7 ms·

Can someone please explain how doxing works at a technical level? Suppose I post something on Twitter or Youtube that someone does not like how would they dox m

by hi41 6y ago

Can someone please explain how doxing works at a technical level? Suppose I post something on Twitter or Youtube that someone does not like how would they dox me? For example, CNN outed a guy who did a video where Trump bashes a guy superimposed with CNN in a boxing ring. Wouldn't such attempts at doxing people also put pressure on their freedom of speech and expression?

ceejayoz 6y ago
It's very difficult to not leave breadcrumbs. Maybe your personal blog had your name, address, and phone number on it back in the 1990s and there's a record of that. Maybe you made one post six months back on your main account instead of your throwaway. Maybe you've inadvertently given enough details for someone to narrow it down. One mistake is all that's needed. For example, Mitt Romney's secret Twitter account was found from just a few bits of info. https://slate.com/news-and-politics/2019/10/mitt-romney-has-a-secret-twitter-account-and-it-sure-looks-like-its-this-one.html https://slate.com/news-and-politics/2019/10/mitt-romney-has-... > “That’s kind of what he does,” Romney said with a shrug, and then got up to retrieve an iPad from his desk. He explained that he uses a secret Twitter account—“What do they call me, a lurker?”—to keep tabs on the political conversation. “I won’t give you the name of it,” he said, but “I’m following 668 people.” Swiping at his tablet, he recited some of the accounts he follows, including journalists, late-night comedians (“What’s his name, the big redhead from Boston?”), and athletes. Trump was not among them. “He tweets so much,” Romney said, comparing the president to one of his nieces who overshares on Instagram. “I love her, but it’s like, Ah, it’s too much.”
- rwmj 6y ago
  Reminds me of a favourite gwern post about how many bits of information there are that make you unique: https://www.gwern.net/Death-Note-Anonymity https://www.gwern.net/Death-Note-Anonymity Even analysing what times of day you post can narrow you down a lot.
floren 6y ago
> Suppose I post something on Twitter or Youtube that someone does not like how would they dox me? Basically it's all about linking internet presences to, eventually, real-world information. Lots of people use the same username across different sites. Suppose I get mad about a video you post on Youtube, so I google "hi41" and find your Twitter. I don't find anything personally identifiable on there, but then I reverse image-search a vacation picture you posted and I find your instagram, which is under your real name. Now I've got your real name, which is a powerful thing to drop on someone who thinks they're anonymous.
sp332 6y ago
If you want to look for techniques, there are lots under the umbrella of OSINT. It stands for Open Source Intelligence, but it doesn't refer to open-source as in software. It just means the sources of information are public instead of being secret. Sometimes you can just Google the person's username, or check the WHOIS records on their website.
TechBro8615 6y ago
The title is misleading. He was not doxed. People have known who he is for a long time. The “outed” is referring to the fact that someone compiled a list of the small number of moderators that moderate a large number of subreddits, and gallowboob was on the list.
TheCapn 6y ago
There's not a whole lot of technicality to it imo. Say I take to google and start looking for your username. Will other websites turn up? Will one of them have a link to an email address of yours? Can I take that email address and find something else you've done? Perhaps you've used your real name and I can Google that to find info about you. Maybe you've said something in comments that hints to an identity. Who is your employer? What is your line of work and the city you reside in? Basically... how much effort does it take from me scouring your public profile before I can narrow down who you are with that info? People have built tools into reddit that does that automatically by pulling all the user comments then looking for info about the person they've shared. The technical side that GallowBoob talks a bit about in the article is people engaging them in conversation and trying to get them to click a link to some site. If he was to click that link they'd have the IP he connected from and would probably start running hacker tools to try and find a vulnerability in his network.
markstos 6y ago
It doesn't have to be that technical. People search for references that connect your username with a real name and possibly a location. If there is only one person with your name in your town, then your home address and likely phone number can be derived from there. No hacking skills required there, just researching. If you send the target a link and they click on it and you control the server, you can find the IP address use to click on it and aren't using a VPN. Home IP addresses don't change often, so with the IP address you have another bit of information that can searched on. This might lead to a second username associated with the IP address. Sometimes simply paying attention to the content they post reveals a lot. Once on a Reddit someone posted a "Guess what state this photo is from" post. It could have been from many places, but I checked out his profile and all of his posts from the same place in Pennsylvania, so I guessed that. He seemed amazed that anyone guessed so fast, but also unaware how the other content he posted made it very easy to fill in the blank. Also, many people aren't trying that hard to hide, because they don't expect that anyone to put any effort into "outting" them.
- ceejayoz 6y ago
  > Also, many people aren't trying that hard to hide, because they don't expect that anyone to put any effort into "outting" them. On top of that, people who are trying to hide now may have a decade or two of not trying to hide in their Internet history.
polytely 6y ago
There are tons of examples of how 4chan routinely traced down individuals based on little evidence. For more recent examples see bellingcat.com it's amazing how far you can go with just open sources and a lot of determination. It also helps to have multiple people do the searching, if like a 100 people would trawl through your posting history here they could probably create a pretty detailed profile of you. For example, on my hackernews profile I link to my mastodon handle. If you would go through my mastodon posting history you would see that I occasionally post links to YouTube music videos I like, I also occasionally post comments under YouTube videos under my real name. If you took all videos I've ever posted to mastodon in like a 2-year period, and compared the comments you could probably find out what my real name is. It would take some hours of menial work, but it's pretty straightforward.
- Shorel 6y ago
  I wish TV show writers knew these things. It would be educative and more entertaining than the hacking stuff they write.
  - ceejayoz 6y ago
    Mr. Robot's writers knew this.
    - Shorel 6y ago
      Such a great show.
  - shigawire 6y ago
    The show Mr Robot kind of does this. While there is "hacking", they make a point to have the main character explain most of what people think of as "hacking" accounts is just social engineering.

by hi41 6y ago

ceejayoz 6y ago

It's very difficult to not leave breadcrumbs. Maybe your personal blog had your name, address, and phone number on it back in the 1990s and there's a record of that. Maybe you made one post six months back on your main account instead of your throwaway. Maybe you've inadvertently given enough details for someone to narrow it down. One mistake is all that's needed. For example, Mitt Romney's secret Twitter account was found from just a few bits of info. https://slate.com/news-and-politics/2019/10/mitt-romney-has-a-secret-twitter-account-and-it-sure-looks-like-its-this-one.html https://slate.com/news-and-politics/2019/10/mitt-romney-has-... > “That’s kind of what he does,” Romney said with a shrug, and then got up to retrieve an iPad from his desk. He explained that he uses a secret Twitter account—“What do they call me, a lurker?”—to keep tabs on the political conversation. “I won’t give you the name of it,” he said, but “I’m following 668 people.” Swiping at his tablet, he recited some of the accounts he follows, including journalists, late-night comedians (“What’s his name, the big redhead from Boston?”), and athletes. Trump was not among them. “He tweets so much,” Romney said, comparing the president to one of his nieces who overshares on Instagram. “I love her, but it’s like, Ah, it’s too much.”

rwmj 6y ago
Reminds me of a favourite gwern post about how many bits of information there are that make you unique: https://www.gwern.net/Death-Note-Anonymity https://www.gwern.net/Death-Note-Anonymity Even analysing what times of day you post can narrow you down a lot.

floren 6y ago

> Suppose I post something on Twitter or Youtube that someone does not like how would they dox me? Basically it's all about linking internet presences to, eventually, real-world information. Lots of people use the same username across different sites. Suppose I get mad about a video you post on Youtube, so I google "hi41" and find your Twitter. I don't find anything personally identifiable on there, but then I reverse image-search a vacation picture you posted and I find your instagram, which is under your real name. Now I've got your real name, which is a powerful thing to drop on someone who thinks they're anonymous.

sp332 6y ago

If you want to look for techniques, there are lots under the umbrella of OSINT. It stands for Open Source Intelligence, but it doesn't refer to open-source as in software. It just means the sources of information are public instead of being secret. Sometimes you can just Google the person's username, or check the WHOIS records on their website.

TechBro8615 6y ago

The title is misleading. He was not doxed. People have known who he is for a long time. The “outed” is referring to the fact that someone compiled a list of the small number of moderators that moderate a large number of subreddits, and gallowboob was on the list.

TheCapn 6y ago

There's not a whole lot of technicality to it imo. Say I take to google and start looking for your username. Will other websites turn up? Will one of them have a link to an email address of yours? Can I take that email address and find something else you've done? Perhaps you've used your real name and I can Google that to find info about you. Maybe you've said something in comments that hints to an identity. Who is your employer? What is your line of work and the city you reside in? Basically... how much effort does it take from me scouring your public profile before I can narrow down who you are with that info? People have built tools into reddit that does that automatically by pulling all the user comments then looking for info about the person they've shared. The technical side that GallowBoob talks a bit about in the article is people engaging them in conversation and trying to get them to click a link to some site. If he was to click that link they'd have the IP he connected from and would probably start running hacker tools to try and find a vulnerability in his network.

markstos 6y ago

It doesn't have to be that technical. People search for references that connect your username with a real name and possibly a location. If there is only one person with your name in your town, then your home address and likely phone number can be derived from there. No hacking skills required there, just researching. If you send the target a link and they click on it and you control the server, you can find the IP address use to click on it and aren't using a VPN. Home IP addresses don't change often, so with the IP address you have another bit of information that can searched on. This might lead to a second username associated with the IP address. Sometimes simply paying attention to the content they post reveals a lot. Once on a Reddit someone posted a "Guess what state this photo is from" post. It could have been from many places, but I checked out his profile and all of his posts from the same place in Pennsylvania, so I guessed that. He seemed amazed that anyone guessed so fast, but also unaware how the other content he posted made it very easy to fill in the blank. Also, many people aren't trying that hard to hide, because they don't expect that anyone to put any effort into "outting" them.

ceejayoz 6y ago
> Also, many people aren't trying that hard to hide, because they don't expect that anyone to put any effort into "outting" them. On top of that, people who are trying to hide now may have a decade or two of not trying to hide in their Internet history.

polytely 6y ago

There are tons of examples of how 4chan routinely traced down individuals based on little evidence. For more recent examples see bellingcat.com it's amazing how far you can go with just open sources and a lot of determination. It also helps to have multiple people do the searching, if like a 100 people would trawl through your posting history here they could probably create a pretty detailed profile of you. For example, on my hackernews profile I link to my mastodon handle. If you would go through my mastodon posting history you would see that I occasionally post links to YouTube music videos I like, I also occasionally post comments under YouTube videos under my real name. If you took all videos I've ever posted to mastodon in like a 2-year period, and compared the comments you could probably find out what my real name is. It would take some hours of menial work, but it's pretty straightforward.

Shorel 6y ago
I wish TV show writers knew these things. It would be educative and more entertaining than the hacking stuff they write.
- ceejayoz 6y ago
  Mr. Robot's writers knew this.
  - Shorel 6y ago
    Such a great show.
- shigawire 6y ago
  The show Mr Robot kind of does this. While there is "hacking", they make a point to have the main character explain most of what people think of as "hacking" accounts is just social engineering.