12 ms·

Googling Strangers: One Professor's Lesson on Privacy in Public Spaces (2019)

128 points by ddtaylor 6y ago

jrimbault 6y ago
I confess to having played that game in the subway. Never with bad intention, just bad manners and curiosity on my part.
drooby 6y ago
The internet is also a public place in many ways. If someone overhears my name and sees my face and discovers my personal website or LinkedIn page, then they have only discovered MORE public information about me. There is no privacy breach if I don’t divulge private information on public spaces, i.e the internet.
- jedimastert 6y ago
  I think there needs to be more consciousness that the internet as a whole is a public commons, as public as doing something on the square. It's something I'm going to endeavor to teach my kids when they start interacting with the internet (a thought that already gives me great anxiety)
  - hc-taway 6y ago
    The norm used to be never to post personal info online. Yes, some things could still be found out, and there were still attack vectors, but typing your real name in a web form, except maybe (and only fairly late in the time period I'm talking about) to pay with a CC on a well-known site? LOL no. Posting photos of yourself, and with your name and maybe even a location attached? Madness! Are you nuts!? I'm convinced Zuckerberg's infamous "dumb fucks" comment was made in a state of puzzlement that all these n00bs just had no idea they shouldn't be giving him that info, and indeed, the dawn of Facebook and all the people it added to the set of folks posting information online ended the previous "no-one knows you're a dog" set of norms of the Web. Now there's money tied up in it, so of course people insist they must be able to post all kinds of things under their real names so they can market themselves. Never mind that it remains a terrible idea. This is the source of conflict, I think, between people who want more real names online and those who want none. The former are the new folks who think posting personal info online is normal, or even necessary (see again: personal brand-building and marketing) and believe that we need to be able to ID everyone to prevent abuse (i.e. be able to find abusers to punish them), and the latter are the old-school Web users (post-Eternal-September, pre-Facebook) who don't get why all these idiots are making themselves easy to abuse in the first place, who see more anonymity as the obvious cure.
    - jedimastert 6y ago
      > This is the source of conflict, I think, between people who want more real names online and those who want none. I think there is a space for both, tbh. There is always business based on reputation, and for that you need to self-identify. I used to be a professional gigging musician, and there was absolutely no way to do that while remaining anonymous online, nor would I want to. The difference being, I suppose, was business vs personal, but personal brand was a thing long before the internet (I assume).
- bogwog 6y ago
  > There is no privacy breach if I don’t divulge private information on public spaces, i.e the internet. You also have to keep in mind that you can be publicly divulging things without even realizing it, especially because everything you post online is stored permanently, and tons of private information about you can be extrapolated from it by anyone who bothers to pay attention. It's also insanely profitable, just look at Google and Facebook!
  - asdfasgasdgasdg 6y ago
    For Google, the most profitable thing (to my understanding) is advertisement on product-seeking queries. If you look and a SERP for a privacy-invading search, like Googling someone's name or email address, you'll notice that there are not really so many ads. I tried searching for my real name, my real name with my locale, and my email address. I was able to find an old breached password and I was able to find my home address, but I didn't see any ads. You could argue that this feature provides some halo benefit to Google's more profitable queries, but to be honest it seems like a stretch to me. For Facebook, they make money from advertising to logged in users. Broadly speaking, they keep users logging in by offering users the ability to broadcast private information to friends, and by offering the ability to receive such broadcasts from friends. To the extent FB does invade privacy, they do so to more effectively advertise to users on their site. They don't make the results of that invasion -- the profiles they build from their tracking bits, in other words -- available for public search. What's available for public search is instead only what the users choose to broadcast about themselves. The exposure of private information to public search engines is not what is profitable about either of these companies. It's an incidental effect of the persistence of digital storage and the difficulty of curating what is stored.
deleted 6y ago
[deleted]
intrasight 6y ago
Cool idea for a class project!
possiblelion 6y ago
I think most of us have done something along these lines, whether out of boredom or just curiosity.
deleted 6y ago
[deleted]
sodality2 6y ago
I found it scarily easy to find info on some people. I was talking to my friend about it, so I tested it out on them (with their permission). With just their public facing instagram account handle, I: Found full name from family members in following list -> email, phone #, etc from full name Found email + phone of most of the close family Found address, PO box, and usernames from their past accounts Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!) Found their old wattpad account (!!!!!!) Found out that their instagram had no 2fa and "hijacked it" with them next to me, changed email and password (not sure if they could have recovered it afterwards). Notifications did come through but given their email, I used an email newsletter spammer I made and a text spammer to blow up their phone to hopefully distract for the few minutes it took, to simulate a real attack. Needless to say, it was bad news all around. (I already knew some of the info I found, but my search consisted of me pretending I didn't) Edit: the irony of me posting about data security when I just divulged where I grew up & school district less than 2 weeks ago :'( (though I bet I'm fine given I have no other accounts with this username)
- btown 6y ago
  That "spam distraction" tactic is scary - no doubt it's being used in the wild!
  - sodality2 6y ago
    Surely so! I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.
  - iamacyborg 6y ago
    It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks. https://wordtothewise.com/2016/08/subscription-bombing-esps-spamhaus/ https://wordtothewise.com/2016/08/subscription-bombing-esps-...
0xCMP 6y ago
A lot of conversations around privacy and using encryption would be much easier if those in the conversation understood just how simple and permissionless it is to snoop information and become way more knowledgeable about someone than you should.
caseysoftware 6y ago
I used to do a presentation called "Shattering Secrets with Social Media" where we'd do a "live attack" on a volunteer from the audience. Starting with their name from their badge, we'd see how many of the top 10 security questions we could answer. For most people we could get 4-6 in a matter of minutes. For a select few we could only get 1-2. Despite it all, there were two we could almost never get: street you grew up on and first pet's name. My theory was that those are tied to a time and place that predates social media for many millenials and all gen-x. But there was another approach.. one of those silly threads from years ago was "What is your porn star name?" which required your first pet's name and the street you grew up on. Yes, that was a social engineering attack at scale. And even if you didn't answer it, if you had a sibling roughly the same age, odds are theirs were the same.
- fanatic2pope 6y ago
  One of the benefits of using a password storing app (in my case keepassxc) is that I answer those kinds of secondary questions with random words.
  - lfowles 6y ago
    Isn't the danger now that someone could call into your bank and say "I forgot them exactly, but the answers are just random strings"
    - jakub_g 6y ago
      This issue always come up with those discussions indeed. Probably to be safe you could just come up with plausible unique non-random name, and still store it in keepass. > What's your cat's name? Site X: Kareem Abdul-Jabaar Site Y: Cassius Clay Site Z: Franz Beckenbauer
    - yohannparis 6y ago
      Then there is a clear breach of the terms of services from your bank, and it might be easier to get issue on their hands. But you are right, the best solution would something in between.
underseacables 6y ago
Imagine if we did Google every single person we met, and started a dossier of them with all of the information that we could find and collect about them. That would be a lot of work, but Facebook does it for us.
- falcolas 6y ago
  Now imagine an ITTT-style automation of this collection, so it requires virtually no input from you to have a dossier on almost everyone around you based on their ambient presence. Could even potentially use Facebook et.al. facial recognition. Bundle it up with your Instagram or Google glasses.
  - HDMI_Cable 6y ago
    This is both so scary, and somewhat feasible. I could imagine this database having more information than all of the government ID systems.
- mywittyname 6y ago
  I think this was FB's secret sauce. We love creeping on people we know.
ThrustVectoring 6y ago
One of the things that I accidentally got is an extremely common first + last name combination. Googling it gives you eight digits of results and an info box for an athlete. My childhood library system had five other people with my name, and my childhood pediatrician had one other. It makes me a lot more confident about my pseudonyms' online anonymity. Not that I don't think concerted attackers could figure out who I am - people have, given access to additional info like previous employers or the college I attended. But I think it severely limits the ease and scope with which people could attack my personal life through my posts online. When I have children I'm going to do the same for them, I can only think it'll be even more important thirty years from now.
- inetknght 6y ago
  On the other hand someone trying to hack you could cause collateral damage to others with your name
  - 29083011397778 6y ago
    That's one reason to advocate for good security hygiene for everyone. "I'm not important" is not a defence here, helping your aunt set up a password manager that syncs automagically for her is.
- dhosek 6y ago
  When I taught high school in the '00s, they used first+last name as a primary identifier for students. For duplicates, they added an asterisk on the end, repeating as necessary. I had one student on my roster who was Jose Ramirez**** (not his actual name or number of asterisks, both of which I've long since forgotten).
- InitialLastName 6y ago
  This, I don't have a common name, but I'm roughly the same age/regional origin as someone with the same name as me who has generated enough internet noise from things like sports that the tracker pages (as an example) have us deeply confused. Very comforting, except for when we get emails meant for each other.
paul7986 6y ago
There is no privacy with sites like SearchPeopleFree (dot) com That's all u need to find out almost anything about anyone! Even if a prospective online dater gives you their Google voice number the site is gonna most likely tell you almost all about them.
- saalweachter 6y ago
  I'm looking at that now out of curiosity. I don't know if I'm more outraged that they link you to multiple sites (for more information) which are clearly just reskinned versions of the same underlying code, that the sites are clearly trying to harvest more and more information from me as a user, or that they are using a "please wait while we search for more information!!!" anti-pattern to keep you on them forever. [EDIT: And oh look, the "more information" site asks for your money after dragging you through the longest anti-pattern in the world.]
  - paul7986 6y ago
    They give plenty of info for free..type in phone number and get their full name, age, current and previous addresses, people they associate with. Everything except criminal record which once you have a name in most US stated you can then go to the local court website and get that info. Why pay anything?
    - StanislavPetrov 6y ago
      Interestingly, they have 4 phone numbers listed for me, none of which are accurate. The (partially blanked out) email address is also not one I have ever used, and although my current address is correct, the three previous addresses are all wrong (nobody I know ever lived at any of them as far as I know). I can only hope that the information behind the paywall is equally inaccurate!
      - paul7986 6y ago
        its been pretty accurate for the two dozen i used it for and or with here on the east coast
datavirtue 6y ago
I did a little experiment and yielded , what to me was expected, results within seconds. I pretended I was at a Starbucks and I heard them call out my grandmother's first name for her coffee order. I googled her first name and the name of the town the Starbucks is in--no state or other info--just two words. I scroll down, swipe through a few pictures, and now I have her life story in front of me. From that I can go down the rabbit hole and easily construct a phishing profile that I can use on her family members. I just assumed everyone already knew you could do this.
BaseS4 6y ago
1990s: open source all the code! HN: yaaaaaay 2020: open source all the intelligence! HN: Now hold your horses, mister What did you think making programming widely available was going to do? Did you think nation-states and their bloated bureaucracies would magically step in and go full North Korea about privacy to protect us from you? This accountability-denying pearl-clutching HN does every time they see an OSINT technique is ridiculously predictable... and only demonstrates your culpability in creating this mess in the first place.
- ggggtez 6y ago
  Your comment doesn't make any sense. Open Source Software is a solution for the problem of companies writing bad software under the assumption that no one will bother finding bugs if they are too annoying to find. History proved that wrong. There would be no point in doing any of that if you wanted the data to be freely available too. If so, you could just publish your database as a read-only file, and call it a day. Or just forgo any accounts at all. It literally makes no sense to blame OSS for privacy problems. The last I checked, Google Search is not open-source... These are two completely separate issues.
  - BaseS4 6y ago
    You seriously cannot find a single correlation between the mass availability of programming talent which extracts and transforms data, the vast majority of Internet hardware and servers being at least 70% powered by open source software, and the unstoppable destruction of privacy made possible by said infrastructure? Open source made Internet hardware affordable for mass use. Mass use of Internet hardware destroyed privacy. Even at its peak, 1950s IBM didn't have enough money in the world to violate privacy the way Google does. And the only reason Google can do it is because it stands on the infrastructure of Internet servers that were able to proliferate to the point of pennies per megabyte due to open source code. Yes, open source code is DIRECTLY responsible for the economics that has made the destruction of privacy endlessly cheap.
    - ggggtez 6y ago
jancsika 6y ago
> Instead, she wanted them to understand the gap between our perception of how much privacy we think we have in public spaces — and the reality. And, as she puts it, "to show them how thin our privacy constructions are in the modern day." It doesn't matter that my neighbor, or hell-- even a rando drunken tourist-- can poison my drinking supply. It does matter if a doe-eyed, tech-fetishizing HOA busy-body hooks up an IoT device which somehow connects the control system for water supply to the internet.
- ggggtez 6y ago
  You're conflating two disparate issues. Privacy and Security should not be thought of an analogs. You're talking about security. I don't think that's helpful for understanding the issues at hand.
mediascreen 6y ago
In a weird way it feels like we are more prepared for this in countries like Sweden where your social security number, tax returns, income, credit history, address, spouse, children, company board positions, pet ownership, car ownership and criminal records are public information and easily available. At least we have no illusions of privacy. Someone could start with your licence plate and two minutes later know pretty much everything. Since 1905 you have been able to buy a book every year that listed up to date income and net worth for everyone in your area [0]. Now, of course, everything has moved to web services and APIs. Take a look at the example response from this API for an idea of the information available [1]. [0] https://en.wikipedia.org/wiki/Taxeringskalendern https://en.wikipedia.org/wiki/Taxeringskalendern [1] https://api.ratsit.se/swagger/ui/index.html#/Person/get_api_v1_personinformation https://api.ratsit.se/swagger/ui/index.html#/Person/get_api_...
- dhosek 6y ago
  This was part of why author Stieg Larsson never married his girlfriend: To do so would expose her to people who had made credible threats on his life because of his journalism work. Unfortunately, this also meant that she was locked out of his estate after his death.
  - blacksmith_tb 6y ago
    Not a Swede, but wouldn't the logical solution to this problem be a will that named her specifically?
    - dhosek 6y ago
      His death was premature. I imagine he meant to do so, but died before he could.
- sib 6y ago
  Note to self: never move to Sweden. (Although I lived there as an exchange student for a summer many years ago...)
mariodiana 6y ago
Some years ago I was applying for a job and had to fill out a form for a background check. The background check asked for my last several addresses — and I had no idea what they were. Even then, it seemed obvious to try googling myself. Scary! In a few minutes I had every address I had ever lived at.
jacquesm 6y ago
I once showed an UHNWI what information I could dig up on them, their family and so on in a couple of minutes starting from a single 'checkin' on FourSquare. They were so shocked that it was hard to believe they had been utterly unaware of this right up until that moment. The next couple of days were spent on reducing their information footprint to something manageable, making sure that children were no longer visible and/or easily traceable and so on. Today you can barely find that person even if you know they exist. If you don't actively manage your privacy you are very likely leaking information that you do not wish to be made public.
throwawy54350 6y ago
Someone turned right in front of me one day, almost causing me to hit them when I had my kids in the car. I was absolutely furious. It was a distinct car, with a vanity plate, that quickly led me to an Instagram account with a link to their business websites. The sites were PHP messes with a bunch of vulns and directory listings with links to admin pages, domain control panels, email, you name it. I was very tempted to nuke everything before common sense returned to me and I just let it go. I (when I am not using a throwaway) try to act like anyone I interact with online could be standing outside my house. You just never know.
monoideism 6y ago
I thought that the lesson of this assignment was something that they never mentioned: all this public information that the students manually googled is available for automated passive surveillance to record, look up, and store.
ChrisArchitect 6y ago
previous old discussion: https://news.ycombinator.com/item?id=19362793 https://news.ycombinator.com/item?id=19362793

128 points by ddtaylor 6y ago

I confess to having played that game in the subway. Never with bad intention, just bad manners and curiosity on my part.

drooby 6y ago

The internet is also a public place in many ways. If someone overhears my name and sees my face and discovers my personal website or LinkedIn page, then they have only discovered MORE public information about me. There is no privacy breach if I don’t divulge private information on public spaces, i.e the internet.

jedimastert 6y ago
I think there needs to be more consciousness that the internet as a whole is a public commons, as public as doing something on the square. It's something I'm going to endeavor to teach my kids when they start interacting with the internet (a thought that already gives me great anxiety)
- hc-taway 6y ago
  The norm used to be never to post personal info online. Yes, some things could still be found out, and there were still attack vectors, but typing your real name in a web form, except maybe (and only fairly late in the time period I'm talking about) to pay with a CC on a well-known site? LOL no. Posting photos of yourself, and with your name and maybe even a location attached? Madness! Are you nuts!? I'm convinced Zuckerberg's infamous "dumb fucks" comment was made in a state of puzzlement that all these n00bs just had no idea they shouldn't be giving him that info, and indeed, the dawn of Facebook and all the people it added to the set of folks posting information online ended the previous "no-one knows you're a dog" set of norms of the Web. Now there's money tied up in it, so of course people insist they must be able to post all kinds of things under their real names so they can market themselves. Never mind that it remains a terrible idea. This is the source of conflict, I think, between people who want more real names online and those who want none. The former are the new folks who think posting personal info online is normal, or even necessary (see again: personal brand-building and marketing) and believe that we need to be able to ID everyone to prevent abuse (i.e. be able to find abusers to punish them), and the latter are the old-school Web users (post-Eternal-September, pre-Facebook) who don't get why all these idiots are making themselves easy to abuse in the first place, who see more anonymity as the obvious cure.
  - jedimastert 6y ago
    > This is the source of conflict, I think, between people who want more real names online and those who want none. I think there is a space for both, tbh. There is always business based on reputation, and for that you need to self-identify. I used to be a professional gigging musician, and there was absolutely no way to do that while remaining anonymous online, nor would I want to. The difference being, I suppose, was business vs personal, but personal brand was a thing long before the internet (I assume).
bogwog 6y ago
> There is no privacy breach if I don’t divulge private information on public spaces, i.e the internet. You also have to keep in mind that you can be publicly divulging things without even realizing it, especially because everything you post online is stored permanently, and tons of private information about you can be extrapolated from it by anyone who bothers to pay attention. It's also insanely profitable, just look at Google and Facebook!
- asdfasgasdgasdg 6y ago
  For Google, the most profitable thing (to my understanding) is advertisement on product-seeking queries. If you look and a SERP for a privacy-invading search, like Googling someone's name or email address, you'll notice that there are not really so many ads. I tried searching for my real name, my real name with my locale, and my email address. I was able to find an old breached password and I was able to find my home address, but I didn't see any ads. You could argue that this feature provides some halo benefit to Google's more profitable queries, but to be honest it seems like a stretch to me. For Facebook, they make money from advertising to logged in users. Broadly speaking, they keep users logging in by offering users the ability to broadcast private information to friends, and by offering the ability to receive such broadcasts from friends. To the extent FB does invade privacy, they do so to more effectively advertise to users on their site. They don't make the results of that invasion -- the profiles they build from their tracking bits, in other words -- available for public search. What's available for public search is instead only what the users choose to broadcast about themselves. The exposure of private information to public search engines is not what is profitable about either of these companies. It's an incidental effect of the persistence of digital storage and the difficulty of curating what is stored.

deleted 6y ago

[deleted]

intrasight 6y ago

Cool idea for a class project!

possiblelion 6y ago

I think most of us have done something along these lines, whether out of boredom or just curiosity.

deleted 6y ago

[deleted]

sodality2 6y ago

I found it scarily easy to find info on some people. I was talking to my friend about it, so I tested it out on them (with their permission). With just their public facing instagram account handle, I: Found full name from family members in following list -> email, phone #, etc from full name Found email + phone of most of the close family Found address, PO box, and usernames from their past accounts Found their (current!) password for email, social media, etc (but not bank) from a breach from 2016 (!!!) Found their old wattpad account (!!!!!!) Found out that their instagram had no 2fa and "hijacked it" with them next to me, changed email and password (not sure if they could have recovered it afterwards). Notifications did come through but given their email, I used an email newsletter spammer I made and a text spammer to blow up their phone to hopefully distract for the few minutes it took, to simulate a real attack. Needless to say, it was bad news all around. (I already knew some of the info I found, but my search consisted of me pretending I didn't) Edit: the irony of me posting about data security when I just divulged where I grew up & school district less than 2 weeks ago :'( (though I bet I'm fine given I have no other accounts with this username)

btown 6y ago
That "spam distraction" tactic is scary - no doubt it's being used in the wild!
- sodality2 6y ago
  Surely so! I just spent a few hours signing up for newsletters I had saved previously and gathering submit POST requests, concatenating it into one script, etc. I honestly can't think of any white hat use for it (besides what I did). I haven't open sourced it, because it will probably be used for malicious purposes by script kiddies 99% of the time, and I don't really want that associated with me.
- iamacyborg 6y ago
  It was, a few years ago Mailchimp and a few other ESP's were subject to major listbombing attacks. https://wordtothewise.com/2016/08/subscription-bombing-esps-spamhaus/ https://wordtothewise.com/2016/08/subscription-bombing-esps-...

0xCMP 6y ago

A lot of conversations around privacy and using encryption would be much easier if those in the conversation understood just how simple and permissionless it is to snoop information and become way more knowledgeable about someone than you should.

caseysoftware 6y ago

I used to do a presentation called "Shattering Secrets with Social Media" where we'd do a "live attack" on a volunteer from the audience. Starting with their name from their badge, we'd see how many of the top 10 security questions we could answer. For most people we could get 4-6 in a matter of minutes. For a select few we could only get 1-2. Despite it all, there were two we could almost never get: street you grew up on and first pet's name. My theory was that those are tied to a time and place that predates social media for many millenials and all gen-x. But there was another approach.. one of those silly threads from years ago was "What is your porn star name?" which required your first pet's name and the street you grew up on. Yes, that was a social engineering attack at scale. And even if you didn't answer it, if you had a sibling roughly the same age, odds are theirs were the same.

fanatic2pope 6y ago
One of the benefits of using a password storing app (in my case keepassxc) is that I answer those kinds of secondary questions with random words.
- lfowles 6y ago
  Isn't the danger now that someone could call into your bank and say "I forgot them exactly, but the answers are just random strings"
  - jakub_g 6y ago
    This issue always come up with those discussions indeed. Probably to be safe you could just come up with plausible unique non-random name, and still store it in keepass. > What's your cat's name? Site X: Kareem Abdul-Jabaar Site Y: Cassius Clay Site Z: Franz Beckenbauer
  - yohannparis 6y ago
    Then there is a clear breach of the terms of services from your bank, and it might be easier to get issue on their hands. But you are right, the best solution would something in between.

underseacables 6y ago

Imagine if we did Google every single person we met, and started a dossier of them with all of the information that we could find and collect about them. That would be a lot of work, but Facebook does it for us.

falcolas 6y ago
Now imagine an ITTT-style automation of this collection, so it requires virtually no input from you to have a dossier on almost everyone around you based on their ambient presence. Could even potentially use Facebook et.al. facial recognition. Bundle it up with your Instagram or Google glasses.
- HDMI_Cable 6y ago
  This is both so scary, and somewhat feasible. I could imagine this database having more information than all of the government ID systems.
mywittyname 6y ago
I think this was FB's secret sauce. We love creeping on people we know.

ThrustVectoring 6y ago

One of the things that I accidentally got is an extremely common first + last name combination. Googling it gives you eight digits of results and an info box for an athlete. My childhood library system had five other people with my name, and my childhood pediatrician had one other. It makes me a lot more confident about my pseudonyms' online anonymity. Not that I don't think concerted attackers could figure out who I am - people have, given access to additional info like previous employers or the college I attended. But I think it severely limits the ease and scope with which people could attack my personal life through my posts online. When I have children I'm going to do the same for them, I can only think it'll be even more important thirty years from now.

inetknght 6y ago
On the other hand someone trying to hack you could cause collateral damage to others with your name
- 29083011397778 6y ago
  That's one reason to advocate for good security hygiene for everyone. "I'm not important" is not a defence here, helping your aunt set up a password manager that syncs automagically for her is.
dhosek 6y ago
When I taught high school in the '00s, they used first+last name as a primary identifier for students. For duplicates, they added an asterisk on the end, repeating as necessary. I had one student on my roster who was Jose Ramirez**** (not his actual name or number of asterisks, both of which I've long since forgotten).
InitialLastName 6y ago
This, I don't have a common name, but I'm roughly the same age/regional origin as someone with the same name as me who has generated enough internet noise from things like sports that the tracker pages (as an example) have us deeply confused. Very comforting, except for when we get emails meant for each other.

paul7986 6y ago

There is no privacy with sites like SearchPeopleFree (dot) com That's all u need to find out almost anything about anyone! Even if a prospective online dater gives you their Google voice number the site is gonna most likely tell you almost all about them.

saalweachter 6y ago
I'm looking at that now out of curiosity. I don't know if I'm more outraged that they link you to multiple sites (for more information) which are clearly just reskinned versions of the same underlying code, that the sites are clearly trying to harvest more and more information from me as a user, or that they are using a "please wait while we search for more information!!!" anti-pattern to keep you on them forever. [EDIT: And oh look, the "more information" site asks for your money after dragging you through the longest anti-pattern in the world.]
- paul7986 6y ago
  They give plenty of info for free..type in phone number and get their full name, age, current and previous addresses, people they associate with. Everything except criminal record which once you have a name in most US stated you can then go to the local court website and get that info. Why pay anything?
  - StanislavPetrov 6y ago
    Interestingly, they have 4 phone numbers listed for me, none of which are accurate. The (partially blanked out) email address is also not one I have ever used, and although my current address is correct, the three previous addresses are all wrong (nobody I know ever lived at any of them as far as I know). I can only hope that the information behind the paywall is equally inaccurate!
    - paul7986 6y ago
      its been pretty accurate for the two dozen i used it for and or with here on the east coast

datavirtue 6y ago

I did a little experiment and yielded , what to me was expected, results within seconds. I pretended I was at a Starbucks and I heard them call out my grandmother's first name for her coffee order. I googled her first name and the name of the town the Starbucks is in--no state or other info--just two words. I scroll down, swipe through a few pictures, and now I have her life story in front of me. From that I can go down the rabbit hole and easily construct a phishing profile that I can use on her family members. I just assumed everyone already knew you could do this.

BaseS4 6y ago

1990s: open source all the code! HN: yaaaaaay 2020: open source all the intelligence! HN: Now hold your horses, mister What did you think making programming widely available was going to do? Did you think nation-states and their bloated bureaucracies would magically step in and go full North Korea about privacy to protect us from you? This accountability-denying pearl-clutching HN does every time they see an OSINT technique is ridiculously predictable... and only demonstrates your culpability in creating this mess in the first place.

ggggtez 6y ago
Your comment doesn't make any sense. Open Source Software is a solution for the problem of companies writing bad software under the assumption that no one will bother finding bugs if they are too annoying to find. History proved that wrong. There would be no point in doing any of that if you wanted the data to be freely available too. If so, you could just publish your database as a read-only file, and call it a day. Or just forgo any accounts at all. It literally makes no sense to blame OSS for privacy problems. The last I checked, Google Search is not open-source... These are two completely separate issues.
- BaseS4 6y ago
  You seriously cannot find a single correlation between the mass availability of programming talent which extracts and transforms data, the vast majority of Internet hardware and servers being at least 70% powered by open source software, and the unstoppable destruction of privacy made possible by said infrastructure? Open source made Internet hardware affordable for mass use. Mass use of Internet hardware destroyed privacy. Even at its peak, 1950s IBM didn't have enough money in the world to violate privacy the way Google does. And the only reason Google can do it is because it stands on the infrastructure of Internet servers that were able to proliferate to the point of pennies per megabyte due to open source code. Yes, open source code is DIRECTLY responsible for the economics that has made the destruction of privacy endlessly cheap.
  - ggggtez 6y ago

jancsika 6y ago

> Instead, she wanted them to understand the gap between our perception of how much privacy we think we have in public spaces — and the reality. And, as she puts it, "to show them how thin our privacy constructions are in the modern day." It doesn't matter that my neighbor, or hell-- even a rando drunken tourist-- can poison my drinking supply. It does matter if a doe-eyed, tech-fetishizing HOA busy-body hooks up an IoT device which somehow connects the control system for water supply to the internet.

ggggtez 6y ago
You're conflating two disparate issues. Privacy and Security should not be thought of an analogs. You're talking about security. I don't think that's helpful for understanding the issues at hand.

mediascreen 6y ago

In a weird way it feels like we are more prepared for this in countries like Sweden where your social security number, tax returns, income, credit history, address, spouse, children, company board positions, pet ownership, car ownership and criminal records are public information and easily available. At least we have no illusions of privacy. Someone could start with your licence plate and two minutes later know pretty much everything. Since 1905 you have been able to buy a book every year that listed up to date income and net worth for everyone in your area [0]. Now, of course, everything has moved to web services and APIs. Take a look at the example response from this API for an idea of the information available [1]. [0] https://en.wikipedia.org/wiki/Taxeringskalendern https://en.wikipedia.org/wiki/Taxeringskalendern [1] https://api.ratsit.se/swagger/ui/index.html#/Person/get_api_v1_personinformation https://api.ratsit.se/swagger/ui/index.html#/Person/get_api_...

dhosek 6y ago
This was part of why author Stieg Larsson never married his girlfriend: To do so would expose her to people who had made credible threats on his life because of his journalism work. Unfortunately, this also meant that she was locked out of his estate after his death.
- blacksmith_tb 6y ago
  Not a Swede, but wouldn't the logical solution to this problem be a will that named her specifically?
  - dhosek 6y ago
    His death was premature. I imagine he meant to do so, but died before he could.
sib 6y ago
Note to self: never move to Sweden. (Although I lived there as an exchange student for a summer many years ago...)

mariodiana 6y ago

Some years ago I was applying for a job and had to fill out a form for a background check. The background check asked for my last several addresses — and I had no idea what they were. Even then, it seemed obvious to try googling myself. Scary! In a few minutes I had every address I had ever lived at.

jacquesm 6y ago

I once showed an UHNWI what information I could dig up on them, their family and so on in a couple of minutes starting from a single 'checkin' on FourSquare. They were so shocked that it was hard to believe they had been utterly unaware of this right up until that moment. The next couple of days were spent on reducing their information footprint to something manageable, making sure that children were no longer visible and/or easily traceable and so on. Today you can barely find that person even if you know they exist. If you don't actively manage your privacy you are very likely leaking information that you do not wish to be made public.

throwawy54350 6y ago

Someone turned right in front of me one day, almost causing me to hit them when I had my kids in the car. I was absolutely furious. It was a distinct car, with a vanity plate, that quickly led me to an Instagram account with a link to their business websites. The sites were PHP messes with a bunch of vulns and directory listings with links to admin pages, domain control panels, email, you name it. I was very tempted to nuke everything before common sense returned to me and I just let it go. I (when I am not using a throwaway) try to act like anyone I interact with online could be standing outside my house. You just never know.

monoideism 6y ago

I thought that the lesson of this assignment was something that they never mentioned: all this public information that the students manually googled is available for automated passive surveillance to record, look up, and store.

ChrisArchitect 6y ago

previous old discussion: https://news.ycombinator.com/item?id=19362793 https://news.ycombinator.com/item?id=19362793