Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Advanced Denanonymization through Strava

steveloughran.blogspot.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Advanced Denanonymization through Strava

#31

Post by fortythirteen »

abcd_f wrote: post #7

This is neither advanced nor denanonymization (sic). They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means. It's also not a deanonymization as there's really no option in Strava for public _anonymous_…

The best hacks always appear overly simple, or even slightly benign, once explained.

You could potentially use the hack the author explained with one of those possible black-sites in Africa to see who's deployed there. A little more research and you can find their home address in the states. Now, tell me an enterprising counter-intel or terrorist organization wouldn't want that info.

Re: Advanced Denanonymization through Strava

#32

Post by jarito »

nradov wrote: post #23
abcd_f wrote: post #7

This is neither advanced nor denanonymization (sic). They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means. It's also not a deanonymization as there's really no option in Strava for public _anonymous_…

Unlike Facebook, Strava has no "real name" policy so you can be as anonymous as you want.

This doesn't really seem to be enough. The combination of home / work location and friends is likely enough to allow for the determination of identity, even if you use a fake name on the site.

Re: Advanced Denanonymization through Strava

#33

Post by nmeofthestate »

I find it hilarious that this guy outlines his cloak-and-dagger tactics to avoid people tracking down his bike via Strava, and then as an aside he mentions the time his bike actually got nicked was when a drug addict accessed it through an unlocked door. That never happened to Jason Bourne.

Re: Advanced Denanonymization through Strava

#34

Post by wallace_f »

maxerickson wrote: post #30
wallace_f wrote: post #21

Earlier quoted context omitted.

This is a good example to bring up when people talk about a digital bill of rights. It fundamentally shouldn't be so easy to undermine individual privacy and military op sec, but when you allow private data to be shared recklessly, you get that.

Individual privacy is the issue. Op sec is the military's problem.

I agree, but what I'm saying is that it's not at all "advanced deanonymization" skills that's a problem. It's the default standars way we share data is capable of undermining privacy, and even military op sec, quite easily, that needs to be changed.

Re: Advanced Denanonymization through Strava

#35

Post by thaumaturgy »

Strava is the first social network I want to be a part of. It promises to help me find activity partners that can help keep me motivated on the days where I'm finding it more difficult than usual to get on the pedals or put on the running shoes. Unlike most others, it might help me feel happier and healthier. I have to accept some loss of privacy for the sake of crawling out of a hole and having an automated system help me meet other folks.

And as he admits, you're far more likely to lose your bike to a combination of a moment of carelessness and an opportunistic thief than someone that's surveilling you through your social network activity.

It's a little ironic too that he's writing about the dangers of deanonymization while providing enough information in his post to figure out his Strava username and approximate location.

Re: Advanced Denanonymization through Strava

#36

Post by nradov »

jarito wrote: post #32
nradov wrote: post #23

Earlier quoted context omitted.

Unlike Facebook, Strava has no "real name" policy so you can be as anonymous as you want.

This doesn't really seem to be enough. The combination of home / work location and friends is likely enough to allow for the determination of identity, even if you use a fake name on the site.

It's easy to set privacy zones around home, work, or any other location. And you're not required to have any friends (followers). Activities can also be hidden from the public and made visible only to followers.

Re: Advanced Denanonymization through Strava

#37

Post by macintux »

nradov wrote: post #36
jarito wrote: post #32

Earlier quoted context omitted.

This doesn't really seem to be enough. The combination of home / work location and friends is likely enough to allow for the determination of identity, even if you use a fake name on the site.

It's easy to set privacy zones around home, work, or any other location. And you're not required to have any friends (followers). Activities can also be hidden from the public and made visible only to followers.

The author covered privacy zones and hidden activities. Neither are as secure as one would hope: privacy zones can be reverse-engineered fairly easily, and private activities can still be leaked.

Re: Advanced Denanonymization through Strava

#39

Post by dawhizkid »

abcd_f wrote: post #7

This is neither advanced nor denanonymization (sic). They basically pluck an interesting route from the hotmap (as per other people's recent discovery), pretend that they have also run/biked this route and Strava will show them names of others who run/biked the same way. That's clever, but that's not "advanced" by any means. It's also not a deanonymization as there's really no option in Strava for public _anonymous_…

I wonder why Uber/Lyft/Waze don't have a feature like this for ridesharing. Seems like it would be useful to find commuters going on the same commute each day.

Re: Advanced Denanonymization through Strava

#40

Post by irl_zebra »

thaumaturgy wrote: post #35

Strava is the first social network I want to be a part of. It promises to help me find activity partners that can help keep me motivated on the days where I'm finding it more difficult than usual to get on the pedals or put on the running shoes. Unlike most others, it might help me feel happier and healthier. I have to accept some loss of privacy for the sake of crawling out of a hole and having an automated system h…

Same here, I’ve been a premium member for many years, and a user for about five years. It’s one of the few services I happily pay for, along with Spotify and Netflix.

I have friends on there, and have added people I’ve seen on workouts. The latter is especially common with group bike rides. You get to know each other and people comment on each other’s workouts. If you have a bad workout, people will chime in and give support, same for a particularly good workout. Also neat to see where friends are running or new routes they’ve done lately. It’s also fun to try to get new course records, or KOMs if cycling (the running equivalent of a running course record). Strava has been in the news a lot in the years since I’ve been using it on fitness (running, cycling, triathlon) forums because occasionally someone will do something dangerous in an attempt to get a course record, like running red lights through a busy intersection, and blame strava. There has also been once or twice I did see theft of very expensive bikes in the news from strava data.

It isn’t what keeps me running, or cycling, but it’s a definite motivator. I’m happy to be a part of the community and happy to pay for premium, though I don’t use that many premium features. I do love the personal heat map premium feature though, it’s basically what this news article is about, but just your workouts. It makes me actively try to fill out more of the city on my heatmap.

Post reply on HN