11 ms·
Maigret: Collect a dossier on a person by username from thousands of sites
- nvr219 4y agoI'm a big use-different-username-for-every-website enthusiast. It makes some things difficult but for me it's worth it.
- walrus01 4y agoBut people are commonly lazy, and you'd find that most people who don't even consider resistance to deanonymization as a concern will just use the same name on many sites.
- bombcar 4y agoUse the battery horse staple tool to generate usernames. Or don’t, I’m not your mom.
- thakoppno 4y agoisn’t it: `correct horse battery staple` just wondering how memorable that technique is. edit: indeed https://xkcd.com/936/ https://xkcd.com/936/
- shanusmagnus 4y agoSpeaking personally, I kind of want people to know I'm the same person in different places. I do realize this is a terrible idea from a privacy perspective, and probably a lot of other perspectives. But I think a bunch of people want to use the net this way.
- NikolaNovak 4y agoAgree. There's a possibly flawed but possibly real notion of reputation or brand or eminence. Patio11 of course comes to mind :).
- Entinel 4y agoIt's only bad from a privacy perspective if you are sharing things you don't want linked together or are sharing things that can be unintentionally linked back to your real life. If you are the same username across multiple sites and you want those linked together then that's just branding.
- trinovantes 4y agoUsing the same username may allow you to manually poison your own profile to make your data less useful than a shadow profile generated through stylometry
- Mezzie 4y agoI do this. I have a handle I've been using for 20+ years (not this one and nothing on HN) and I lie about stupid shit rather frequently. I also also create one-off usernames in addition to my 'permanent' name. That way everybody sees the permanent name and assumes I'm too stupid/ignorant to use different names, so nobody ever suspects the other names are me. (Using different emails because I do the same thing with email addresses and - when I can afford it - phone numbers).
- walrus01 4y ago> It's only bad from a privacy perspective if you are sharing things you don't want linked together or are sharing things that can be unintentionally linked back to your real life You must live in a location where you have very little fear of political oppression. If you're an Iranian or something these days the situation is very different.
- BenjiWiebe 4y agoCount me in as one of those people. I use the same username (which is my real name as well) pretty much everywhere.
- vidarh 4y agoI use recognisable usernames in places (like here) where I'm fine with my comments being linked to my real name, and less obvious ones without explicitly hiding it places where I'd prefer my comments don't show up in Google searches for my name (e.g. Reddit - if you trawl through my reddit profile, linking it to my name is easy, and it wouldn't be a problem if you found it, but I don't get a bunch of reddit comments when I Google my name), and then totally separate user names for anything I actually want to be anonymous for. My situation is a bit unusual in that I almost certainly have a globally unique name (my last name is a corruption of an uncommon name in Norway; said corruption occurred two places independently, and there are less than 500 people with that last name in Norway, and probably about the same in the US, and to date I've seen no indication of anyone combining it with my first name), my first name plus last initial is also unusual enough that I only rarely can't get it as a username.
- barbariangrunge 4y agoI guess with password managers, this is easier than ever
- tempodox 4y agoEven if you used the same username on different accounts, you should have different passwords anyway.
- glitchcrab 4y agoI'm pretty sure they meant that using a password manager means you don't have to remember the _username_ for every site.
- kataklasm 4y agoI've started to just generate a 10-char alphanumerical string with the password generator feature and use that as the username on new accounts, starting to update them retroactively, too (by scrapping the old account and making a new one).
- JamesDough 4y agoThats great, then you can use the same for your password.
- marginalia_nu 4y agoReally, why is that?
- quetzthecoatl 4y agobecause if you get your account compromised on one site/forum because of lax security on their end, you don't want all your accounts compromised.
- 4y ago
- hifikuno 4y agoI've started doing this too. I use DuckDuckGo's email forwarder and they provide random email addresses to hide your real one. Every service I sign up with now has a random email address and what ever the email address is that becomes my username. Couple this with a password manager it works well. If I ever lose access to the password manager I am screwed.
- walrus01 4y agoThis also seems like a useful tool for hunting down sockpuppet and nation-state sponsored astroturfing campaigns.
- dymk 4y agoThose accounts seem the most likely to be randomly named per-site. Why would they reuse a username?
- epakai 4y agoSometimes a persona might be created to establish rapport. It's probably pretty rare because of the extra effort isn't commensurate with with returns.
- NavinF 4y agoNo, this finds accounts that want to be found. Sockpuppets wouldn't use the same username.
- GekkePrutser 4y agoWhich could be one thing that identifies them!
- fire 4y agohah, I thought it sounded like sherlock[1] and lo, it's a fork! can't find a comparison of them though; any idea how they differ? 1: https://github.com/sherlock-project/sherlock https://github.com/sherlock-project/sherlock
- frumiousirc 4y ago> sherlock Comparing the options described in their readme files, maigret adds --html, --pdf, --tags beyond what sherlock supports. And, it adds documentation beyond a README file.
- lol768 4y agoThis is technologically impressive, but I was disappointed (but not particularly surprised) to see no mention of the ethics involved in using this sort of project - in either the GitHub issues or the README/docs. This seems like a great tool for stalking people; particularly the recursive functionality (for tying identifiers together). I'm not saying the world is worse-off due to the release of software like this - indeed, you could argue that publishing these sorts of OSINT tools allow folks to take a proactive and protective view of their own information and e.g. make changes to their own profiles/privacy settings. But the question of ethics seems like something all-too-often glossed over in the infosec world. Software doesn't exist in a vacuum.
- motoxpro 4y agoAs a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.
- lol768 4y ago> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. > 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way. Yup, I do think you're right. And honestly, the folks who'd probably most benefit from being able to run one of these tools to empower themselves with data that can help them change their behaviour/privacy settings - they're probably actually the folks least likely to be able to install and run the tool.
- NoraCodes 4y agoI disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of motivated attackers that any moderately public queer person will, at some point, be doxed and subjected to some level of internet harassment.
- bee_rider 4y agoWell, that is creepy as hell, but I guess it is obvious that such a tool could exist, and it is better not to have it exclusively in the hands of data-brokers, etc. I wonder how hard it would be to add the functionality: go back to the email address that has registered these accounts, find any other names they've registered, and search off those. (EDIT: err, wait, I bet that's the "recursive" functionality they mention).
- swyx 4y agoi think clearbit is making $100m/yr doing this as a service for businesses already
- eurasiantiger 4y agoYou have probably already clicked ”accept”[1] on one of those ”cookie notices” which actually make you give your consent to having your data processed and all your profiles and devices linked by hundreds, if not thousands of companies all over the world. [1]: more accurately, you didn’t go through the list of all vendors and didn’t object to their ”legitimate interests”, if that was even an option.
- bee_rider 4y agoIf your point is that it is too onerous to use the modern internet without being spied on, yes I agree.
- throwaway81523 4y agoUse a separate password for each site, and also a separate username.
- Entinel 4y agoI used to do what this tool does but manually when networking. Find someone I wanted to network with then find all of their online accounts to try to find an "in." Definitely very creepy but I if called it networking not stalking and its okay right.
- Swizec 4y agoYou can make it not feel creepy by using the research as a way to seed the conversation rather than replacing it. Ask good questions because you know [part of] the answer, but let the person decide how much they want to say in the moment. An even better trick is to invite them for a podcast recording. Then all this research is suddenly very normal and expected.
- AdmiralAsshat 4y agoSeems incredibly prone to false positives. For example, I can guarantee that I'm not the AdmiralAsshat on Reddit, Gmail, or Twitter, because that username was already taken by the time I tried to sign up for them.
- TheAdamist 4y agoAs a commissioned officer, you may be responsible for everything done in your name. More rations of rum, i think thats how the british managed it. I wouldnt complain, much.
- lol768 4y agoYup; for common/short usernames it's all too common for other folks to register using the same identifier. The end result seems to be that this tool decides you're interested in "dating", "porn", "stocks" and tags you with a "ru" country code - despite not owning any of the accounts that the determination has been based off of. The README should come with a disclaimer really.
- jhugo 4y agoIsn't it obvious just from reading one sentence about what it does? As it clearly says, it's based on username only, so multiple people's results may be mixed in the dossier if they share a username. We don't need a disclaimer for every thing that a moment's thought can reveal.
- voakbasda 4y agoThe people that use this tool to dig up dirt on someone will love to see a mixed bag, because it could be useful to cast shade on their actual target. This tool will be abused on purpose.
- jhugo 4y agoThat makes no sense. They could just make stuff up, it wouldn't be any more or less believable.
- djbusby 4y agoRemember when KeyBase was gonna make it easy to verify users across profiles? Your KeyBase profile would link out to all of them, no magic needed.
- styfle 4y agoYeah that or a personal website which often has links to the same person on all social networks.
- ergodic1 4y agoSomeone needs to build a 1password for usernames.
- xena 4y agoUse a D&D character name generator
- bee_rider 4y agoMost password managers will already do this, right? Like the iOS and Firefox built in ones will remember a username/password pair.
- weaksauce 4y agothat is built into bitwarden actually
- jonas-w 4y agoYes also with plus addressed E-Mail, or a catch-all E-Mail generator or if you use Firefox Relay etc a generator for these. But the username generator is just a random English word plus a number.
- retox 4y agoI'd never heard of Firefox Relay, thanks for that. https://relay.firefox.com/ https://relay.firefox.com/
- jbm 4y agoI took a look at my own user names and it's pretty obvious that the results here are mostly worthless. So many people with empty blogs and the same user name. Unless the blog is auto-created, I don't see the point. I do find all the .ru tags to be concerning. I can imagine out-of-touch security types at Paypal deciding to sanction me based on it without any recourse.
- basicplus2 4y agoUnless all your user names are your email address
- vosper 4y agoYeah I've seen a similar tool fail hard on any wiki site that returns a placeholder page for any username whether or not it actually exists. I've never seen anything except 95% false positives, which is so many that after a few runs you just ignore the tool.
- GoblinSlayer 4y agoPaypal is a private company, it can sanction you for lulz too.
- hnbad 4y agoIt's mostly worthless but the recursive search via aliases can give some interesting insights. I ran it on my GitHub username and while the result ended up linking me to countries I have never been to (probably via a yandex account as the username is very common and a lot of the profiles were of other people) it did include my full name and cities I've lived in. It seems the most "dangerous" link in my case was Gravatar. Interestingly, searching by e-mail gave the most garbage results, likely because most services don't expose the e-mail address directly. I guess it's an advantage that neither my usernames nor my legal name are particularly unique.
- Lucent 4y agoThis is going to work great on me, having spent most of my life pouncing on this name on every platform.
- rishsriv 4y agoDid something similar as an experiment a few years ago, except I used photos and name strings as fuzzy identifiers across social media profiles. We also scraped individual reactions from social media apps to get a _very_ detailed profile on what they engaged with (like using the "Angry" reaction emoji when Trump said something stupid vs using the "Angry" reaction emoji when someone AOC said something stupid). Never released it in the wild for obvious ethnical reasons, but was an interesting technical challenge. Also led to super interesting insights – like learning that videos and text links were watched by entirely different audiences on Facebook and Twitter [1] [1] https://twitter.com/rishdotblog/status/1483329729302515712 https://twitter.com/rishdotblog/status/1483329729302515712
- kodt 4y agoSeems like several large forums are missing from the website list.
- sbf501 4y agoMy decision to pick a username that was taken on other sites has successfully improved my anonymity score!
- StarlaAtNight 4y agoActually pretty useful if you input your email address. It crawls through some kind of knowledge graph I'm seeing stuff I probably need to go clean up from like 10 years ago that's no longer relevant
- Romanulus 4y ago
- 29athrowaway 4y agoSome people have voluntarily done what this service does via Linktree.
- INTPenis 4y agoI've been fantasizing about something like this for years. But my idea was more along the lines of supporting API keys for many different sites, taking your time to configure all these API settings for all these different "site scraping engines" and that would give you the activity of someone you might be tracing. Their comments, their posts and so forth. I was thinking this would be great for snooping employers who want to know what their WFH employees are up to. Funny enough I was even imagining support for Steam, and friend request coming from these robots that in rare cases you could even see live as an employee started playing a game.
- vincnetas 4y agoThis just made me think about treating both username and password fields as "put random strings here and let password manager remember them". And then give a nickname for account in password manager. And communicate your username to your friends through other channels if you need to.
- pseingatl 4y agomaigret: command not found
- _Algernon_ 4y agoTry installing it
- daitangio 4y agoTested docker version: nice but the report is a long list, much like an "index" of the provided username present on a set of sites. It should provide at least some numbers/graph to "measure" your presence on the web, like I do not now, number of GitHub repositories, instaram photos and so on. A user with little instagram photos but a lot of GitHub repositories is different from a guy with a lot of Blog posts, Pinterest entries, Twich videos...and so on.
- faeriechangling 4y agoThis is why I use many different usernames, I must have used maybe three dozen different ones by now. The only time I use the same username is for games because I want people to know what other games I play. My opsec is pretty awful but I at least try to not be "simply type in the username I always use into google or some tool on GitHub" bad. I at least want somebody to have to use a few hours or pay a data broker to reveal all my secrets because my bet is that nobody cares about me enough to do that.
- baxtr 4y agoThai won’t be helpful going forward. The next gen of tools will analyze your writing style and make the connection through that.
- aunetx 4y agoI guess to analyse your writing style from thousands of billions of messages on Internet in order to simply link two of your accounts together is... overcomplicated? I mean of course it could work, but except if there is a very special interest for an account, we may need to wait some decades before a list of "linked accounts" containing it in particular could emerge, right?
- deleted 4y ago[deleted]
- Karunamon 4y agoI would be willing to bet that, around the same time those tools become widely distributed (kind of like what stable diffusion did for AI artwork), adversarial tools that emulate or obfuscate writing styles will exist as well.
- dolmen 4y agoThis project is apparently a fork of another project called Sherlock [1] which is still active. Does anyone know the story behind the fork? [1]: https://github.com/sherlock-project/sherlock https://github.com/sherlock-project/sherlock
- leogout 4y agoI've tried out both today. As far as I can tell maigret generates nice reports whereas sherlock only gives you the urls and you have to dig yourself int those.
- mcqueenjordan 4y agoI think you're supposed to do this with Stylometrics[1]. So I guess this is sort of the greedy hacky approach to try and associate users across websites. My operating assumption of Palantir as a company is that they have a very advanced system of a similar shape that tries to accomplish the same goal of linking accounts across services, but I have no insider knowledge. [1]: https://en.wikipedia.org/wiki/Stylometry https://en.wikipedia.org/wiki/Stylometry
- tartaglia0 4y agoI gave it a try feeding it with one of my community nicknames. It was rather generic so I did expect some false positives. Color me surprised when it automatically started a second search iteration using my real name! Turns out that one of the websites I'm registered to uses Gravatar to display profile pictures. I've naively been using the same WP account to set a picture for all my emails, believing that you couldn't get information about my other accounts using a simple picture. I guess I was wrong, and I'll probably split my Gravatar account this evening.
- joshka 4y agoRelated... https://bitwarden.com/blog/how-to-use-the-bitwarden-username-generator-and-why-you-should/ https://bitwarden.com/blog/how-to-use-the-bitwarden-username...
- pvaldes 4y agoFrancosphere, so perhaps not so well known in US as in Europe. For context: https://en.wikipedia.org/wiki/Jules_Maigret https://en.wikipedia.org/wiki/Jules_Maigret Terrific detective books
- fritztastic 4y ago>The Maigret database contains not only the original websites, but also mirrors, archives, and aggregators. Deeply unsettling. Having had my share of encounteres with people online taking personal interest in an unfriendly context, this is worrying. I don't need to run a search of my info to know to use different usernames, but an automated feature that allows just about anybody determined enough to easily find not only linked accounts but archived data. I'm glad I no longer use social media, at least infrequently and not the major ones- but the fact someone can find archived information? Time to make some adjustments.
- VincentKun 4y agoYeah I hope this won't get used by whoever want to hire me
- microtherion 4y agoA number of the sites this is checking seem to be returning a "hit" for any user name you check on them, whether an account exists or not.
- pvillano 4y agoMai re-gret is reusing my first username for multiple accounts when I first joined the internet. I've tried to transfer accounts to separate work, personal, and anonymous emails, but nothing is ever really deleted.
- deleted 4y ago[deleted]
- DaMaGeLaB 4y agoNice xD
- GekkePrutser 4y agoThis works pretty well but it's pretty basic. It doesn't for example list all HN comments and ascertain interests etc from there. Just the account info. It's nice for an initial scan of a target but I expected a more comprehensive report. It's a good start but it could use a lot more.