Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maigret: Collect a dossier on a person by username from thousands of sites

github.com

Post reply on HN
Print view View original

181–190 of 203 posts

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#181

Post by nvr219 »

marginalia_nu wrote: post #166
quetzthecoatl wrote: post #160

Earlier quoted context omitted.

because if you get your account compromised on one site/forum because of lax security on their end, you don't want all your accounts compromised.

How will your accounts be compromised if they are all different? A key is no good if you don't know which lock it leads to.

Because it might be tied back to your email account or some other common denominator. Using different usernames is good for dox attacks like this but doesn't necessarily help you if your email is compromised. So you need different passwords (AND MFA!!!!)

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#182

Post by epakai »

dymk wrote: post #30
walrus01 wrote: post #4

This also seems like a useful tool for hunting down sockpuppet and nation-state sponsored astroturfing campaigns.

Those accounts seem the most likely to be randomly named per-site. Why would they reuse a username?

Sometimes a persona might be created to establish rapport. It's probably pretty rare because of the extra effort isn't commensurate with with returns.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#183

Post by MonkeyClub »

c7b wrote: post #140
smeagull wrote: post #25

Earlier quoted context omitted.

You always need to balance Precision and Recall. For something like this, you want to be exhaustive. I've worked on search engines, and depending on who is using them, that balance gets struck differently on the ROC curve. For legal matters, for example, they want every record that might match. For ad-hoc (google style) queries, nobody reads the second page so you care more about Precision @ 20 (or really, at 3)

> You always need to balance Precision and Recall. For something like this, you want to be exhaustive. Respectfully disagree. You're right in principle if you build a tool like that for yourself. But since this is Open Source, you have to take into account that people who don't understand that will use the tool as well and then use that as "evidence" in whatever arguments they're having with someone.

Frankly,

> But since this is Open Source,

You can add the functionality you would like it to have, and share with the others.

For more fine tuned solutions, there is always a DoD contractor available near you :-)

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#184

Post by rtev »

archevel wrote: post #70
rtev wrote: post #58

Earlier quoted context omitted.

Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?

I think the argument is more that this tool by virtue of being easily accessible creates more malicious actors. Similar to how most people wouldn't steal a locked bike, but a larger portion would steal an unlocked one. It isn't that much harder to steal a locked bike vs an unlocked one, but the threshold is just a tiny bit higher so more people will attempt it. Conversely this tool lowers the threshold for stalking,…

Assuming your online identity is secure by obscurity is not a realistic option. If all it takes is a flashlight for everyone to become “vulnerable”, we need to just assume the light is always on. Someone handing out flashlights just highlights the bigger problem.

If this truly causes worry, adopt better opsec and create generative usernames for different sites. If not, assume anyone will easily be able to link your bowel issue subreddit comments to your LinkedIn profile.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#186

Post by marginalia_nu »

nvr219 wrote: post #181
marginalia_nu wrote: post #166

Earlier quoted context omitted.

How will your accounts be compromised if they are all different? A key is no good if you don't know which lock it leads to.

Because it might be tied back to your email account or some other common denominator. Using different usernames is good for dox attacks like this but doesn't necessarily help you if your email is compromised. So you need different passwords (AND MFA!!!!)

What if I use more than one email?

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#187

Post by rtev »

wruza wrote: post #95
rtev wrote: post #58

Earlier quoted context omitted.

Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?

If this wasn’t on GitHub, we wouldn’t be aware of it The more availability this type of tool has, the less professional its users are. As a result, while it makes easier for you to see what “they” can see about you, “they” become much more personal and bitchy than credit bureaus or ads companies who already have it. E.g. a credit bureau would never sell your comments or “private preferences” to your boss to step over…

The actual fix is to not reuse usernames. Does distributing password stuffing tools increase the ease of password stuffing? Yes. Is that the problem? No - people reusing passwords is the problem.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#188

Post by wruza »

rtev wrote: post #187
wruza wrote: post #95

Earlier quoted context omitted.

If this wasn’t on GitHub, we wouldn’t be aware of it The more availability this type of tool has, the less professional its users are. As a result, while it makes easier for you to see what “they” can see about you, “they” become much more personal and bitchy than credit bureaus or ads companies who already have it. E.g. a credit bureau would never sell your comments or “private preferences” to your boss to step over…

The actual fix is to not reuse usernames. Does distributing password stuffing tools increase the ease of password stuffing? Yes. Is that the problem? No - people reusing passwords is the problem.

It doesn’t work retrospectively. You either start a new web life or live under a risk of accidentally exposing or linking to one of your already vulnerable accounts.

Also, if we don’t raise issues like this, the next actual fix will be “don’t reuse writing styles and vocabularies on different sites”.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#189

Post by jhugo »

voakbasda wrote: post #172
jhugo wrote: post #153

Earlier quoted context omitted.

Isn't it obvious just from reading one sentence about what it does? As it clearly says, it's based on username only, so multiple people's results may be mixed in the dossier if they share a username. We don't need a disclaimer for every thing that a moment's thought can reveal.

The people that use this tool to dig up dirt on someone will love to see a mixed bag, because it could be useful to cast shade on their actual target. This tool will be abused on purpose.

That makes no sense. They could just make stuff up, it wouldn't be any more or less believable.

Re: Maigret: Collect a dossier on a person by username from thousands of sites

#190

Post by jhugo »

voakbasda wrote: post #171
c7b wrote: post #159

Earlier quoted context omitted.

the thing is, people who want to use this for defamation don't have an incentive to sanitize the data - the message might stick around regardless of whether it has any merit (we've seen this happening even at the most publicly scrutinized national level, imagine how much fewer defenses smaller players have)

Defamation is definitely one problem with this tool. Once there is “evidence”, it can be (ab)used without consequence by someone, because they can simply point at the tool output. If the output is usually “good enough”, it will provide an alibi for their actions: “I didn’t make a mistake, the computer did.”

Nobody who bothers to check what the tool does will be swayed by this. If someone wants to make shit up, and their audience will not bother to spend 30 seconds looking at their "sources", they could just write a script that outputs whatever they wanted and then point at that script.
Post reply on HN