Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maigret: Collect a dossier on a person by username from thousands of sites

github.com

Post reply on HN
Print view View original

91–100 of 203 posts

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#91

Post by JustHiThere »

motoxpro wrote: post #20
lol768 wrote: post #9

This is technologically impressive, but I was disappointed (but not particularly surprised) to see no mention of the ethics involved in using this sort of project - in either the GitHub issues or the README/docs. This seems like a great tool for stalking people; particularly the recursive functionality (for tying identifiers together). I'm not saying the world is worse-off due to the release of software like this - i…

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

Wrong approach imho. This means, all the tools developed for ethical hacking are "bad" because they can used for "bad". This is like saying we shouldn't sell knifes because knifes can be used to kill someone. It's just silly.

This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc ...

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#92

Post by verisimi »

lol768 wrote: post #9

This is technologically impressive, but I was disappointed (but not particularly surprised) to see no mention of the ethics involved in using this sort of project - in either the GitHub issues or the README/docs. This seems like a great tool for stalking people; particularly the recursive functionality (for tying identifiers together). I'm not saying the world is worse-off due to the release of software like this - i…

Ethics plays no part in this reality. The term 'ethics' is only ever used to justify the unethical, eg ethics committees find that it is fine to use embryos in science. It is about applying the veneer of morality over the top.

Ethical decisions are down to the individual.

Unfortunately, lots of people think ethics is what the law allows, or what government says, or even what teachers teach. Most individuals don't take the time to realise or uncover and then act upon the ethics they have innately - aka following one's heart/conscience.

Worse still, many paychecks depend upon the unethical, so don't expect any critical introspection or changes soon.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#93

Post by vintermann »

EdwardDiego wrote: post #74
bityard wrote: post #55

Earlier quoted context omitted.

Software like this _already_ exists. Credit bureaus, advertising firms, data brokers, skip trace databases, three-letter agencies across the globe, and nearly all of the Big Tech companies do their business building centralized profiles of basically everyone and that certainly includes correlating online identities. The only difference here is that one is more limited and open source. "Privacy is dead, get over it."

Sure, but none of them are readily available to someone you argued with on /r/politics who has taken agin you.

So, the question is: are you more afraid of random nobodies online, or are you more afraid of already organized, already powerful people who had similar capability already?

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#94

Post by ohgodplsno »

JustHiThere wrote: post #91
motoxpro wrote: post #20

Earlier quoted context omitted.

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

Wrong approach imho. This means, all the tools developed for ethical hacking are "bad" because they can used for "bad". This is like saying we shouldn't sell knifes because knifes can be used to kill someone. It's just silly. This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc ...

A knife has many uses, from cutting wood to stabbing people. This tool is very much specialized in the stabbing (not necessarily people, as you said, you could stab a ballistic dummy to see the damage it does). Do you really a think a stab-only knife should be sold with no background checks, with no tracking of who buys it ?

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#95

Post by wruza »

rtev wrote: post #58
mod wrote: post #37

Earlier quoted context omitted.

I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves. It will be used for many reasons, but the stalking is the most obvious. Not all of my usernames are as resistant as this one, unfortunately.

Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?

If this wasn’t on GitHub, we wouldn’t be aware of it

The more availability this type of tool has, the less professional its users are. As a result, while it makes easier for you to see what “they” can see about you, “they” become much more personal and bitchy than credit bureaus or ads companies who already have it. E.g. a credit bureau would never sell your comments or “private preferences” to your boss to step over you in career. It increases attack vectors enormously.

Is blissful ignorance better?

It is in this case, I believe. It’s like spreading free covert time-travel-enabled surveillance devices among general public. Someone will pat it onto your back just for dark fun.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#96

Post by INTPenis »

I've been fantasizing about something like this for years.

But my idea was more along the lines of supporting API keys for many different sites, taking your time to configure all these API settings for all these different "site scraping engines" and that would give you the activity of someone you might be tracing. Their comments, their posts and so forth.

I was thinking this would be great for snooping employers who want to know what their WFH employees are up to.

Funny enough I was even imagining support for Steam, and friend request coming from these robots that in rare cases you could even see live as an employee started playing a game.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#97

Post by [deleted] »

vintermann wrote: post #93
EdwardDiego wrote: post #74

Earlier quoted context omitted.

Sure, but none of them are readily available to someone you argued with on /r/politics who has taken agin you.

So, the question is: are you more afraid of random nobodies online, or are you more afraid of already organized, already powerful people who had similar capability already?

[deleted]

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#98

Post by vincnetas »

This just made me think about treating both username and password fields as "put random strings here and let password manager remember them".

And then give a nickname for account in password manager. And communicate your username to your friends through other channels if you need to.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#99

Post by vosper »

jbm wrote: post #41

I took a look at my own user names and it's pretty obvious that the results here are mostly worthless. So many people with empty blogs and the same user name. Unless the blog is auto-created, I don't see the point. I do find all the .ru tags to be concerning. I can imagine out-of-touch security types at Paypal deciding to sanction me based on it without any recourse.

Yeah I've seen a similar tool fail hard on any wiki site that returns a placeholder page for any username whether or not it actually exists. I've never seen anything except 95% false positives, which is so many that after a few runs you just ignore the tool.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#100

Post by ohgodplsno »

AdmiralAsshat wrote: post #15

Seems incredibly prone to false positives. For example, I can guarantee that I'm not the AdmiralAsshat on Reddit, Gmail, or Twitter, because that username was already taken by the time I tried to sign up for them.

I'm more surprised by the fact that people have used my standard username on not just one, but three porn sites, and that I am now a 31 year old camgirl from Thailand, a 36 year old man from Norfolk looking for love and a 31 year old man from South Africa.
Post reply on HN