6 ms·

One thing I've always wondered about these types of anonymous "Internet famous" people: How are they not instantly outed by someone who works for any of the pro

One thing I've always wondered about these types of anonymous "Internet famous" people: How are they not instantly outed by someone who works for any of the providers in between their Twitter client and the readers? Are they all taking extremely careful steps to use things like Tor and anonymous email to prevent the process of tweeting from leaving a trail of bits anyone with access can see?

betenoire 11y ago
would it be worth risking your job? for what?
patio11 11y ago
If your adversary is a Twitter employee, you graph "Payoff for 'outing' vs. likelihood of being fired" and come to the conclusion that no Twitter employee has cared enough. If your adversary is substantially better resourced than a Twitter employee or would not suffer equivalent costs (e.g. if your adversary is law enforcement), assume the inevitability of compromise. An interesting question is "How would you rate the ability of e.g. investigative journalists on this score?", to which I answer "Equivalent to their ability to ask someone in their social circle to tell them what the answer is."
- hkmurakami 11y ago
  I'd add that the potential is worse than just getting fired. This could cause a fall in the stock price and a subsequent lawsuit.
  - azernik 11y ago
    Those probably don't hit the employee themselves; those hit the company. Classic principal-agent problem.
    - nostrademons 11y ago
      Companies will often sue for the difference. If random company X employee doxes a client of X, and then the market cap of X falls by $Y on the news and consequence loss of trust, company X has a pretty good case that financial damages of $Y are warranted through the actions of the employee's breach of contract. Chances are, the employee has nowhere close to $Y in assets, but will settle for $Z << $Y to avoid having a huge lawsuit with the potential to garnish many years worth of wages hanging over their head. Many people who might think that the risk of being fired is worth having the inside scoop on a story might reconsider when the threat is a lawsuit from Google/Facebook/Twitter.
    - briandear 11y ago
      Although given the value of Twitter stock bonuses and options a stock price hit does matter.
- gregmac 11y ago
  Not just fired though: if they either didn't do it anonymously, or someone outed the outer, they'd be putting future job prospects in jeopardy as well. The story about them doing this will quickly shoot to the top of search results for their name, and probably stick with them forever. Who wants to hire someone who is infamous for violating their previous company's privacy policy and abusing their access privilege? Who wants to stay on as a customer of a company where that person now works?
- mdpopescu 11y ago
  no Twitter employee has cared enough True, but the danger is not only with large enemies. I have had the network admin of my internet provider read my emails because he was bored. I know because we later became friends and he told me about it - with proof. (This was before gmail and everything-important-is-on-ssl.) I also come live in a country where "government employees are reading your emails" is up there with "the water is wet", so large enemies are pretty much assumed to know everything they care to know.
ejcx 11y ago
Not sure about other twitter famous anonaccounts, but @SwiftOnSecurity for example, used to have their real account pointed at SwiftOnSecurity, saying that he was the person managing it. Now SwiftOnSecurity is so huge people who remember/know this don't really talk about it. I imagine a lot of these things that blow up start like SwiftOnSecurity and then the person realizes "I'm kind of getting a lot of visibility. It could really help me but it could really hurt me. Maybe I should keep this separate from myself". Beyond basic opsec of keeping your mouth shut, nothing is really necessary...
pbreit 11y ago
Seems like it would be pretty easy to remain anonymous enough to Twitter employees without even using Tor, etc.
rcurry 11y ago
It's pretty easy to stay anonymous if you're just doing something for comedy and not breaking the law - use a dedicated laptop for your fake persona, only post from random public wifi connections and you're done. You might want to throw in a bit of sanitizing with respect to the linguistic analysis side, but generally speaking if you use a clean laptop and a random public connection it will be very difficult for anyone to out you.
- jonnathanson 11y ago
  From a technical standpoint, yes. From a behavioral/social standpoint, a motivated investigator can always find some patterns to work with. Maybe not sufficient patterns, but enough to start making educated deductions.
sulam 11y ago
Speaking entirely for myself, it never occurred to me to do that, and if it had I have to say that it's immediately self-evidently that it would be wrong to do. Twitter has repeatedly gone to bat to protect people who are the targets of major governments, including suing the US government. SLJ (whoever he is) is due the same treatment anyone else on Twitter has. To use your power as an employee to out him when you're fighting court orders asking you to reveal the identity of other accounts would be the height of hypocrisy. This is very similar to the strange (to me) idea that people wouldn't use GMail because they're worried Google will steal their corporate secrets. Seriously? There would be riots in Mountain View if anything like that ever happened...
jameshart 11y ago
I'm struggling to figure out what 'trail of bits' you think would be obviously and easily pulled together by an individual somewhere in the twitter infrastructure. I guess maybe someone who has access to activity analytics could maybe connect accesses to the anonymous account to accesses to another account from the same client. I suppose Twitter's teams who investigate malicious accounts probably have tools for connecting sockpuppets to their masters, which could be brought to bear. But it seems unlikely to me that the pool of people who have access to the tools and data to do this is very large, or that that group of people would not be subject to careful oversight to make sure their privileges are not being abused. The risk that people with this level of access will be approached by journalists offering cash for insight into celebrities (e.g. who is Justin Bieber DMing?) means you'd have to put controls around it.

betenoire 11y ago

would it be worth risking your job? for what?

patio11 11y ago

If your adversary is a Twitter employee, you graph "Payoff for 'outing' vs. likelihood of being fired" and come to the conclusion that no Twitter employee has cared enough. If your adversary is substantially better resourced than a Twitter employee or would not suffer equivalent costs (e.g. if your adversary is law enforcement), assume the inevitability of compromise. An interesting question is "How would you rate the ability of e.g. investigative journalists on this score?", to which I answer "Equivalent to their ability to ask someone in their social circle to tell them what the answer is."

hkmurakami 11y ago
I'd add that the potential is worse than just getting fired. This could cause a fall in the stock price and a subsequent lawsuit.
- azernik 11y ago
  Those probably don't hit the employee themselves; those hit the company. Classic principal-agent problem.
  - nostrademons 11y ago
    Companies will often sue for the difference. If random company X employee doxes a client of X, and then the market cap of X falls by $Y on the news and consequence loss of trust, company X has a pretty good case that financial damages of $Y are warranted through the actions of the employee's breach of contract. Chances are, the employee has nowhere close to $Y in assets, but will settle for $Z << $Y to avoid having a huge lawsuit with the potential to garnish many years worth of wages hanging over their head. Many people who might think that the risk of being fired is worth having the inside scoop on a story might reconsider when the threat is a lawsuit from Google/Facebook/Twitter.
  - briandear 11y ago
    Although given the value of Twitter stock bonuses and options a stock price hit does matter.
gregmac 11y ago
Not just fired though: if they either didn't do it anonymously, or someone outed the outer, they'd be putting future job prospects in jeopardy as well. The story about them doing this will quickly shoot to the top of search results for their name, and probably stick with them forever. Who wants to hire someone who is infamous for violating their previous company's privacy policy and abusing their access privilege? Who wants to stay on as a customer of a company where that person now works?
mdpopescu 11y ago
no Twitter employee has cared enough True, but the danger is not only with large enemies. I have had the network admin of my internet provider read my emails because he was bored. I know because we later became friends and he told me about it - with proof. (This was before gmail and everything-important-is-on-ssl.) I also come live in a country where "government employees are reading your emails" is up there with "the water is wet", so large enemies are pretty much assumed to know everything they care to know.

ejcx 11y ago

Not sure about other twitter famous anonaccounts, but @SwiftOnSecurity for example, used to have their real account pointed at SwiftOnSecurity, saying that he was the person managing it. Now SwiftOnSecurity is so huge people who remember/know this don't really talk about it. I imagine a lot of these things that blow up start like SwiftOnSecurity and then the person realizes "I'm kind of getting a lot of visibility. It could really help me but it could really hurt me. Maybe I should keep this separate from myself". Beyond basic opsec of keeping your mouth shut, nothing is really necessary...

pbreit 11y ago

Seems like it would be pretty easy to remain anonymous enough to Twitter employees without even using Tor, etc.

rcurry 11y ago

It's pretty easy to stay anonymous if you're just doing something for comedy and not breaking the law - use a dedicated laptop for your fake persona, only post from random public wifi connections and you're done. You might want to throw in a bit of sanitizing with respect to the linguistic analysis side, but generally speaking if you use a clean laptop and a random public connection it will be very difficult for anyone to out you.

jonnathanson 11y ago
From a technical standpoint, yes. From a behavioral/social standpoint, a motivated investigator can always find some patterns to work with. Maybe not sufficient patterns, but enough to start making educated deductions.

sulam 11y ago

Speaking entirely for myself, it never occurred to me to do that, and if it had I have to say that it's immediately self-evidently that it would be wrong to do. Twitter has repeatedly gone to bat to protect people who are the targets of major governments, including suing the US government. SLJ (whoever he is) is due the same treatment anyone else on Twitter has. To use your power as an employee to out him when you're fighting court orders asking you to reveal the identity of other accounts would be the height of hypocrisy. This is very similar to the strange (to me) idea that people wouldn't use GMail because they're worried Google will steal their corporate secrets. Seriously? There would be riots in Mountain View if anything like that ever happened...

jameshart 11y ago

I'm struggling to figure out what 'trail of bits' you think would be obviously and easily pulled together by an individual somewhere in the twitter infrastructure. I guess maybe someone who has access to activity analytics could maybe connect accesses to the anonymous account to accesses to another account from the same client. I suppose Twitter's teams who investigate malicious accounts probably have tools for connecting sockpuppets to their masters, which could be brought to bear. But it seems unlikely to me that the pool of people who have access to the tools and data to do this is very large, or that that group of people would not be subject to careful oversight to make sure their privileges are not being abused. The risk that people with this level of access will be approached by journalists offering cash for insight into celebrities (e.g. who is Justin Bieber DMing?) means you'd have to put controls around it.