOps is already moved out of mass populace and into the somewhat informed. Someone practicing SecOps would definitely be the type to use some sort of credentials management. So I don't think unique totally unrelated emails is too much of a burden. Using different free email providers is even better.

It depends on the underlying email server. But strictly speaking, the "+" is a valid identifier, and "joe+admin@example.com" is a completely different address than "joe@example.com".

It just so happens that email servers tend to recognize the usage of "+" as a "tag" and route incoming mail using the tag to the root email that precedes the plus and tag.

But, as the sender, you cannot assume that this is always the behavior. You must assume that those are two different emails.

I use periods and they work fine like for exampl.e@gmail.com or e.xampl.e@gmail.com which surprisingly resolves to my main email and I’ll block spam from any sender spamming that period address. Anyone know why this works?

This is a Gmail-specific feature. I'd guess it's there for user convenience and some protection against typos (accidental or malicious).

https://support.google.com/mail/answer/7436150?hl=en

As a sender, that's entirely true. As a flag to identify correlated emails and accounts, it can be a very useful assumption to make.

Gmail accounts aren't free: I believe they only allow up to 4 to be linked to the same phone number (which is mandatory).

Microsoft is worse: they'll let you create an account, then lock it the next day, after you've already used it for something, if you don't link your phone number.

Phone number is used because it costs money to get, is hard to get in bulk, and in many countries is always tied to your identity.

I wonder what the market for throwaway phone number verification is worth.

It is still possible to register Gmail accounts without a phone number. I suppose they primarily use IP reputation to determine when they allow it but device seems to matter too.

In the past you could use BlueStacks android emulator to register Gmail accounts without sms verification even with VPN IPs. This year I've created a few Gmails without sms verification, once on desktop chrome (with Firefox they would've required sms) and a couple of times using the Gmail app on an Android phone.

There are several cheap (not free) email providers that allow you to create unique emails per service for this precise purpose, and do not require a phone number, however they are lacking significantly in every other way, like an easy to use inbox, so not great for your main contact. One I tested out I found to be good for these random sites that want emails as your username. Then I set the custom email to forward the mail thereby maintaining unique usernames on each site. If the site does not use an email for the username and does not make the provided email public, you could use your regular email with the handy features that come with a Google/Microsoft suite, or air on the side of caution by still having the unique email.

This functionality is built into iCloud subscriptions with throw away Apple addresses that resolve to your AppleID registered email.

> I wonder what the market for throwaway phone number verification is worth.

I pondered this recently, and it seems to top out at a couple bucks per shot.

The problem is that the phone number tends to need to be persistent for the sake of security. You can't typically sign up for something that requires a phone number and then expect to be able to keep the account safe without maintaining exclusive access to that number.

I'm sure if it were cost effective, one of the password managers would have some kind of SMS integration, like Apple's hide my email, but for phone numbers.

If you're the kind of person who doesn't want to provide their own phone number to make an account, you probably also wouldn't be using any account long-term.

That’s not true. None of my Gmail accounts have a phone number, and I’ve used them for their discrete purposes continuously since their creation. I doubt I’m the edge case

I’ve never provided a phone number for any of the gmail accounts I have. When was this mandated?

Very recently. I only noticed it about 2 years ago when I went to make a throwaway gmail account exactly for the above opsec purposes.

You claim OpSec, but if you’re using such bad opsec, then I’d suggest you’re not actually doing opsec. Tying a throw away account to actual data that can directly identify you is just such bad opsec, you might as well use your actual name as your user name.

Opsec can be a relative term. Yes, some people are selling drugs or spying for the Russian government but other people just don't want to be OSINTed by scripts like this. Then creating a new Gmail account from the same IP address is enough. It's a lot easier to hide your identity from people who don't have the power to issue subpoenas.

IP address != phone number

I think his point was that he wasn't looking to be totally invisible. Just less obvious to people who won't spend a pile of time looking for you.

If you're adding your phone number to a throw away account you use on Target or Walmart, it's likely okay.

The IP comment was likely because if someone can get your phone number from the Walmart service (via subpoena), to track you down, they can also get your IP address too.

> Doesn't this subaddress all just resolve to the same account?

Not in OAuth/OIDC compliant identity providers. As one example, I frequently use + email addresses for testing on auth0-secured apps, where I use the + text to tag a role or some other user attribute that identifies what makes the test account special. eg stult+admin-staging@example.com or stult+user-declined-gdpr-prod@example.com. Each plus variant resolves to its own separate account with its own password (which I do in fact manage via a credential manager), without requiring me to set up multiple full email addresses to simulate multiple users with verified email addresses.

In what kind of dystopia would one need to hide doing research on health related topics? Oh, right.

And this makes it obvious why you should use the same username everywhere!

When maintaining an official online public presence, or if you are privacy minded you likely want to "plant the flag" to stop others from impersonating you.

This is like preventing identity theft by putting your SSN on the side of a truck

Or better yet, be extra privacy conscious with everything you do.

I strongly suggest the opposite. Collect everything and do on a personal site, do good seo on your pages, expose your content. Go totally anon for anything you don't want exposed of course. But you should expose as much of yourself as you're able and control the conversation.

This reminds me of a friend who was a steam moderator, and they had an alternate account on twitter pretending to be mexican. The amount of times they got people thinking they found their real name was larger than "juan".

Using online services require so much special attention it starts to weight up to the benefits given. Considering the risks, it is already in pair with the value delivered.

But then at this point we can take a username, take a user's posts on one site, train a LLM with these posts and ask the LLM to write comments in the style of that user on another forum/subject.

How do you even determine anymore if something is really written by someone?

Websites are already for a huge part written by bots/LLMs and we all know to take them with a huge grain of salt.

How long until we consider users posts aren't to be trusted anymore either?

It already started (impersonating usernames) for sure.

So what is this even tracking?

Heck, at this point it's nearly a guarantee we already have bots trained on outputs of other bots.

I wonder what the implication of all this is going to be.

>And this makes it obvious why you should use a unique username everywhere!

Actually I was disappointed by the post, I was hoping it will be able to find the same person regardless of the username through analyzing the writing style, what they are talking about, the timezone etc.

The username doesn't prove anything, anybody can take any username anywhere. If someone targets you, they can take usernames on platforms you haven't claimed your username yet and pretend being you and damage your reputation.

That’s why you should claim your main handle on all platforms, just don’t use it if you want privacy.

I have no interest on some platforms.

Whatvabout the platformsthat I don't know of? Or that don't exist yet?

Even major corporations don't bother with all TLDs.

It's far more plausible to not seek to have the same identity behind the same handle.

You don’t need every single one obviously, just the major ones.

And I’m saying you should reserve your main handle - you can still have a unique one that you actually use.

>I was hoping it will be able to find the same person regardless of the username

>Sherlock: Hunt down social media accounts by username

I don't know why you would have been hoping for this. The title isn't exactly ambiguous.

Doesn't matter for the next day's witch hunt

They are just gonna make fake accounts that look like yours and shitpost ahead anyways.

Social media has multiple problems, including authenticity, transparency, validity and verifiability. All of which don't exist and make it the optimum propaganda machine (referring to the criteria that Chomsky described) because it can be corrupted through multiple attack vectors.

If we want to survive this hellhole of misinformation, the mentioned criteria has to be implemented for the "next big platform" so that censorship and other legislative processes can be encountered with increased transparency and openness.

On a network/society scale it can't be driven by financial incentives to prevent corruption, ergo it must be financed by taxes. Preferably on an EU or UN legislative level to prevent political corruption of single state actors.

A state funded platform with a focus on authenticity, transparency, validity and verifiability, is the best thing against censorship? I don’t get how.

L’etat c’est vous.

Reply on news.ycombinator.com