Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GHunt – An OSINT tool to extract information about a Google account

github.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: GHunt – An OSINT tool to extract information about a Google account

#23

Post by mettamage »

alanfranz wrote: post #15
mettamage wrote: post #10

Earlier quoted context omitted.

I agree with this. I'm worried about the probable location though, because I've realized that people tend to post reviews (even if it's a one-off) in a location where they live. All the probably locations it was able to guess, it was right.

Don't post reviews all around where you live, then. But, actually the city where I live is a public information... it's on my linkedin profile, etc. I don't actually care. This tool doesn't seem to be leaking private information of any kind. It's just a way to consolidate existing public information. I think pipl (pipl.com) used to do something like this across accounts, some 10+ years ago.

The first sentence reads as a personal attack. I don’t know if you meant it that way and I don’t mind, but that might explain why you are downvoted.

I don’t mind people knowing my location. But most people aren’t as tech/security savvy as the average HN user. I am worried for them.

And to second another commenter. OSINT is generally using public information in ways that you’re getting too much info about someone.

The coolest example of it are camera reflections or searching dns records about someone (IMO).

Re: GHunt – An OSINT tool to extract information about a Google account

#24

Post by mobilio »

djrhails wrote: post #11
neolog wrote: post #6

How does it work?

Looks like Google has a mostly internal user id ("gaia_id"), once you've got this small identifier you can look on each Google related site for publicly available information relating to that user id. Looks like Google is aware of it as the reference to gaia_id has been removed from Youtube pages source (Aug 2020), locked down public accessibility of photo albums (Sep 2020), and prevented connected email address leak…

hmmm... what is this leak from Webmasters?

Re: GHunt – An OSINT tool to extract information about a Google account

#25

Post by deltron3030 »

dikaio wrote: post #13

I’ve had the chance to use Gatsby, Next, Nuxt and Hugo out of all the above my preference is Nuxt but it lacks graphQL. I’ve also used Gridsome which I love problem is I can’t really recommend it because I’m pretty sure the project is becoming abandoned... their official twitter account hasn’t posted anything since Sept. 2019 and there’s very few pushes to the repository which is a shame because it would have been my…

>Would love to see a Svelte SSG (Sapper’s nice but no movement there either).

Check out Elder.js

Re: GHunt – An OSINT tool to extract information about a Google account

#29

Post by alanfranz »

mettamage wrote: post #23
alanfranz wrote: post #15

Earlier quoted context omitted.

Don't post reviews all around where you live, then. But, actually the city where I live is a public information... it's on my linkedin profile, etc. I don't actually care. This tool doesn't seem to be leaking private information of any kind. It's just a way to consolidate existing public information. I think pipl (pipl.com) used to do something like this across accounts, some 10+ years ago.

The first sentence reads as a personal attack. I don’t know if you meant it that way and I don’t mind, but that might explain why you are downvoted. I don’t mind people knowing my location. But most people aren’t as tech/security savvy as the average HN user. I am worried for them. And to second another commenter. OSINT is generally using public information in ways that you’re getting too much info about someone. The…

Oh, my. Not a personal attack, for sure. Why?

It just seemed a bit obvious to me. If I post a review, with my account, I have been there, right? And if I post a lot of reviews month after month in a certain place, I probably live there, right? This has nothing to do about being tech savvy. It's not about IP geolocation or recognizing user locations from random photos.

I understand the OSINT part as well. But the tool claims to be able to extract some info that should not be public (device info, installed apps). But it cannot.

Re: GHunt – An OSINT tool to extract information about a Google account

#30

Post by grezql »

formerly_proven wrote: post #12

Doesn't really work for Google accounts that have reasonable privacy configuration, in which case it only tells you the email (which you specified), the account ID, the main account name and last profile edit. Of these the main account name might be the real name for many people, but I don't think that's required. The account name is also publicly used by Google in a whole bunch of places (e.g. when you read a Google…

I think even if 99% of google users have strict privacy, this tool is still worth it for data brokers as they can run email lists of millions of users.

And every data about a user that can be connected to the rest of the master data is gold as its all about the network effect.

edit: https://imgur.com/a/o2petUC

here is a good example. The white box is from a publically available dataleak of a site called SexDating.se. its 10 years old db. but still i managed to extract the name of the person even though the original DB had no identifiers apart from this gmail.

Post reply on HN