6 ms·

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out i

As a commentary on the conundrum, not so much your post. I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way.

lol768 4y ago
> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. > 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way. Yup, I do think you're right. And honestly, the folks who'd probably most benefit from being able to run one of these tools to empower themselves with data that can help them change their behaviour/privacy settings - they're probably actually the folks least likely to be able to install and run the tool.
- NoraCodes 4y ago
  I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of motivated attackers that any moderately public queer person will, at some point, be doxed and subjected to some level of internet harassment.
  - javajosh 4y ago
    Yeah but this tool just lowered the barrier-to-entry for any motivated attacker. What before was an, oh, 20 hour slog through a bunch of sites looking for the same username, is now a 15 minute run of a script. For an analogy, consider another tool, an app you can side-load and use to unlock any Prius made between 2010 and 2013. Is this beneficial? Certainly some affected Prius owners will be helped by its release. But affected Prius owners will be (probabilistically) harmed. Even if you're one of the group that was helped (probably arguing the exploit was already well known prior to the tool's release, perhaps?) I think it is dishonest to assert that the release of the tool is "good" from a utilitarian sense. I wish it weren't so.
    - NoraCodes 4y ago
      I definitely see your point, but when there are, at minimum, dozens of people who are willing to undergo that 20 hour slog, I'm glad there's a tool that makes it take mere minutes to find OSINT leaks myself. I'm not saying you're necessarily wrong in general. It's possible this is bad for the world. But I maintain that for myself and the people I care about, it's more useful than it is damaging.
mod 4y ago
I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves. It will be used for many reasons, but the stalking is the most obvious. Not all of my usernames are as resistant as this one, unfortunately.
- rtev 4y ago
  Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?
  - archevel 4y ago
    I think the argument is more that this tool by virtue of being easily accessible creates more malicious actors. Similar to how most people wouldn't steal a locked bike, but a larger portion would steal an unlocked one. It isn't that much harder to steal a locked bike vs an unlocked one, but the threshold is just a tiny bit higher so more people will attempt it. Conversely this tool lowers the threshold for stalking, so more people, who otherwise wouldn't, will use it maliciously. That isn't the fault of the tool or its developers, but it is something to be aware of when building any tool. When you release it, it may get abused by people for bad purposes.
    - rtev 4y ago
      Assuming your online identity is secure by obscurity is not a realistic option. If all it takes is a flashlight for everyone to become “vulnerable”, we need to just assume the light is always on. Someone handing out flashlights just highlights the bigger problem. If this truly causes worry, adopt better opsec and create generative usernames for different sites. If not, assume anyone will easily be able to link your bowel issue subreddit comments to your LinkedIn profile.
  - Springtime 4y ago
    I feel this is similar to Firesheep[1], a browser extension from a decade ago that put cookie session hijacking into the hands of everyday users and became wildly popular until its removal. Pre-Snowden it pushed various major sites to implement HTTPS encryption, including Facebook[2]. Granted there the solution was a rather simple one but I feel it's at least worthwhile for more to be conscientious of singular identities online and what info is disclosed publicly with them. [1] https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep [2] https://threatpost.com/facebook-kills-firesheep-new-secure-browsing-feature-012611/74883/ https://threatpost.com/facebook-kills-firesheep-new-secure-b...
JustHiThere 4y ago
Wrong approach imho. This means, all the tools developed for ethical hacking are "bad" because they can used for "bad". This is like saying we shouldn't sell knifes because knifes can be used to kill someone. It's just silly. This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc ...
- ohgodplsno 4y ago
  A knife has many uses, from cutting wood to stabbing people. This tool is very much specialized in the stabbing (not necessarily people, as you said, you could stab a ballistic dummy to see the damage it does). Do you really a think a stab-only knife should be sold with no background checks, with no tracking of who buys it ?
- motoxpro 4y ago
  We could debate where they are but surely there are limits? I wouldn't want everyone to have access to things like Pegasus (https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-identified-in-mexico/ https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-ide...). You could argue Pegasus could be used to hack a phone of a child predator to save a life, just as you could argue this tool could be used to educate. Maybe for you this username tool falls outside of yours, but it looks more like a switchblade than a butter knife to me.
- nottorp 4y ago
  > This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc Or just... look yourself up. Like most of the people on this HN thread have done.

lol768 4y ago

> I always think it’s strange when people make the argument that it’s good for harmful tools to be out in the open because people can/will change their behavior because of them. > 99.999999% of people will never see this repo, never know things like this exist, and don’t visit sites like HN but can, and probably will be, affected by it in some way. Yup, I do think you're right. And honestly, the folks who'd probably most benefit from being able to run one of these tools to empower themselves with data that can help them change their behaviour/privacy settings - they're probably actually the folks least likely to be able to install and run the tool.

NoraCodes 4y ago
I disagree entirely. As someone with a moderately public persona who is also in the LGBTQ+ community, having tools like this is extremely helpful, both to help me keep a grasp on information about myself and for helping less technically inclined people in my community protect themselves. It's all information that a motivated attacker could find easily with or without the tool, and there are a sufficient number of motivated attackers that any moderately public queer person will, at some point, be doxed and subjected to some level of internet harassment.
- javajosh 4y ago
  Yeah but this tool just lowered the barrier-to-entry for any motivated attacker. What before was an, oh, 20 hour slog through a bunch of sites looking for the same username, is now a 15 minute run of a script. For an analogy, consider another tool, an app you can side-load and use to unlock any Prius made between 2010 and 2013. Is this beneficial? Certainly some affected Prius owners will be helped by its release. But affected Prius owners will be (probabilistically) harmed. Even if you're one of the group that was helped (probably arguing the exploit was already well known prior to the tool's release, perhaps?) I think it is dishonest to assert that the release of the tool is "good" from a utilitarian sense. I wish it weren't so.
  - NoraCodes 4y ago
    I definitely see your point, but when there are, at minimum, dozens of people who are willing to undergo that 20 hour slog, I'm glad there's a tool that makes it take mere minutes to find OSINT leaks myself. I'm not saying you're necessarily wrong in general. It's possible this is bad for the world. But I maintain that for myself and the people I care about, it's more useful than it is damaging.

mod 4y ago

I agree. I think this publication is a net-loss for the world, for sure. People will find and use this code--people who could/would never create it themselves. It will be used for many reasons, but the stalking is the most obvious. Not all of my usernames are as resistant as this one, unfortunately.

rtev 4y ago
Is it better for only malicious actors to have access to this tooling? If both teams don’t have the same tools, there isn’t a level playing field. If this wasn’t on GitHub, we wouldn’t be aware of it. However, it would certainly be circulating on underground forums. Is blissful ignorance better?
- archevel 4y ago
  I think the argument is more that this tool by virtue of being easily accessible creates more malicious actors. Similar to how most people wouldn't steal a locked bike, but a larger portion would steal an unlocked one. It isn't that much harder to steal a locked bike vs an unlocked one, but the threshold is just a tiny bit higher so more people will attempt it. Conversely this tool lowers the threshold for stalking, so more people, who otherwise wouldn't, will use it maliciously. That isn't the fault of the tool or its developers, but it is something to be aware of when building any tool. When you release it, it may get abused by people for bad purposes.
  - rtev 4y ago
    Assuming your online identity is secure by obscurity is not a realistic option. If all it takes is a flashlight for everyone to become “vulnerable”, we need to just assume the light is always on. Someone handing out flashlights just highlights the bigger problem. If this truly causes worry, adopt better opsec and create generative usernames for different sites. If not, assume anyone will easily be able to link your bowel issue subreddit comments to your LinkedIn profile.
- Springtime 4y ago
  I feel this is similar to Firesheep[1], a browser extension from a decade ago that put cookie session hijacking into the hands of everyday users and became wildly popular until its removal. Pre-Snowden it pushed various major sites to implement HTTPS encryption, including Facebook[2]. Granted there the solution was a rather simple one but I feel it's at least worthwhile for more to be conscientious of singular identities online and what info is disclosed publicly with them. [1] https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep [2] https://threatpost.com/facebook-kills-firesheep-new-secure-browsing-feature-012611/74883/ https://threatpost.com/facebook-kills-firesheep-new-secure-b...

JustHiThere 4y ago

Wrong approach imho. This means, all the tools developed for ethical hacking are "bad" because they can used for "bad". This is like saying we shouldn't sell knifes because knifes can be used to kill someone. It's just silly. This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc ...

ohgodplsno 4y ago
A knife has many uses, from cutting wood to stabbing people. This tool is very much specialized in the stabbing (not necessarily people, as you said, you could stab a ballistic dummy to see the damage it does). Do you really a think a stab-only knife should be sold with no background checks, with no tracking of who buys it ?
motoxpro 4y ago
We could debate where they are but surely there are limits? I wouldn't want everyone to have access to things like Pegasus (https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-identified-in-mexico/ https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-ide...). You could argue Pegasus could be used to hack a phone of a child predator to save a life, just as you could argue this tool could be used to educate. Maybe for you this username tool falls outside of yours, but it looks more like a switchblade than a butter knife to me.
nottorp 4y ago
> This tool could be used to teach people, e.g. in OSINT challenges, it could be used to gather information for a pentesting job, it can be used to teach people about best practices online etc Or just... look yourself up. Like most of the people on this HN thread have done.