Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maigret: Collect a dossier on a person by username from thousands of sites

github.com

Post reply on HN
Print view View original

51–60 of 203 posts

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#51

Post by NoraCodes »

lol768 wrote: post #28
motoxpro wrote: post #20

Earlier quoted context omitted.

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. > 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way. Yup, I do think you're right. And honestly, the folks who'd probably…

I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of motivated attackers that any moderately public queer person will, at some point, be doxed and subjected to some level of internet harassment.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#52

Post by rishsriv »

Did something similar as an experiment a few years ago, except I used photos and name strings as fuzzy identifiers across social media profiles.

We also scraped individual reactions from social media apps to get a _very_ detailed profile on what they engaged with (like using the "Angry" reaction emoji when Trump said something stupid vs using the "Angry" reaction emoji when someone AOC said something stupid).

Never released it in the wild for obvious ethnical reasons, but was an interesting technical challenge. Also led to super interesting insights – like learning that videos and text links were watched by entirely different audiences on Facebook and Twitter [1]

[1] https://twitter.com/rishdotblog/status/1483329729302515712

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#55

Post by bityard »

lol768 wrote: post #9

This is technologically impressive, but I was disappointed (but not particularly surprised) to see no mention of the ethics involved in using this sort of project - in either the GitHub issues or the README/docs. This seems like a great tool for stalking people; particularly the recursive functionality (for tying identifiers together). I'm not saying the world is worse-off due to the release of software like this - i…

Software like this _already_ exists. Credit bureaus, advertising firms, data brokers, skip trace databases, three-letter agencies across the globe, and nearly all of the Big Tech companies do their business building centralized profiles of basically everyone and that certainly includes correlating online identities.

The only difference here is that one is more limited and open source.

"Privacy is dead, get over it."

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#56

Post by styfle »

djbusby wrote: post #29

Remember when KeyBase was gonna make it easy to verify users across profiles? Your KeyBase profile would link out to all of them, no magic needed.

Yeah that or a personal website which often has links to the same person on all social networks.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#57

Post by SpamFork »

romeoblade wrote: post #31
bee_rider wrote: post #19

Earlier quoted context omitted.

Some annoying people seem to have used my gmail to sign up for things like Twitch. I have all the three factor authentication stuff set up, so I don't think they can get in to click the "verify" links, but I wonder if this sort of tool would be able to verified that the account was... verified. Probably not.

My Gmail is first.last name. I get very sensitive documents for a lawyer with my same name who resides in Texas. We've actually had some decent conversations over the years.

Your gmail is actually firstlastname periods are ignored and so are most things after a +. So your email could be fir.st.las.t+hackernewsapp @

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#58

Post by rtev »

mod wrote: post #37
motoxpro wrote: post #20

Earlier quoted context omitted.

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves. It will be used for many reasons, but the stalking is the most obvious. Not all of my usernames are as resistant as this one, unfortunately.

Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field.

If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#59

Post by TEP_Kim_Il_Sung »

bee_rider wrote: post #19
AdmiralAsshat wrote: post #15

Seems incredibly prone to false positives. For example, I can guarantee that I'm not the AdmiralAsshat on Reddit, Gmail, or Twitter, because that username was already taken by the time I tried to sign up for them.

Some annoying people seem to have used my gmail to sign up for things like Twitch. I have all the three factor authentication stuff set up, so I don't think they can get in to click the "verify" links, but I wonder if this sort of tool would be able to verified that the account was... verified. Probably not.

Your current username at geronnimo mail dot kazooie? Fun fact: at email dot com is a functional AOL address, still recognized by all corporate services, even with completely made up user part. e.g. birdperson @ email dotcom

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#60

Post by javajosh »

NoraCodes wrote: post #51
lol768 wrote: post #28

Earlier quoted context omitted.

> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. > 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way. Yup, I do think you're right. And honestly, the folks who'd probably…

I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of mot…

Yeah but this tool just lowered the barrier-to-entry for any motivated attacker. What before was an, oh, 20 hour slog through a bunch of sites looking for the same username, is now a 15 minute run of a script.

For an analogy, consider another tool, an app you can side-load and use to unlock any Prius made between 2010 and 2013. Is this beneficial? Certainly some affected Prius owners will be helped by its release. But affected Prius owners will be (probabilistically) harmed. Even if you're one of the group that was helped (probably arguing the exploit was already well known prior to the tool's release, perhaps?) I think it is dishonest to assert that the release of the tool is "good" from a utilitarian sense.

I wish it weren't so.

Post reply on HN