12 ms·
Sherlock: Hunt down social media accounts by username across 400 social networks
- webdevladder 2y agoReminder that malicious impersonation is common and easily automated with LLMs.
- noworriesnate 2y agoIt doesn't even have to be malicious if you have a common username.
- mrkramer 2y agoNice OSINT tool.
- pluc 2y agoSo what's a non creepy use for this?
- hn_throwaway_99 2y agoI think the "non creepy" use is really just making people aware how easy it is to correlate all your different traces online. It's like when someone released on HN a tool that would link various HN accounts (and maybe Reddit accounts too IIRC), but by looking at commenter word choice similarity. It makes people realize that actual anonymity online is a smokescreen.
- deadbabe 2y agoFinding usernames that you can register and own across all social networks.
- anticorporate 2y ago*For some very narrow, twisted definitions of the word "own"
- hooverd 2y agoThat's the great part- there isn't. Following people you like on every platform I guess.
- diogonr95 2y agoIt’s also a great education tool to showcase the need to be careful about internet hygiene. The creeps have done this sort of things for decades
- deleted 2y ago[deleted]
- lupusreal 2y agoLike hiring a PI to follow people around to educate people about about stalkers.
- jedberg 2y agoSeeing what it finds about yourself?
- mrkramer 2y agoCybercrime research; locate malicious actors across social web.
- deleted 2y ago[deleted]
- some_random 2y agoRealistically it's doing this to people who deserve it, trouble is that no one is going to agree on that criteria
- s1artibartfast 2y agoWho deserves it, and what is "it"?
- Mountain_Skies 2y agoTo socially harass and drive to suicide anyone that doesn't conform to the dominate cultural outlook. Think that's creepy? Well, you just made the list!
- yieldcrv 2y agoI’m on a lot of lists and still have TSA Precheck, Global Entry, can hold US security clearances, pass professional background checks so what are you lesser relevant people worried about exactly?
- noman-land 2y agoWhat lists are you on?
- Tepix 2y agoIs it creepy if you google a job candidate?
- naavis 2y agoIn many parts of the world it is illegal for a recruiting party to search for information on a candidate without their consent.
- Tepix 2y agoWhat are laws that prohibit it?
- naavis 2y agoOne example is Finnish legislation: https://finlex.fi/fi/laki/ajantasa/2004/20040759#L2P4 https://finlex.fi/fi/laki/ajantasa/2004/20040759#L2P4 Sadly only available in Finnish. The law applies both to employees and candidates. EDIT: Looks like there is an English translation. See section 4 of: https://finlex.fi/en/laki/kaannokset/2004/en20040759_20190347.pdf https://finlex.fi/en/laki/kaannokset/2004/en20040759_2019034...
- JSteph22 2y agoWhichever parts of the world that may be, you can guarantee that it happens anyways. Unenforceable rules are never followed.
- steelframe 2y agoI recently Googled myself, and in the first page of results I ran across some shit AI website that scrapes random web content about people and attempts to summarize it. It got my current occupation completely and comically wrong -- as in, it has nothing at all to do with tech. If you're trying to figure out anything about me from social media or other such random web pages, I don't care to have anything to do with you, and I don't care what you're led to believe about me. I suppose this is born of privilege, but the only contacts I care to make are directly via people I already have a relationship with.
- EGreg 2y agoLetting a person sign up on your site and choose to import stuff they've put onto other sites under that username, maybe.
- fragmede 2y agoClean up the online footprint for someone that hires you to do so before they run for office. I don't remember every single web site I've every signed up for going back to when I started using the Internet, and neither can you.
- pluc 2y agoInternet Archive likely renders that point moot, no? There a plenty of sites that index tweets outside of Twitter for example... at least there used to be
- jdiff 2y agoThe Archive is much less discoverable. There's no search engine for the wayback machine.
- deleted 2y ago[deleted]
- sureglymop 2y agoYou can request them to take down personally identifying information about yourself. They respond quickly and seem to have someone employed to handle GDPR requests.
- gotoeleven 2y agoThis will be very handy because when I see someone post something I disagree with on HN I can also go downvote them on reddit and swipe them in the ugly direction on tindr and/or grindr. I am justified in doing this because everything I don't like should be banned.
- penguinburglar 2y agoDon't forget to report the reddit posts for suicide concerns.
- immibis 2y agoFor the unfamiliar: this causes a reddit-owned bot to send them a passive-aggressive private message telling them how not to kill themselves. There's no way to know who caused it to be sent.
- jmyeet 2y agoRemember when IPv6 decided on 128 bit addreses and defaulting to /64 blocks because someone thought using a 48-bit MAC address as the IPv6 equivalent of a port was a good idea? Fast forward a decade or two and we realize how this is a PII leak issue so nobody does it but we're still stuck with 128-bit addresses (for those who use IPv6). There are several things that are a security issue or simply a privacy issue. These include: - Your username (as I assume this tool is demonstrating) - Your email address. While this is treated as your "public identity" to some extent, I think we're rapidly approaching a point where we need to not do this; - Your phone number; and - Your profile pic. I would advise to never use the same pic across accounts and certainly don't use services like gravatar (if that's still a thing). Email is particularly problematic because you can end up on spam lists if a site is compromised and you can't really identify where it comes from. What I think we need is a more integrated solution for logging in and creating throwaway addresses (eg like SimpleLogin) so it's basically seamless. Gmail seems well-positioned to do this. I honestly don't know why Google hasn't done this. Interestingly, Facebook Groups seem to handle this kind of anonymity reasonable well. Each group your in is a separate profile. You can't find out what other groups someone is in from either their personal identity or any group's identity. Weirdly, your FB profile is associated with any pages or profiles you comment on. It should be clear to these companies by now that people want to silo their public identities (aka pseudonomity).
- gonzo 2y ago> Remember when IPv6 decided on 128 bit addreses and defaulting to /64 blocks because someone thought using a 48-bit MAC address as the IPv6 equivalent of a port was a good idea? No, I don’t, and I’m well-aware of EUI-64. IPv6 uses 128-bit addressing because some on the design committee or making comments on the drafts thought that 64 bits might not be enough.
- immibis 2y agoYou're not required to put a MAC in the last 64 bits, but the fact that your ISP has to give you at least 64 bits is very cool. Privacy addresses are random and periodically rotated. The IPv6 equivalent of a port is a port.
- tonmoy 2y agoFor people who want to have a professional social presence (FB/linkedin) as well as an anonymous one (Reddit etc), it’ll be super useful to see if the accounts are truly unlinkable. Moreover if you are opening a new anonymous account, maybe a good idea to search the new username using this tool to make sure it’s not “taken”
- dylan604 2y agoUntil some ML process is learned to give a probability that accounts are the same based on writing styles Staying anonymous is very difficult
- cootsnuck 2y agoThen people will start using browser extensions that automatically "fuzz" your writing style randomly. That is, if chasing anonymity is someone's true goal.
- mikeodds 2y agoUsing stats this is called stylometry and I agree this will probably be easier at scale now. You can also match posting windows, pull additional features from database dumps/hacks. Fun post applying it to HN, not sure if the site is still live: https://news.ycombinator.com/item?id=33755016 https://news.ycombinator.com/item?id=33755016
- philipkglass 2y agoStylometry tools may be useful if you already have a small candidate pool of suspected aliases. They produce too many false positives to be useful for blind cross-linking of accounts. Once or twice somebody has done stylometric analysis of HN accounts and I've looked at the results for my accounts. Even though I don't try to obscure style across accounts, stylometry didn't match my actual accounts with each other. My top matches were for accounts controlled by other people.
- deleted 2y ago[deleted]
- 2y ago
- s1artibartfast 2y agoI dont plan to run for president or anything, but find myself increasingly censoring my online speech. I think the biggest risk is some out of context post being pulled into a civil suit, or professional cancellation following that. Things like advice in an alcohol recovery forum would be prime evidence for a liability suit. There are also groups that vacuum the internet for offensive posts, and use them to try to get people fired for things they said 10 years ago. At this point, I assume all internet activity can and will be de-anonymized, and restrict my speech accordingly. I'm sure there are some meaningful precautions and nuances, but it is too much to keep up with.
- yieldcrv 2y agoBeing authentic is the ticket to public office now I’m kind of glad that the value of blackmail futures has plummeted to zero I always thought millenials would be the culprit because millennials have so much online, but nope, it was just old fashioned baby boomers that have spearheaded it and double down on their indiscretions to be the role models for the country’s top offices
- CRConrad 2y ago> Being authentic is the ticket to public office now Yeah, if you can fake that, you've got it made.
- exe34 2y ago"criminal activity?" "no sir." "for god's sake Baldrick, you're running for parliament. I'll put fraud and sexual deviancy."
- echelon 2y agoOnly for this cycle. The pendulum will swing back to cancelling and pitchforks after this era of cult of personality.
- EGreg 2y agoI thought canceling never stopped. It was just politically motivated. (Ironically, Dems eat their own for that stuff, so maybe "politically motivated" doesn't quite capture it... compare e.g. Al Franken and Katie Hill vs Roy Moore or Matt Gaetz)
- Tepix 2y agoAnd this makes it obvious why you should use a unique username everywhere! It makes pervasive tracking a lot harder. Also when you do any research on health related topics, be extra privacy conscious.
- dylan604 2y agojust to be slightly pedantic as there are still sites that have screen names vs account names where the screen name the public sees has no correlation with the account name (typically an email account). so don't re-use email accounts across sites. SecOps matter
- Tepix 2y agoYes, another thing you can do is use email subadressing for every account you create, ideally with a non-default separator (i.e., not "+").
- dylan604 2y agoDoesn't this subaddress all just resolve to the same account? The accounts are free, so just make up a completely different account. Yeah, it might get a bit of a mess for a user to manage, but that's what password managers are for. let's face it, we're not talking about Joey Beercan doing this. Anyone even tossing around the term SecOps is already moved out of mass populace and into the somewhat informed. Someone practicing SecOps would definitely be the type to use some sort of credentials management. So I don't think unique totally unrelated emails is too much of a burden. Using different free email providers is even better.
- immibis 2y agoGmail accounts aren't free: I believe they only allow up to 4 to be linked to the same phone number (which is mandatory). Microsoft is worse: they'll let you create an account, then lock it the next day, after you've already used it for something, if you don't link your phone number. Phone number is used because it costs money to get, is hard to get in bulk, and in many countries is always tied to your identity. I wonder what the market for throwaway phone number verification is worth.
- blindriver 2y agoI haven’t used my real name online since the late 1990s once I realized things are stored forever.
- jackconsidine 2y agoI’ve successfully used Sherlock to track down a colleague that I only connected with on MeetUp. It’s an amazing tool. Worth running on your own usernames as an easy account inventory
- ksynwa 2y agoIs it querying an offline or an online database? Because if it's the latter I hope people don't give it their various disparate usernames allowing them to link them together.
- jdiff 2y agoIt doesn't query a database, it queries the individual sites. https://github.com/sherlock-project/sherlock/blob/master/sherlock_project/resources/data.json https://github.com/sherlock-project/sherlock/blob/master/she...
- geor9e 2y agoIt's essentially a loop that fetches www.whatever.com/username and does a regex for "user not found". It then outputs a list of links, to possible profile pages. Pretty simple tool, but speeds up a standard investigation technique.
- EGreg 2y agoWorth noting that the search bar on top searches the site / code, and is not part of the actual search by username!
- n8henrie 2y agoI get this error upon first run, both with pipx and with a regular venv: https://github.com/sherlock-project/sherlock/issues/2294 https://github.com/sherlock-project/sherlock/issues/2294
- throwaway78122k 2y agoWhat's this tool vs typing a user name in google to find similar to same info?
- betaby 2y agoEven less useful than google for couple of monikers I tried.
- lakomen 2y agoWhy is this not a website but I have to install something?
- ivanmontillam 2y agoI would assume it's because checking usernames using your own IP address leads to better results while making it a website would forcefully make it a SaaS (to cover cloud costs). I'd argue instead why is this not a GUI? Making it a CLI makes it less user-friendly.
- keyboardJones 2y agoI would guess to prevent IP address blocking, or offloading responsibility Edit: added “to prevent”
- pimlottc 2y agoBecause not everything is a website?
- Gooblebrai 2y agoThe tool didn’t work as well as I expected. It claimed to have found the username I entered on 40 websites, but when I followed several of the provided links, they led to 404 error pages.
- saturn8601 2y agoFurthermore it seems to be showing false results for some domains regardless of whatever you type.
- casey2 2y agoIt's a really overengineered fn() { browser site1/$1 site2/$1 ... } Tools like these insult the users' intelligence and generate needless drama[1] the only data needed are the urls from https://github.com/sherlock-project/sherlock/blob/master/sherlock_project/resources/data.json https://github.com/sherlock-project/sherlock/blob/master/she... [1] https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to_github_and_i_have_lots_to_say/ https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to...
- immibis 2y agocollecting that data is worth something.
- antoniojtorres 2y agoThat person on the reddit example is as caustic as can be. Perfect example of a nightmare open source user.
- KetoManx64 2y agoI don't think so. He doesn't care about the source code or want the source code. He just wants an executable file. If there was the exact same project that was closed source and had an .exe file he would have never even gone to the github.
- throwaway519 2y agoTermux should be supported soone4 from default. No pkg package.
- domoregood 2y agoInteresting tool, but it generates false positives. Try Sherlocking some randomly generated usernames that cannot possibly exist and it will still return results for some of the URLs in its list.
- rramadass 2y agoReminds me of this excerpt from "A Study in Scarlet". 'Have you read Gaboriau's works?' I asked. 'Does Lecoq come up to your idea of a detective?' Sherlock Holmes sniffed sardonically. Lecoq was a miserable bungler,' he said, in an angry voice; 'he had only one thing to recommend him, and that was his energy. That book made me positively ill. The question was how to identify an unknown prisoner. I could have done it in twenty-four hours. Lecoq took six months or so. It might be made a text-book for detectives to teach them what to avoid.'
- buildsjets 2y agoOh noes I hope they don't find my USENET posts from between 1992 and 1997.
- ksajadi 2y agowait, there are 400 social media networks?
- CRConrad 2y agoWait, there are only 400 social media networks?
- casenmgreen 2y agoThere's a UI design element here which I don't like. The UI presents a text field which is for entering search terms. You click it and expect to type - but NO! - SURPRISE!!! it's actually a button!! And now the page changes, pops up an actual text field, somewhere else and new, and you abruptly are forced to set aside your thoughts about search to process the page layout a second time and go and click again to type in a term. Why on God's clean Earth would anyone ever do this?
- deleted 2y ago[deleted]