Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Doxing the hero who stopped WannaCry was irresponsible and dumb

thenextweb.com

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#81

Post by sfilipov »

Nadya wrote: post #49
Spare_account wrote: post #42

Earlier quoted context omitted.

I've been wondering if it is possible to dox my Reddit account. I like to think I've been careful not to give too much away but I wonder if it is true. I would like to find a white hat site that prepares a report on what they can find about you. (For the record, my reddit account has a different username than my HackerNews account)

>I would like to find a white hat site that prepares a report on what they can find about you. This would be difficult to start as it would require trust. I already do exactly this ("white hat doxing") but do you trust that that is actually what I'm doing? Maybe it would be easier as an established corporation with an explicit privacy policy. >I've been wondering if it is possible to dox my Reddit account. You can ma…

Is that going to help against checking with the Internet Archive? I've used the Internet Archive to read versions of reddit comments when they were deleted (but not to dox people).

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#82

Post by rdrey »

proaralyst wrote: post #9
krona wrote: post #6

There is a newspaper claiming he's now working with GCHQ. I doubt such information is true, but given what happened to Gareth Williams in similar circumstances, I'd suggest it's egregiously irresponsible for a newspaper to even suggest it given everyone now knows who he is.

For those curious as I was: https://en.wikipedia.org/wiki/Death_of_Gareth_Williams

If you're still curious, this has been turned into a BBC mini-series called "London Spy". See: https://www.theguardian.com/commentisfree/2015/nov/12/london...

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#83

Post by Nadya »

Zak wrote: post #72
Nadya wrote: post #59

Earlier quoted context omitted.

>In communities where people buy and sell things, or offer pay for services (e.g. /r/forhire), a glance at someone's account history provides some insight into their likely reliability. It's not much to go on, but that's inherent to doing business with strangers online. Trivially solvable with an alias used exclusively for such dealings where you don't scrub history. Also, as mentioned, it isn't necessarily that good…

I'll grant this for that technique: while your website linked to your username here made it easy to guess your reddit username, 5 minutes of looking did not recover your deleted comments. It's a little difficult for me to wrap my head around the mindset though: if you're concerned about privacy, why would you post anything sensitive to reddit? If you haven't posted anything sensitive, why delete it? I'll admit, I've…

>I'll admit, I've never been the victim or perpetrator of doxxing, so I may be missing something.

Most people leak information constantly and each bit or byte of information by itself is not important. However, in aggregate, people leak enough information about themselves to have it become sensitive information. What can be seen as harmless on its own can lead to more sensitive/"harmful" information being gathered.

For an example, let's say you share a photograph of yourself somewhere in London. Maybe you went on vacation, a business trip, a family visit, a honeymoon, etc. There are plenty of reasons to be in London one time! Now over the period of 10 years you've shared a few dozen photos of yourself in various places of London. What are the chances you live in London? Would you say the chances are higher than if you had only shared a single photograph?

Likewise, information that doesn't seem sensitive on its own can become incriminating when combined with other evidence. Scrubbing everything therefore is the best way to ensure you aren't leaving anything behind. It's also a lot easier to scrub everything than to read over years of post history to see if you've ever shared anything you maybe shouldn't have.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#84

Post by vultour »

jlebrech wrote: post #3

they came to the wrong conclusion that someone who bought a kill switch domain, would have been one of the hackers. when it fact the kill switch was firewall check (look for 502 rather than 404) and the person who bought the domain kill switched it for everyone. Sucky journalism strikes again.

Where did you come to the conclusion that they think he was one of the hackers? Neither the link, nor the Telegraph article said anything like that AFAIK.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#85

Post by kbenson »

Spare_account wrote: post #42
Nadya wrote: post #37

Earlier quoted context omitted.

I occasionally offer to dox people to show them how bad their OpSec truly is or as an example of why I don't use social media like Facebook for privacy concerns. Doxing people is often trivial since nearly anyone contributing to discussions online have large online profiles. It isn't a very difficult task - just a game of connecting the dots and knowing how to construct specific Google search queries (eg: "site:___ +…

I've been wondering if it is possible to dox my Reddit account. I like to think I've been careful not to give too much away but I wonder if it is true. I would like to find a white hat site that prepares a report on what they can find about you. (For the record, my reddit account has a different username than my HackerNews account)

> I would like to find a white hat site that prepares a report on what they can find about you.

To me there seems to be an inherent catch-22 involved in that. To be responsible, you have to confirm the person requesting the information is the person that wants doxxing. In providing evidence you are who you say you are, you're seeding that company with information to better find you that might not be easily found otherwise. It would take a strict separation of the sales and operations teams, to make sure this was a useful and accurate service, and with all that work it likely wouldn't be cheap.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#86

Post by pmontra »

tudorconstantin wrote: post #8

If some journalists were able to find his identity, he can safely assume that the people behind wannacry are also able to do it. Maybe he'll take some measures to protect himslef more now. I would've liked to see the journalists find the hackers behind this. That would've been an achievement indeed.

Maybe the wannacry people had more profitable ways to invest their resources, but the cost of pursuing this guy is much lower now.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#87

Post by TeMPOraL »

Nadya wrote: post #59
Zak wrote: post #55

Earlier quoted context omitted.

I hate it when people use these scripts and do have a rule against deleting posts that have replies in one subreddit I moderate. There are two kinds of things harmed by this behavior: * In communities where people buy and sell things, or offer pay for services (e.g. /r/forhire), a glance at someone's account history provides some insight into their likely reliability. It's not much to go on, but that's inherent to do…

>In communities where people buy and sell things, or offer pay for services (e.g. /r/forhire), a glance at someone's account history provides some insight into their likely reliability. It's not much to go on, but that's inherent to doing business with strangers online. Trivially solvable with an alias used exclusively for such dealings where you don't scrub history. Also, as mentioned, it isn't necessarily that good…

I'm strongly with 'Zak here; there's little I hate more in the domain of Internet conversations than people deleting things their wrote. In fact, I believe there is a strong community interest in all (not killed by moderation) comments remaining up as long as the whole discussion exists. I don't mind if someone unlinks their post by e.g. deleting account; I care less about who wrote something than about what was written. Deleting posts ruins the discussion for those who come later.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#88

Post by Nadya »

sfilipov wrote: post #81
Nadya wrote: post #49

Earlier quoted context omitted.

>I would like to find a white hat site that prepares a report on what they can find about you. This would be difficult to start as it would require trust. I already do exactly this ("white hat doxing") but do you trust that that is actually what I'm doing? Maybe it would be easier as an established corporation with an explicit privacy policy. >I've been wondering if it is possible to dox my Reddit account. You can ma…

Is that going to help against checking with the Internet Archive? I've used the Internet Archive to read versions of reddit comments when they were deleted (but not to dox people).

Not always - but the idea is to make linking separate posts more difficult and time consuming. Not making reading an individual post impossible.

Re: Doxing the hero who stopped WannaCry was irresponsible and dumb

#89

Post by TeMPOraL »

Nadya wrote: post #83
Zak wrote: post #72

Earlier quoted context omitted.

I'll grant this for that technique: while your website linked to your username here made it easy to guess your reddit username, 5 minutes of looking did not recover your deleted comments. It's a little difficult for me to wrap my head around the mindset though: if you're concerned about privacy, why would you post anything sensitive to reddit? If you haven't posted anything sensitive, why delete it? I'll admit, I've…

>I'll admit, I've never been the victim or perpetrator of doxxing, so I may be missing something. Most people leak information constantly and each bit or byte of information by itself is not important. However, in aggregate, people leak enough information about themselves to have it become sensitive information. What can be seen as harmless on its own can lead to more sensitive/"harmful" information being gathered. F…

I fear we're slowly stepping into paranoia levels of privacy protection. This is my personal belief, I'm aware many people here don't think that way, but here it is: it is literally impossible to live a life in a society without radiating such information all the time. This applies both to physical and digital realms; and as most people spend more and more time with digital services, the two start to blend into one.

So I guess my opinion is: radiating that information is not really an issue, and any problems arising from it are best solved elsewhere, and not by becoming a digital hermit.

Post reply on HN