Some annoying people seem to have used my gmail to sign up for things like Twitch. I have all the three factor authentication stuff set up, so I don't think they can get in to click the "verify" links, but I wonder if this sort of tool would be able to verified that the account was... verified. Probably not.
Your current username at geronnimo mail dot kazooie? Fun fact: at email dot com is a functional AOL address, still recognized by all corporate services, even with completely made up user part. e.g. birdperson @ email dotcom
Nah, decided to make a clean break from previous accounts for this site.
Some annoying people seem to have used my gmail to sign up for things like Twitch. I have all the three factor authentication stuff set up, so I don't think they can get in to click the "verify" links, but I wonder if this sort of tool would be able to verified that the account was... verified. Probably not.
My Gmail is first.last name. I get very sensitive documents for a lawyer with my same name who resides in Texas. We've actually had some decent conversations over the years.
I have an extremely common (for German-speaking countries) first-last name combination and I have firstlast@gmail.com (not used anymore, but I check it around once a week). I get so many confidential documents or personal photos.
The most hilarious/sad was the insurance provider domcura which advertised how they got some kind of award for their great processes, yet writing to 2 or 3 different service emails that they are sending me confidential documents resulted in nothing until I wrote to their data protection officer.
I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of mot…
Yeah but this tool just lowered the barrier-to-entry for any motivated attacker. What before was an, oh, 20 hour slog through a bunch of sites looking for the same username, is now a 15 minute run of a script. For an analogy, consider another tool, an app you can side-load and use to unlock any Prius made between 2010 and 2013. Is this beneficial? Certainly some affected Prius owners will be helped by its release. Bu…
I definitely see your point, but when there are, at minimum, dozens of people who are willing to undergo that 20 hour slog, I'm glad there's a tool that makes it take mere minutes to find OSINT leaks myself.
I'm not saying you're necessarily wrong in general. It's possible this is bad for the world. But I maintain that for myself and the people I care about, it's more useful than it is damaging.
Yes also with plus addressed E-Mail, or a catch-all E-Mail generator or if you use Firefox Relay etc a generator for these. But the username generator is just a random English word plus a number.
I'd never heard of Firefox Relay, thanks for that.
Seems incredibly prone to false positives. For example, I can guarantee that I'm not the AdmiralAsshat on Reddit, Gmail, or Twitter, because that username was already taken by the time I tried to sign up for them.
I intentionally steal nicknames I've seen. I'm an asshole as well, so sometimes it works out. I have 13 different nicknames so far that I use/have used since 1997, though I tend to rotate between all of them regularly. I DO hope they try to use "AI" to track me. That will be fun.
My Gmail is first.last name. I get very sensitive documents for a lawyer with my same name who resides in Texas. We've actually had some decent conversations over the years.
I have an extremely common (for German-speaking countries) first-last name combination and I have firstlast@gmail.com (not used anymore, but I check it around once a week). I get so many confidential documents or personal photos. The most hilarious/sad was the insurance provider domcura which advertised how they got some kind of award for their great processes, yet writing to 2 or 3 different service emails that they…
I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves. It will be used for many reasons, but the stalking is the most obvious. Not all of my usernames are as resistant as this one, unfortunately.
Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?
I think the argument is more that this tool by virtue of being easily accessible creates more malicious actors. Similar to how most people wouldn't steal a locked bike, but a larger portion would steal an unlocked one. It isn't that much harder to steal a locked bike vs an unlocked one, but the threshold is just a tiny bit higher so more people will attempt it. Conversely this tool lowers the threshold for stalking, so more people, who otherwise wouldn't, will use it maliciously. That isn't the fault of the tool or its developers, but it is something to be aware of when building any tool. When you release it, it may get abused by people for bad purposes.