6 ms·
> Most of the core team had been operating under false identities, used anonymization tools and been very careful with operational security. > All of a sudden
by powertower 11y ago
> Most of the core team had been operating under false identities, used anonymization tools and been very careful with operational security.
> All of a sudden all the developers discovered simultaneously that a lawyer from the film studio Warner Bros. had visited their professional LinkedIn pages.
Are there any details about how the Warner Bros. lawyer was able to find the developers?
Sounds like a story of it's own, bigger than this one.
- objclxt 11y ago> Sounds like a story of it's own, bigger than this one. I think the key word you're overlooking is "most", as in "most of the core team" took steps to be anonymous, not all (steps that, for all we know, may never have worked).
- loganu 11y ago"Most of the core team" anonymous. "All of the developers" being visited on LinkedIn. If it's not sloppy journalism, there's something really interesting about a multi-national company's legal team using (potentially) illegal means in tracking down developers. "– We do not know how, but he had managed to track us. We were quite unsettled. We thought it was a scare tactic. And we were frightened. None of us were anonymous anymore. They knew where we worked, where we lived."
- kachnuv_ocasek 11y agoThere's an adage: “A chain is only as strong as its weakest link.”
- dhimes 11y agoI think kordless has a key insight here: it doesn't say the lawyers visited all of them and only them. The devs may still be fairly anonymous in a big pool of devs that was visited- a dragnet, as it were. We don't know yet.
- loganu 11y agoTrue, but a "dragnet" across (for example) all Argentinian devs with experience in Ruby and React (substitute whatever skills make sense)would have hits outside this small group. If enough people were this scared about LinkedIn visits, they'd likely have friends or colleagues outside the PopcornTime group saying "Oh yeah, he looked at my profile too. Don't worry about it." I'm just saying, I imagine they wouldn't be scared about it if it was a big net fishing for info. Could be sensationalism for the story though.
- FireBeyond 11y ago"really interesting about a multi-national company's legal team using (potentially) illegal means in tracking down developers" Whilst I'm not all about the ethics of multinationals, there is a strong presumption that those 'anonymous' members were anywhere near as thorough as they say or thought they were in not leaving breadcrumbs (witness DPR and Silk Road).
- loganu 11y agoTrue. It's easy to slip, and it only takes one time. From my limited reading, DPR slipped often. But his case doesn't mean individuals can't obscure themselves. Look at Satoshi (Bitcoin). We don't even know 100% for sure if Satoshi is a group or individual.
- dmix 11y agoExpensive laywers hire expensive private investigators who know how to deanonymize people on the internet quite well. Just because Warner Bros is old and stodgy doesn't mean that they don't have access to people with advanced technical skill. In England there have even been P.I. shops used by the wealthy that were shut down for hacking and that was 5+ years ago.
- intopieces 11y agoThey're so advanced in technical skill they didn't think to turn off the feature that tells the user you're snooping on their profile? I use LinkedIn to validate user information and I turned this off immediately.
- dmix 11y agoNote it was the lawyer who went to their Linkedin pages not the P.I. who they hired for technical skill. You can't always save your clients from messing things up.
- Toenex 11y agoUnless the lawyer wanted them to know he was looking. Might make some of the developers nervous.
- onion2k 11y agoIn which case, it might be the case that the lawyer just clicked on thousands of developers hoping to hit the right ones and scare them in to stopping their work on Popcorn Time or doing something to make themselves known.
- devonharvey 11y agoIt may have been intentional, to frighten them. If that was the case, it seemed to have the desired effect.
- benihana 11y ago
- marianov 11y agoNo, they didn't use any serious anon tools. Just posted on a fake name once or twice the first days of the project, but then even included their credits on their twitter bios [example: https://twitter.com/abad https://twitter.com/abad ]
- loganu 11y agoWell, obviously Abad's come out about his involvement. But we don't know that the other devs weren't using any tools earlier. If you know more about this, share it.
- deleted 11y ago[deleted]
- kordless 11y agoIt wouldn't be that hard to ID the skills the devs had to build the product, then scrape Github and LinkedIn for profiles that match those skills. Automate a visit to their page (and a few thousand other devs) and you've managed to spook the few that are actually working on it. I periodically get visits from attorneys to my LinkedIn page, but have done nothing to warrant those visits, at least to my knowledge.
- nathancahill 11y agoMight even be possible to check their Github keys for keys that match other Github accounts.
- dale-cooper 11y agoYou can't use the same key on multiple accounts
- infinite8s 11y agoAre github keys public?
- icebraining 11y agoYes: https://twitter.com/postmodern_mod3/status/300438256200339456 https://twitter.com/postmodern_mod3/status/30043825620033945...
- johnmorales 11y agoI hope you are not putting private keys in github.
- marincounty 11y agoI always wondered why anyone would use their legal name, or even home IP address when using GIT? Especially, if one is doing anything remotely fishy? I have always used a pseudonym on GIT, and all other sites. I tell people, who need to see my work/me, my pseudonym. I guess if I was actively looking for a job I wouldn't be able to be anonymous?
- tdkl 11y agoMy question is that if someone is using false identities while operating this kind of business, why have a LinkedIn (or insert site X with data you don't own) site in the first place?
- chc 11y agoThey probably work on other things for money.
- samstave 11y agoSell outs.
- PhasmaFelis 11y agoThey were using false identities on Popcorn Time and their real identities on LinkedIn.
- differentView 11y agoI don't use LinkedIn, does it tell you who visited your profile? Have other developers been visited by the WB lawyer? Maybe they're just checking all LinkedIn profiles of developers with certain skills.
- samstave 11y agoit will tell you who visited you - but you can turn off your account showing up as a viewer. You set your prefs to show you as anon when you click others' profiles.
- tbomb 11y agoIt does tell you, but you can "anonymize" yourself by selecting an option they have. Then I think you can only see it if you are a paying member. I'm sure there are other ways to find out who viewed you but I don't know of them/don't use it enough to warrant it.
- mirimir 11y agoI'm sure that they were just sloppy. DPR was sloppy, and he was setting up a drug marketplace! That ISIS script kiddie was sloppy too, and now he's dead :) So it goes. Edit: I obviously don't know specifics about what they did to be "anonymous" and how they were deanonymized. But whatever, if they were deanonymized, they didn't properly assess threats, and employ adequate OPSEC. In other words, they were sloppy.
- jqm 11y agoMaybe he went to every developers page he could find. Maybe someone wrote him a script. Sounds like it spooked the developers in question so....