15 ms·

Help me figure out how I lost this bet to an engineer

193 points by SteliE 13y ago

woodchuck64 13y ago
Well everyone's on his/her phone these days, so let's assume a second picture caught her busy with her phone. Highly doubtful a photo would be high-res enough to get text-level detail but certainly the general layout and colors of whatever she was looking at would show up. So if this led to a successful ID, she must have been looking at an app or page that is user-customizable to some extent like facebook with a unique profile and cover. If you have even a blurry image of a website, the RGB colors are still going to be pretty close so if you have some sort of way of automatically iterating through user pages on the website in question (GraphAPI), doing direct page capture to image, scaling down that image, doing the appropriate rotation, shear, etc., and then running some simple image match criteria, that "might" work. Facebook has billions of users though which surely would take more than 24 hours to iterate through, so maybe you could prune the search space by only searching friends of people claiming the high school graduation year in question.
jbg331 13y ago
I can confirm there is no GPS coordinates embedded in the photo
- DanBC 13y ago
  In the actual photo? Is there any meta data? Is there any EXIF data? What was the photo filename, and what does searching for that (with increments up and down) return? To try and guess what happened:- 1) One of them followed you and got information. (You say this didn't happen.) 2) They had information about the event and worked from there. 3) There were other people in the photo, and they got face-matched, and their friends lists were not hidden, and they got it from that. 4) They had snippets of other information and just trawled through very many searches to get the name. I'm a bit confused how they didn't already have her name. You told them you met someone, but didn't give any kind of name?
  - mithras 13y ago
    That high school she went too might have been a pretty good lead if you know her approximate age.
  - jbg331 13y ago
    I am positive they didn't do number 1. I am positive they didn't have number 2 There were no other people in the photo What other snippets of information would be useful? And they never met her, only I did. So they didn't know her name. And yeah, I said "I met a cute girl." I didn't say I met "name"
sliverstorm 13y ago
If they knew her high school and were doing lots of batch processing, I wonder if they found digital copies of the yearbook and tried facial recognition. For a single subject, it doesn't even need to be particularly accurate- they can easily sift through twenty possible matches with their own eyes.
- philfreo 13y ago
  We were unable to find a digital yearbook
AsymetricCom 13y ago
I'm sure there's a lot of information missing from this story, which leads to a lot of possible solutions that aren't negated by the lack of limiting circumstances. More than likely the author is an idiot and the image had EXIF data. Considering they already knew her highschool, it wouldn't had been to hard to go through the year books in a few hours.
- jbg331 13y ago
  I resent the fact that you think I'm an idiot. I have had two engineers check for EXIF data and there is 'nothing interesting in there'
  - Pxtl 13y ago
    Heh, geek blog effect. Reddit et al have created some very bad habits of dialogue, such as assuming the subject of a link isn't reading it. And being nasty with candor. I still remember the time I said something impolite about David Brin. Brin took offense and replied. I'm actually a huge fan of David Brin. That sucked.
    - AsymetricCom 13y ago
      I'm not sure where you go the idea that pseudo-celebs and IT managers are immune to stupidity or posting stupid articles. There's always an element of "who cares if my content sucks, lets just get it done" when posting bloggy stuff, and it's pretty apparent here. Calling EXIF "back end stuff" is pretty stupid, I don't care if the author's ego is bigger than that statement, it's still true. The article might as well be how many apples fit in a bag or how long is a string.
      - Pxtl 13y ago
        http://cdn.memegenerator.net/instances/400x/37048520.jpg http://cdn.memegenerator.net/instances/400x/37048520.jpg edit: I'm aware of the irony in criticizing online geek culture and then bringing out a foul-mouthed meme pic.
    - 13y ago
mrspandex 13y ago
I think the key is knowing what high school she went to. From there, you could possibly get yearbook pictures and student lists. Knowing an approximate age would narrow the possibilities significantly as well.
- evan_ 13y ago
  I would probably take a social engineering approach to this problem- if you knew her high school and approximate age you could probably find someone who was in that class who would know her pretty easily. At that point it's just a matter of either tricking them into identifying the photo or just straight-up asking them.
  - jbg331 13y ago
    They knew what high school she went to (I just found out), but probably didn't know exactly how old she was. There are no digital yearbooks from the high school. I checked
  - swamp40 13y ago
    Or scrolling thru a classmates friends list on Facebook. And then scrolling thru all the friends lists of all their friends on Facebook. (Especially if they have nicely sorted their friends into "High School" friends.) Twitter lets you do the same thing. I've seen entire classes all "Friend" and "Follow" each other.
iterationx 13y ago
http://www.tineye.com/ http://www.tineye.com/
ngoel36 13y ago
Assuming that she didn't show up in a reverse Google Image Search, maybe they used some sort of facial recognition API (like http://www.lambdal.com/ http://www.lambdal.com/), perhaps along with the other people in the picture, against scraped pictures from LinkedIn and Facebook based on her appx age, location (Austin), gender (F), and high school. At least that's what I might have done.
deleted 13y ago
[deleted]
evan_ 13y ago
At this point he could not see my screen (he was standing directly in front of me), but offered me a simple bet – He said if I sent him the picture of the girl he could find out her name. Reminds me of: Sky Masterson: One of these days in your travels, a guy is going to show you a brand-new deck of cards on which the seal is not yet broken. Then this guy is going to offer to bet you that he can make the jack of spades jump out of this brand-new deck of cards and squirt cider in your ear. But, son, do not accept this bet, because as sure as you stand there, you're going to wind up with an ear full of cider. http://www.youtube.com/watch?v=d8Wvgs9q3js http://www.youtube.com/watch?v=d8Wvgs9q3js Simplest explanation: He knew before he made the bet.
- philfreo 13y ago
  > Simplest explanation: Someone saw you and told him. Of course one of the first things I did was ask another friend who I thought met her. But no, ultimately the answer did come from the internet, not from anyone I knew.
philfreo 13y ago
I'm the engineer he's referring to. I still get a laugh seeing Justin's amazement when we told him her name. To answer a few questions... - This isn't the actual photo but looks similar, except that she was alone. Justin was afraid of reposting the same photo after the results of handing over a photo last time :) - There was no useful exif data in the image. - We knew her high school and approximate age in Austin, but were unable to find any yearbooks / class rosters online. (Idea not pursued: try to acquire a yearbook offline). - Facebook Graph Search and LinkedIn with the criteria we knew didn't help. - Google Image search didn't help. > "I'm sure there's a lot of information missing from this story" Quite true. Ultimately we had several methods going at once to try to figure it out. The one that came back with results first relies on some information Justin still doesn't know we had (though he would still be impressed), but other approaches we also expected to work would be possible with only what's in the story, and haven't yet been mentioned here. EDIT: shared more at https://news.ycombinator.com/item?id=6369751 https://news.ycombinator.com/item?id=6369751
- antr 13y ago
  tineye.com or similar?
  - philfreo 13y ago
    no luck
- fnordfnordfnord 13y ago
  Justin's own phone leaked his location (through some google-lattitude, or Yelp like service or perhaps gps directly) while Justin drove (or rode with her in a taxi) to her home.
  - philfreo 13y ago
    good idea, but not the case here.
  - jbg331 13y ago
    How would they have gotten my GPS location? And how would they have figured out which one was her house. I was in her neighborhood and stopped multiple places that were 'significant' to her as a kid. Any of them could have been her house. And I wasn't at anyone for more than 60 seconds
jmillikin 13y ago
Why not ask them? If your engineers as self-satisfied about finding her as it sounds, then they'll be happy to describe their process over a beer or two. I've never known an engineer who doesn't like discussing how they solved some riddle.
- nrivadeneira 13y ago
  The engineers were made to beg for info on the girl, so they might be getting some satisfaction from keeping a secret from the author in return. I know I would. Give 'em a taste of his own medicine. Also, if it was a relatively simple solution, it's probably more exciting with some mystery overlaying it rather than just explaining it outright.
  - philfreo 13y ago
    You got it... exactly this!
oh_sigh 13y ago
How are you surprised that they did it when they knew what high school she went to? Two possibilities: Option 1: Step 1) Find copies of yearbooks going back a few years, 2) find her face in the yearbook. Option 2: Step 1) Search facebook for people who went to the same high school as she did in the probable time frame. 2) Look for her in that set, or in the set of friends that the people who matched the search have. Feel free to sprinkle in face detection on the yearbook/facebook photos to make it more engineer-ey. As a matter of fact, how did they find out what high school she went to? I can't imagine you telling them that if you were not providing much information about her to anyone else.
- jbg331 13y ago
  They knew what high school because it was a slip up. If you knew these guys, they aren't the kind who would just sit there and look at pictures. They had some software running. FYI, I am a sales guy...not an engineer
  - georgemcbay 13y ago
    > If you knew these guys, they aren't the kind who would just sit there and look at pictures. As someone who has been a software developer for quite a long time, this statement makes a big assumption. A good software developer knows it is often far easier and faster to flip through a couple of hundred photos and process them with your meat-brain rather than write a one-off bit of software to do the matching, even if you start from an existing base like OpenCV or whatever.
  - smoyer 13y ago
    Having software running doesn't preclude using your brain - first to consider possible heuristics and then to do the types of analysis computers aren't good at. There's a reason mechanical turk exists.
  - oh_sigh 13y ago
    > If you knew these guys, they aren't the kind who would just sit there and look at pictures. That's why I said "Feel free to sprinkle in face detection on the yearbook/facebook photos to make it more engineer-ey."
cperciva 13y ago
Where was the photo taken? What was in the photo other than the girl? If the photo was taken at her home and there is any landscape in the background, the obvious initial point of attack would be to identify the location the photograph was taken.
swamp40 13y ago
If you know the high school and year(s), you go thru the friends list of every person on Facebook who did post their high school from that year (or nearby years), and does show their friends, until you see her face. That's only a couple hundred kids, each with a couple hundred friends. If you still get nothing, start doing friend requests for the people that don't show their friends. I'll bet you'd get another 25-30 kids that way. I don't see why you'd need facial recognition software to go thru 20,000 pictures. 3/4ths of them would be the wrong gender/age and be immediately disqualified. But if you're a programmer, you can probably scrape and aggregate to speed things up - drop out the males, other high schools, only show pictures once, etc.
noconflict 13y ago
waiting for someone to post her name and address
domdelimar 13y ago
Did the girl leak the information? Like mentioning his name/twitter handle or something like that?
dkb 13y ago
Philfreo > I think that the girl did share something with you that Justin doesn't know, such as something that she did accomplish in that school, like winning some kind of award, winning a competition or something similar. Then, you used that information along with the name of the school in Google.
wtracy 13y ago
I wonder what the resolution of the original image was? The inside of her thumb is visible through the glass, so with enough detail it might be possible to record her thumb print. Even if you could do that, though, odds are against her print being present in any publicly-available database.
- philfreo 13y ago
  Congrats on having the most far fetched idea of all of the ones posted here :)
cbhl 13y ago
One of the things that looks like a clue to me is that this the lead engineer of close.io. Browsing through their site, it looks like they do "telecom in an API"; it reminds me of Twilio and OneBox. So, here's a thought. Let's say the Engineer has access to the SMS logs (NSA-style) for Justin's phone. (Maybe his phone goes through their system. But even if not, maybe it's company-provided, so there's an admin interface provided by the telecom that lists this information.) Justin probably doesn't regularly text people in Texas, since the team is based out of Palo Alto. So look through his logs for a number in a Texas area code (http://en.wikipedia.org/wiki/List_of_Texas_area_codes http://en.wikipedia.org/wiki/List_of_Texas_area_codes) that he's been texting more often than usual. That gets you the girl's phone number; probably a cell phone. Now, you need to go from the cell phone number to a last name. Reverse Phone Lookup probably won't work for this, although it's certainly worth a first try. More likely candidates: looking through the users table at close.io for a matching phone number, or doing a google search for the phone number. Or, try calling in the middle of the night and seeing what the voicemail says. Any of these approaches might work. Once you've got a last name, grab a copy of the white pages. Most public schools publish their district boundaries, so go grab a copy of that. Look through all entries that match the last name, and see how many of them fall within (or close to, in the case politics made the boundary change) the district boundary. You probably will get a handful (maybe three or four). If you only get one, bingo! If you get more than one, I'd call the cell phone to see if I can get a first name somehow. Then, I'd go through the landlines in the White Pages and call them one at a time, "Hello, may I speak to X? Sorry, wrong number." until one matches.
- philfreo 13y ago
  I love this explanation. But unfortunately there was no telephony hacking of any kind as this was just an ordinary personal cell phone. I did have an idea that we could try to hack his Verizon account to look at his SMS log, figuring that Forgot Password questions might be easy or that we could intercept an email. But we didn't do this.
- kennywinker 13y ago
  Since the point of this article is probably to promote their company, having the answer be "our engineers looked at your private information for a prank" seems like a no go.
Vistz 13y ago
Hm. Did you guys use the Prism API by any chance?
scott_s 13y ago
Saying she "doesn't exist on the internet" is a big assumption. First, she is on Facebook, so she's on the internet, easily accessible or no. Second, most people leave some internet trail through online forums, newspaper articles and newsletters. I find it very likely that she was found on the internet somewhere.
pearjuice 13y ago
So basically the engineers knew something specific about the girl already which narrowed their data set. Unless they tell you what that was, we can go all day long guessing how they "figured" it out. In fact with this information I am interested in the actual time taken to find the girl. They could have found her in five minutes after receiving the picture and you wouldn't know. Why? From the article: 1) They were running software on a computer for hours They are engineers! 2) The first couple of tries didn’t work Are you sure they weren't debugging? 3) They knew what high school she went too prior to searching If they know the high school they only have to find one or two established teachers who were around for a long period of time. It is not unlikely they can call a name from a picture after all those years. This smells like viral marketing to me (too bad I still don't know what close.io is, should have added some information to the article. Or are you looking for new engineers? "Hey look! At close.io we seal bets with engineers. About girls! Come work for us!").
fnordfnordfnord 13y ago
Justin had another photo of her in his tumblr with metadata?
broostoryco 13y ago
He sent the picture to his buddy at the NSA who performed an image search with facial recognition on all images ever transferred over the internet.
oe 13y ago
She checked in with Foursquare? Some people still use it.
- helicon 13y ago
  He said she only bought the dress recently. They did a image search and found a local store that stocks that particular dress - and she had checked in with foursquare?
jbigelow76 13y ago
>My Ask Nails on a freaking chalkboard. What is so bad about the word "question"?
- sp332 13y ago
  It sounds terrible and is awkward to say.
  - marze 13y ago
    But has half as many syllables thus takes half as long to say/type. Who likes wasting time?
- qu4z-2 13y ago
  To me "My ask" translated to "My request", not "my question". Having said that, it still sounds a bit lost in time.
socialist_coder 13y ago
This is obviously a shill post setup to advertise close.io and HN fell right for it. Why would this post be hosted on the close.io blog and not on a personal blog? It has nothing to do with close.io. Why would he mention close.io so many times? Why would he ask about the quality of the "close.io engineers" instead of just his coworker or friend? Smells fishy to me.
- philfreo 13y ago
  So you're saying that http://close.io http://close.io not only has good engineers but also is good at marketing? Maybe you should check it out if you're looking for sales software then :)
  - frogpelt 13y ago
    The girl doesn't exist! Edit: The girl is Lennay Kekua!
  - kjs3 13y ago
    1) He did not say either group was 'good', and implied quite the opposite. 2) As someone who purchases things like enterprise sales software, this exercise does not entice me to consider your product. Ever.
- S4M 13y ago
  I was thinking the same, and expected the answer to be something like "Phil used the API provided by Close.io that invert google picture search and was about to get her name", but it turns out Close.io doesn't do anything related. But yeah, the post clearly emphasizes that they have smart engineers.
  - dlss 13y ago
    Yep. Nothing's as good as finding out someone's name to prove you're good at writing webapps... oh wait :p
- photorized 13y ago
kouiskas 13y ago
Some ideas... - using tools like http://www.pictriev.com/ http://www.pictriev.com/ or similar offline solutions to get a pretty good estimate of her age. - using image analysis to "fingerprint" the camera used to take the picture. Then crawling sites where she would be likely to post pictures (twitter, etc.) based on the suspected area and comparing to find matches (i.e. pictures taken with the same camera). I'm not sure what the current state-of-the-art is for those algorithms, but if for instance the camera displayed an obvious visible flaw (darker spot), it would have made it easier. On a perfectly clean camera without visible defects I assume that more than one picture is necessary for effective camera fingerprinting. - using tools like http://graphics.cs.cmu.edu/projects/im2gps/ http://graphics.cs.cmu.edu/projects/im2gps/ to try and determine the location just based on visual features.
hkdobrev 13y ago
Here is how I think it was done: I assume the author is not a Facebook friend with the girl. Otherwise it would have been too easy. But friends of friends is not the only privacy leak on Facebook. There is a very old feature (which is about to get deprecated) called Networks. Networks are created for schools, universities and other big organizations. They had the name of the high school so they have to list it as their own high school in their Facebook profiles. This will automatically put them in the same network as the girl. I am assuming here that she has listed that on her Facebook profile. Then performing a graph search for women who has gone to that high school and live in Austin with an age between X and Y will narrow the search a lot. Even if some of that information is not public on Facebook it would be public to them if they are not same network if she has the default settings. This is a neat trick which is still usable. I don't think looking through the pictures would take more than half an hour.
- michaelmior 13y ago
  From the engineer in question "- Facebook Graph Search and LinkedIn with the criteria we knew didn't help." https://news.ycombinator.com/item?id=6369519 https://news.ycombinator.com/item?id=6369519
emhart 13y ago
jbg331 - while we wait for people to ferret out the right answer, can you tell us how the woman in question has responded to the "game"? Genuinely curious.
- jbg331 13y ago
  Surpringly well. I told her about the bet and she took everything in stride. She actually laughed when I told her. Shes a pretty awesome girl
  - emhart 13y ago
    Very glad to hear that :)
- karanr 13y ago
  She thought it was funny!
olegp 13y ago
Hate to sound cynical, but this seems like an attempt to solicit responses to identify good engineers to hire or promote some upcoming feature of the web app.
realrocker 13y ago
Really people? You are going to give ideas to track people to the general crowd. It's not even an exceptionally technical problem.
lifeformed 13y ago
I'm guessing it has to be something to do with facial recognition, since he asked for the picture without knowing its contents (other than that it has her face in it). From there, if he had an idea of where they went that night, a club or bar, perhaps he could do some Facebook/Twitter searching magic to search for pictures of that night, taken by other people. Then they could look for her face in the background. Not sure where to go from there... perhaps they got lucky with one of the pictures being tagged with name. Or perhaps they identified everyone she was shown to be associating with, and found intersections in their Facebook friends list? Does it have to do with Facebook?
lifeformed 13y ago
The answer is probably simple. Social engineering. Find someone who went to the high school, then send them the picture and ask who it is. Concoct some reasonable non-creepy story like "I found this person's wallet and I want to return it".
waterside81 13y ago
Since the reply is buried down below, here's how they did it: https://news.ycombinator.com/item?id=6369859 https://news.ycombinator.com/item?id=6369859
- michaelmior 13y ago
  Actually, if you read the fully reply, that's NOT how they did it. They ended up finding her via another approach. Phil mentioned the other approach which he thought would have worked.
  - swah 13y ago
    I fell for the same thing, the wording is ambiguous in the first sentence. :)
gregors 13y ago
Knowing the high school and approx age in Austin... You probably know the year she graduated, you can run subsequent queries using +-1 based off of that graduation year. What you're after at first are rosters. The end goal is to place a picture for each name discovered. Over 10 years since high school graduation? I'd be looking at one of the classmate or facebook groups regarding reunions. Less than 10 years since graduation? I'd still look trying to compile a list of names from these places. Old high school sports and club rosters maybe? Build a graph of people who did go to that high school during those years. Start building 1 degree of separation. Once you've gotten a list of names, start cross referencing local groups, meet ups, colleges starting with the University of Texas -- possibly even spamming people using generated you've collected )lastname_firstletter@utexas@edu). Perhaps a phishing Email as follows "information regarding blah blah, looking for the person in this pic, we think they left their purse/cell phone etc"? Or post something in a local Austin Reddit. I'd also do simple searches based on individual names and generated college emails. Start cross referencing all college clubs past/present with names and/or generated emails. If the person is/was in graduate school they will probably have even more school related information online. If the person has graduated, start working the job route. Online career profiles monster, linkedIn, facebook. Have they done any sort of volunteering? Lot's of pics associated with volunteer work are out there. 5K results are a treasure trove, location, name and age ripe for searching. Some 5K's have corresponding flickr sets where you can match name to race number to a face. Once you have faces either look at them or run them through some CV for possible matches. Even if the name you've found isn't the person you're looking for such pictures might lead you to them anyway, if that person appears in a picture with your target. If you know that the person you found knows your target, start looking at that person's information. Who do they follow on pinterest, twitter, etc... Does this person own a house do searches against the tax databases for full address of home. Even if the address isn't useful you might learn their middle name - re search with middle initial and middle names in lieu of first names. Look at old social networking sites like myspace - the target might have old profiles up?
ssijak 13y ago
Made an ad campaign on Facebook targeting her high school and girls of her age saying in the ad something like "Click on this link darling, need to see this, Justin Gold ;)" and redirecting her to some fake (made by you) rosy website with hearts on them where she is socially engineered to leave her name. Probably not this, but I would try it for the fun.
b_emery 13y ago
Possibilities: - they looked at signups at close.io after the evening, thus narrowing a list of female names for image searching. They could further limit this to IP's from the austin area. - They bought the ad words 'justin gold', and 'justinbgold'. Then waited for her to google you, thus revealing IP addresses for further googling.
abalone 13y ago
Wow. It is stunning how oblivious nearly everyone on this thread is to how douchey it is to BET YOUR BROGRAMMER PALS THEY CAN CYBERSTALK A GIRL. Advice to woman: Run. Advice to startups: Don't let your sales and engineering teams be giant douche canoes and if they are certainly don't publicly brag about it.
- jlees 13y ago
  I feel like the majority of folk are treating this as a purely intellectual challenge. Which it sort of is (to the HN crowd, since the actual photo information is missing) but please, let's not forget the context here.
- bunkat 13y ago
  Yeah, this was my thought too. This whole situation is just creepy and its even creepier that so many people have a million other ways they would stalk somebody. Sure you can do all of these things, but if you have ethics you just don't.
- philfreo 13y ago
  Or, have some faith in humanity, considering: - This was just a fun bet between friends. Justin really didn't think it could be done and I wanted to show him how a little information goes a long way online. - Justin treated this girl well and she even knew about this bet. - "Look up online" != Stalking - None of the discovered information has been posted publicly online. This isn't even her photo.
  - jbg331 13y ago
    When I told her about the bet she laughed and took it all in stride. She thought it was funny.
    - masterzora 13y ago
      Did you tell her about it/get her permission beforehand? Or did she say something when you met her that indicated it would be okay? If so, great. If not, this is still in the creepy / douche canoe area and the fact that she happened to be okay with it after the fact doesn't really change that.
dlss 13y ago
This is dumb. You can get a private investigator to do this for $100 - $200, with almost surely a better method that Phil used. Given what Phil does, the most cost effective (rational) method he could have used was to spend those hours working, and then pay a private investigator. If he wanted to do it himself, the easiest way is to facebook search for people who went to her high school in the right date range, then ask them who is in the photo. Given the start time and end time, Phil probably didn't do that, he probably browsed their photos & friends until he found her. Not a very good use of time, but it would work. I think guessing the exact method used isn't interesting, because the problem isn't a particularly hard one. He's done the social engineering equivalent of picking the lock on your filing cabinet.
- MAGZine 13y ago
  except that this is an intellectual challenge, more like a puzzle. You could pay a puzzle solver to solve a puzzle, but that defeats the purpose.
  - dlss 13y ago
    http://lesswrong.com/lw/iq/guessing_the_teachers_password/ http://lesswrong.com/lw/iq/guessing_the_teachers_password/ A good riddle is about the best way to do something, not about the way someone else happened to do it.
saalweachter 13y ago
I think what makes this feel creepy instead of cool is that you've just described an exploit without giving any thought to mitigating the threat. So you've found an attack vector where you can get a woman's name and address off the 'net with a picture and a small amount of information. Maybe it doesn't work all the time, but it worked at least once. What are you going to do with that attack vector? Are you going to make an iPhone app, so that others can snap pictures of random women and recreate your exploit automatically? Or are you going to come up with ways the attack vector can be shut down, things that either individuals (eg, the woman herself) or organizations (like Facebook or Google) can do to block the attack?
- philfreo 13y ago
  > What are you going to do with that attack vector? Huh? Nothing... this was a just a fun bet between two friends with no bad intentions. I didn't discover anything, as evidenced by the dozens of others in this discussion with similar ideas.
- VLM 13y ago
  There is some redeeming social value in publicly defusing paranoia. Coincidentally this is 9/11 day... It turns out that anyone of room temp or above IQ can easily do something fairly awful, but the fact it almost never happens provides some faith in humanity that basically no one (on a statistical basis) is actually awful.
gingergirl 13y ago
As someone who happens to be good at finding people on the internet (true confessions), the approach I would have taken would have been related to FB likes, or log-ins at the bar that they met on Facebook. I.e. they were all at the same bar in Austin, so search for people who have checked-in at the bar. And perhaps the other photo the engineers had was another location that she liked, or another piece of information about the bar in question. Then, it's just a matter of narrowing down results based on age and location. The fact that they knew the high school would have made this quest even easier. I once found an individual from a first name and the name of the bar they work at in (comically) downtown Austin. It took forever, but I had patience. :) The internet has all sorts of shortcuts to finding people if you know how to look!
VLM 13y ago
She looks pretty; At least for guys pretty = memorable. When I was single I was pretty bold with the ladies and I'd have flirted with her first (perhaps getting shot down, oh well), remembered at least some demographic information, and then used it to completely F with my coworker's mind for awhile. When I was younger I was quite the practical joker. Note the convoluted written responses about not talking to anyone he knew and so forth which technically does not exclude the girl, herself, saying her own name. The other alternative is she's somebody's buddy/family member so it would be trivial to know before hand that she's so and so's ex or sister or whatever and given that intel, figure it out.
jmccree 13y ago
Is it just me or is this spectacularly creepy? "I bet you can't cyber stalk my friend! I bet you we can!" I could understand if this was at defcon or a security/privacy related conference and all parties involved were in the field, but just cyber stalking some random woman? What's the point?
- OGC 13y ago
  No, it's not just you. It's spectacularly creepy, lacking reflection _and_ a thinly disguised ad for their site/product ("look, our engineers are fucking evil geniuses! Amazing."). And of course, like others already have said, HN fell for it. This stuff should worry you, not be lauded as some kind of amazing engineering feat. 4chan does this all the time and they call it doxxing.
- philfreo 13y ago
  Looking up online != "stalking", and there was no "point" - it was a simple fun bet between friends.
pbreit 13y ago
Reverse image search? Facial matching image search?
- espeed 13y ago
  Google Plus and FB's facial tag suggestions.
somberinad 13y ago
Did you use Tineye or Google Image search to see if there were other photos from the event? A combination of her dress and the time of her arriving there?
telephonetemp 13y ago
Although this most probably isn't the case here, note how making a post impersonating the person who'd lose the bet would be a great way to solicit methods to win the bet.
brownbat 13y ago
Did you recently add her on any social network? Even if her FB is inaccessible, yours isn't... maybe a friend recommendation engine would eventually suggest her if someone just friended and unfriended you repeatedly? Did she sign up for a free trial of close.io?
georgemcbay 13y ago
This thread kind of exists as it does based on the fact that people were assuming there was something clever and software related that lead to the information because that's what the sales guy thinks, but the incomplete information we have from the developers suggests that they simply had a second photo that probably had some kind of identifiable information in it like her name that they saw via ZOOM,ENHANCE and a bit of Google which anyone could have done, even the sales guy. FWIW, as others have pointed out, I do find this a bit creepy too, on two levels. First, the initial bet is a bit creepy. Guy involved said girl laughed it off, but that doesn't necessarily mean she didn't find it creepy that some guy she recently met was betting other people they couldn't track her down Enemy of the State style. And then on top of that, inviting the entire Internet into the game via the second obscured photo adds a much bigger layer of creep on to it, especially since in the process a lot of secondary information on her was leaked. Probably enough along with the photo of her face missing for others to find her, and you've kind of made that a public challenge indirectly. (Not one I have any interest in pursuing because like I said, the whole thing seems a bit creepy to me).
- wojcikstefan 13y ago
  The photo used in the blog post is not of the girl the bet was about.
  - georgemcbay 13y ago
    Are you sure? (serious question here, since I'm not) philfreo said: "This isn't the actual photo but looks similar, except that she was alone. Justin was afraid of reposting the same photo after the results of handing over a photo last time :)" Which to me suggests it is the same girl in a different photo. I would still find it creepy even if the photo is not of her at all, though somewhat less so.
    - jbg331 13y ago
      The photo used in the story is not her. I am 100% certain. The photo in the blog is a picture of a random girl who lives in another part of the country, has different physical attributs, and is a different age than the original girl in question
jimzvz 13y ago
The bet is fine but writing a blog post about it on your company blog is in bad taste in my opinion.
- jimzvz 13y ago
  If I was the girl, I would be pretty pissed off that I was the subject of some kind of marketing ploy.
  - jbg331 13y ago
    This is not a marketing ploy and has nothing to do what our company does. This was a bet between friends, and everyone I told this story to got a kick out of it. That, plus the fact I hoped someone on HN could help me solve this puzzle led us to post the story.
nu2ycombinator 13y ago
My bet is people who gets it right will be contacted by close.io recruiter
- kjs3 13y ago
  Exactly this.
csa 13y ago
tl;dr -- fiverr 1. Compose tactful email text explaining the bet. This is optional if you don't care about tact or a potential negative impact on your or your company image. 2. Go to fiverr and get a person or three to find teachers, administrators, and students who were at the same high school around the same time. Have them send the letter you composed to these potential teachers, staff, and peers. Track with close.io. 3. Get answers and try to confirm results. 4. With new data, iterate text of email and/or task request for fiverr if appropriate. If you are skilled at chatting up gatekeepers (many sales folks are good at this), then you can call the school admin, explain the situation to her, and the answer would be yours in a few minutes. There are some other options that are of questionable legality and/or ethics, but I will stay away from those.
plaban123 13y ago
To all those people who are complaining about stalking: If the girl and the engineers have no complain about each other, who the fuck are you to decide?
bsaul 13y ago
Did anyone mention twitter ? Maybe seing her tweet at some time and looking for tweets happening at the same time in some region lead you to her tweet account. Then from a tweet account to a blog, then to her name ?

193 points by SteliE 13y ago

Well everyone's on his/her phone these days, so let's assume a second picture caught her busy with her phone. Highly doubtful a photo would be high-res enough to get text-level detail but certainly the general layout and colors of whatever she was looking at would show up. So if this led to a successful ID, she must have been looking at an app or page that is user-customizable to some extent like facebook with a unique profile and cover. If you have even a blurry image of a website, the RGB colors are still going to be pretty close so if you have some sort of way of automatically iterating through user pages on the website in question (GraphAPI), doing direct page capture to image, scaling down that image, doing the appropriate rotation, shear, etc., and then running some simple image match criteria, that "might" work. Facebook has billions of users though which surely would take more than 24 hours to iterate through, so maybe you could prune the search space by only searching friends of people claiming the high school graduation year in question.

jbg331 13y ago

I can confirm there is no GPS coordinates embedded in the photo

DanBC 13y ago
In the actual photo? Is there any meta data? Is there any EXIF data? What was the photo filename, and what does searching for that (with increments up and down) return? To try and guess what happened:- 1) One of them followed you and got information. (You say this didn't happen.) 2) They had information about the event and worked from there. 3) There were other people in the photo, and they got face-matched, and their friends lists were not hidden, and they got it from that. 4) They had snippets of other information and just trawled through very many searches to get the name. I'm a bit confused how they didn't already have her name. You told them you met someone, but didn't give any kind of name?
- mithras 13y ago
  That high school she went too might have been a pretty good lead if you know her approximate age.
- jbg331 13y ago
  I am positive they didn't do number 1. I am positive they didn't have number 2 There were no other people in the photo What other snippets of information would be useful? And they never met her, only I did. So they didn't know her name. And yeah, I said "I met a cute girl." I didn't say I met "name"

sliverstorm 13y ago

If they knew her high school and were doing lots of batch processing, I wonder if they found digital copies of the yearbook and tried facial recognition. For a single subject, it doesn't even need to be particularly accurate- they can easily sift through twenty possible matches with their own eyes.

philfreo 13y ago
We were unable to find a digital yearbook

AsymetricCom 13y ago

I'm sure there's a lot of information missing from this story, which leads to a lot of possible solutions that aren't negated by the lack of limiting circumstances. More than likely the author is an idiot and the image had EXIF data. Considering they already knew her highschool, it wouldn't had been to hard to go through the year books in a few hours.

jbg331 13y ago
I resent the fact that you think I'm an idiot. I have had two engineers check for EXIF data and there is 'nothing interesting in there'
- Pxtl 13y ago
  Heh, geek blog effect. Reddit et al have created some very bad habits of dialogue, such as assuming the subject of a link isn't reading it. And being nasty with candor. I still remember the time I said something impolite about David Brin. Brin took offense and replied. I'm actually a huge fan of David Brin. That sucked.
  - AsymetricCom 13y ago
    I'm not sure where you go the idea that pseudo-celebs and IT managers are immune to stupidity or posting stupid articles. There's always an element of "who cares if my content sucks, lets just get it done" when posting bloggy stuff, and it's pretty apparent here. Calling EXIF "back end stuff" is pretty stupid, I don't care if the author's ego is bigger than that statement, it's still true. The article might as well be how many apples fit in a bag or how long is a string.
    - Pxtl 13y ago
      http://cdn.memegenerator.net/instances/400x/37048520.jpg http://cdn.memegenerator.net/instances/400x/37048520.jpg edit: I'm aware of the irony in criticizing online geek culture and then bringing out a foul-mouthed meme pic.
  - 13y ago

mrspandex 13y ago

I think the key is knowing what high school she went to. From there, you could possibly get yearbook pictures and student lists. Knowing an approximate age would narrow the possibilities significantly as well.

evan_ 13y ago
I would probably take a social engineering approach to this problem- if you knew her high school and approximate age you could probably find someone who was in that class who would know her pretty easily. At that point it's just a matter of either tricking them into identifying the photo or just straight-up asking them.
- jbg331 13y ago
  They knew what high school she went to (I just found out), but probably didn't know exactly how old she was. There are no digital yearbooks from the high school. I checked
- swamp40 13y ago
  Or scrolling thru a classmates friends list on Facebook. And then scrolling thru all the friends lists of all their friends on Facebook. (Especially if they have nicely sorted their friends into "High School" friends.) Twitter lets you do the same thing. I've seen entire classes all "Friend" and "Follow" each other.

iterationx 13y ago

http://www.tineye.com/ http://www.tineye.com/

ngoel36 13y ago

Assuming that she didn't show up in a reverse Google Image Search, maybe they used some sort of facial recognition API (like http://www.lambdal.com/ http://www.lambdal.com/), perhaps along with the other people in the picture, against scraped pictures from LinkedIn and Facebook based on her appx age, location (Austin), gender (F), and high school. At least that's what I might have done.

deleted 13y ago

[deleted]

evan_ 13y ago

At this point he could not see my screen (he was standing directly in front of me), but offered me a simple bet – He said if I sent him the picture of the girl he could find out her name. Reminds me of: Sky Masterson: One of these days in your travels, a guy is going to show you a brand-new deck of cards on which the seal is not yet broken. Then this guy is going to offer to bet you that he can make the jack of spades jump out of this brand-new deck of cards and squirt cider in your ear. But, son, do not accept this bet, because as sure as you stand there, you're going to wind up with an ear full of cider. http://www.youtube.com/watch?v=d8Wvgs9q3js http://www.youtube.com/watch?v=d8Wvgs9q3js Simplest explanation: He knew before he made the bet.

philfreo 13y ago
> Simplest explanation: Someone saw you and told him. Of course one of the first things I did was ask another friend who I thought met her. But no, ultimately the answer did come from the internet, not from anyone I knew.

philfreo 13y ago

I'm the engineer he's referring to. I still get a laugh seeing Justin's amazement when we told him her name. To answer a few questions... - This isn't the actual photo but looks similar, except that she was alone. Justin was afraid of reposting the same photo after the results of handing over a photo last time :) - There was no useful exif data in the image. - We knew her high school and approximate age in Austin, but were unable to find any yearbooks / class rosters online. (Idea not pursued: try to acquire a yearbook offline). - Facebook Graph Search and LinkedIn with the criteria we knew didn't help. - Google Image search didn't help. > "I'm sure there's a lot of information missing from this story" Quite true. Ultimately we had several methods going at once to try to figure it out. The one that came back with results first relies on some information Justin still doesn't know we had (though he would still be impressed), but other approaches we also expected to work would be possible with only what's in the story, and haven't yet been mentioned here. EDIT: shared more at https://news.ycombinator.com/item?id=6369751 https://news.ycombinator.com/item?id=6369751

antr 13y ago
tineye.com or similar?
- philfreo 13y ago
  no luck
fnordfnordfnord 13y ago
Justin's own phone leaked his location (through some google-lattitude, or Yelp like service or perhaps gps directly) while Justin drove (or rode with her in a taxi) to her home.
- philfreo 13y ago
  good idea, but not the case here.
- jbg331 13y ago
  How would they have gotten my GPS location? And how would they have figured out which one was her house. I was in her neighborhood and stopped multiple places that were 'significant' to her as a kid. Any of them could have been her house. And I wasn't at anyone for more than 60 seconds

jmillikin 13y ago

Why not ask them? If your engineers as self-satisfied about finding her as it sounds, then they'll be happy to describe their process over a beer or two. I've never known an engineer who doesn't like discussing how they solved some riddle.

nrivadeneira 13y ago
The engineers were made to beg for info on the girl, so they might be getting some satisfaction from keeping a secret from the author in return. I know I would. Give 'em a taste of his own medicine. Also, if it was a relatively simple solution, it's probably more exciting with some mystery overlaying it rather than just explaining it outright.
- philfreo 13y ago
  You got it... exactly this!

oh_sigh 13y ago

How are you surprised that they did it when they knew what high school she went to? Two possibilities: Option 1: Step 1) Find copies of yearbooks going back a few years, 2) find her face in the yearbook. Option 2: Step 1) Search facebook for people who went to the same high school as she did in the probable time frame. 2) Look for her in that set, or in the set of friends that the people who matched the search have. Feel free to sprinkle in face detection on the yearbook/facebook photos to make it more engineer-ey. As a matter of fact, how did they find out what high school she went to? I can't imagine you telling them that if you were not providing much information about her to anyone else.

jbg331 13y ago
They knew what high school because it was a slip up. If you knew these guys, they aren't the kind who would just sit there and look at pictures. They had some software running. FYI, I am a sales guy...not an engineer
- georgemcbay 13y ago
  > If you knew these guys, they aren't the kind who would just sit there and look at pictures. As someone who has been a software developer for quite a long time, this statement makes a big assumption. A good software developer knows it is often far easier and faster to flip through a couple of hundred photos and process them with your meat-brain rather than write a one-off bit of software to do the matching, even if you start from an existing base like OpenCV or whatever.
- smoyer 13y ago
  Having software running doesn't preclude using your brain - first to consider possible heuristics and then to do the types of analysis computers aren't good at. There's a reason mechanical turk exists.
- oh_sigh 13y ago
  > If you knew these guys, they aren't the kind who would just sit there and look at pictures. That's why I said "Feel free to sprinkle in face detection on the yearbook/facebook photos to make it more engineer-ey."

cperciva 13y ago

Where was the photo taken? What was in the photo other than the girl? If the photo was taken at her home and there is any landscape in the background, the obvious initial point of attack would be to identify the location the photograph was taken.

swamp40 13y ago

If you know the high school and year(s), you go thru the friends list of every person on Facebook who did post their high school from that year (or nearby years), and does show their friends, until you see her face. That's only a couple hundred kids, each with a couple hundred friends. If you still get nothing, start doing friend requests for the people that don't show their friends. I'll bet you'd get another 25-30 kids that way. I don't see why you'd need facial recognition software to go thru 20,000 pictures. 3/4ths of them would be the wrong gender/age and be immediately disqualified. But if you're a programmer, you can probably scrape and aggregate to speed things up - drop out the males, other high schools, only show pictures once, etc.

noconflict 13y ago

waiting for someone to post her name and address

domdelimar 13y ago

Did the girl leak the information? Like mentioning his name/twitter handle or something like that?

dkb 13y ago

Philfreo > I think that the girl did share something with you that Justin doesn't know, such as something that she did accomplish in that school, like winning some kind of award, winning a competition or something similar. Then, you used that information along with the name of the school in Google.

wtracy 13y ago

I wonder what the resolution of the original image was? The inside of her thumb is visible through the glass, so with enough detail it might be possible to record her thumb print. Even if you could do that, though, odds are against her print being present in any publicly-available database.

philfreo 13y ago
Congrats on having the most far fetched idea of all of the ones posted here :)

cbhl 13y ago

One of the things that looks like a clue to me is that this the lead engineer of close.io. Browsing through their site, it looks like they do "telecom in an API"; it reminds me of Twilio and OneBox. So, here's a thought. Let's say the Engineer has access to the SMS logs (NSA-style) for Justin's phone. (Maybe his phone goes through their system. But even if not, maybe it's company-provided, so there's an admin interface provided by the telecom that lists this information.) Justin probably doesn't regularly text people in Texas, since the team is based out of Palo Alto. So look through his logs for a number in a Texas area code (http://en.wikipedia.org/wiki/List_of_Texas_area_codes http://en.wikipedia.org/wiki/List_of_Texas_area_codes) that he's been texting more often than usual. That gets you the girl's phone number; probably a cell phone. Now, you need to go from the cell phone number to a last name. Reverse Phone Lookup probably won't work for this, although it's certainly worth a first try. More likely candidates: looking through the users table at close.io for a matching phone number, or doing a google search for the phone number. Or, try calling in the middle of the night and seeing what the voicemail says. Any of these approaches might work. Once you've got a last name, grab a copy of the white pages. Most public schools publish their district boundaries, so go grab a copy of that. Look through all entries that match the last name, and see how many of them fall within (or close to, in the case politics made the boundary change) the district boundary. You probably will get a handful (maybe three or four). If you only get one, bingo! If you get more than one, I'd call the cell phone to see if I can get a first name somehow. Then, I'd go through the landlines in the White Pages and call them one at a time, "Hello, may I speak to X? Sorry, wrong number." until one matches.

philfreo 13y ago
I love this explanation. But unfortunately there was no telephony hacking of any kind as this was just an ordinary personal cell phone. I did have an idea that we could try to hack his Verizon account to look at his SMS log, figuring that Forgot Password questions might be easy or that we could intercept an email. But we didn't do this.
kennywinker 13y ago
Since the point of this article is probably to promote their company, having the answer be "our engineers looked at your private information for a prank" seems like a no go.

Vistz 13y ago

Hm. Did you guys use the Prism API by any chance?

scott_s 13y ago

Saying she "doesn't exist on the internet" is a big assumption. First, she is on Facebook, so she's on the internet, easily accessible or no. Second, most people leave some internet trail through online forums, newspaper articles and newsletters. I find it very likely that she was found on the internet somewhere.

pearjuice 13y ago

So basically the engineers knew something specific about the girl already which narrowed their data set. Unless they tell you what that was, we can go all day long guessing how they "figured" it out. In fact with this information I am interested in the actual time taken to find the girl. They could have found her in five minutes after receiving the picture and you wouldn't know. Why? From the article: 1) They were running software on a computer for hours They are engineers! 2) The first couple of tries didn’t work Are you sure they weren't debugging? 3) They knew what high school she went too prior to searching If they know the high school they only have to find one or two established teachers who were around for a long period of time. It is not unlikely they can call a name from a picture after all those years. This smells like viral marketing to me (too bad I still don't know what close.io is, should have added some information to the article. Or are you looking for new engineers? "Hey look! At close.io we seal bets with engineers. About girls! Come work for us!").

fnordfnordfnord 13y ago

Justin had another photo of her in his tumblr with metadata?

broostoryco 13y ago

He sent the picture to his buddy at the NSA who performed an image search with facial recognition on all images ever transferred over the internet.

oe 13y ago

She checked in with Foursquare? Some people still use it.

helicon 13y ago
He said she only bought the dress recently. They did a image search and found a local store that stocks that particular dress - and she had checked in with foursquare?

jbigelow76 13y ago

>My Ask Nails on a freaking chalkboard. What is so bad about the word "question"?

sp332 13y ago
It sounds terrible and is awkward to say.
- marze 13y ago
  But has half as many syllables thus takes half as long to say/type. Who likes wasting time?
qu4z-2 13y ago
To me "My ask" translated to "My request", not "my question". Having said that, it still sounds a bit lost in time.

socialist_coder 13y ago

This is obviously a shill post setup to advertise close.io and HN fell right for it. Why would this post be hosted on the close.io blog and not on a personal blog? It has nothing to do with close.io. Why would he mention close.io so many times? Why would he ask about the quality of the "close.io engineers" instead of just his coworker or friend? Smells fishy to me.

philfreo 13y ago
So you're saying that http://close.io http://close.io not only has good engineers but also is good at marketing? Maybe you should check it out if you're looking for sales software then :)
- frogpelt 13y ago
  The girl doesn't exist! Edit: The girl is Lennay Kekua!
- kjs3 13y ago
  1) He did not say either group was 'good', and implied quite the opposite. 2) As someone who purchases things like enterprise sales software, this exercise does not entice me to consider your product. Ever.
S4M 13y ago
I was thinking the same, and expected the answer to be something like "Phil used the API provided by Close.io that invert google picture search and was about to get her name", but it turns out Close.io doesn't do anything related. But yeah, the post clearly emphasizes that they have smart engineers.
- dlss 13y ago
  Yep. Nothing's as good as finding out someone's name to prove you're good at writing webapps... oh wait :p
photorized 13y ago

kouiskas 13y ago

Some ideas... - using tools like http://www.pictriev.com/ http://www.pictriev.com/ or similar offline solutions to get a pretty good estimate of her age. - using image analysis to "fingerprint" the camera used to take the picture. Then crawling sites where she would be likely to post pictures (twitter, etc.) based on the suspected area and comparing to find matches (i.e. pictures taken with the same camera). I'm not sure what the current state-of-the-art is for those algorithms, but if for instance the camera displayed an obvious visible flaw (darker spot), it would have made it easier. On a perfectly clean camera without visible defects I assume that more than one picture is necessary for effective camera fingerprinting. - using tools like http://graphics.cs.cmu.edu/projects/im2gps/ http://graphics.cs.cmu.edu/projects/im2gps/ to try and determine the location just based on visual features.

hkdobrev 13y ago

Here is how I think it was done: I assume the author is not a Facebook friend with the girl. Otherwise it would have been too easy. But friends of friends is not the only privacy leak on Facebook. There is a very old feature (which is about to get deprecated) called Networks. Networks are created for schools, universities and other big organizations. They had the name of the high school so they have to list it as their own high school in their Facebook profiles. This will automatically put them in the same network as the girl. I am assuming here that she has listed that on her Facebook profile. Then performing a graph search for women who has gone to that high school and live in Austin with an age between X and Y will narrow the search a lot. Even if some of that information is not public on Facebook it would be public to them if they are not same network if she has the default settings. This is a neat trick which is still usable. I don't think looking through the pictures would take more than half an hour.

michaelmior 13y ago
From the engineer in question "- Facebook Graph Search and LinkedIn with the criteria we knew didn't help." https://news.ycombinator.com/item?id=6369519 https://news.ycombinator.com/item?id=6369519

emhart 13y ago

jbg331 - while we wait for people to ferret out the right answer, can you tell us how the woman in question has responded to the "game"? Genuinely curious.

jbg331 13y ago
Surpringly well. I told her about the bet and she took everything in stride. She actually laughed when I told her. Shes a pretty awesome girl
- emhart 13y ago
  Very glad to hear that :)
karanr 13y ago
She thought it was funny!

olegp 13y ago

Hate to sound cynical, but this seems like an attempt to solicit responses to identify good engineers to hire or promote some upcoming feature of the web app.

realrocker 13y ago

Really people? You are going to give ideas to track people to the general crowd. It's not even an exceptionally technical problem.

lifeformed 13y ago

I'm guessing it has to be something to do with facial recognition, since he asked for the picture without knowing its contents (other than that it has her face in it). From there, if he had an idea of where they went that night, a club or bar, perhaps he could do some Facebook/Twitter searching magic to search for pictures of that night, taken by other people. Then they could look for her face in the background. Not sure where to go from there... perhaps they got lucky with one of the pictures being tagged with name. Or perhaps they identified everyone she was shown to be associating with, and found intersections in their Facebook friends list? Does it have to do with Facebook?

lifeformed 13y ago

The answer is probably simple. Social engineering. Find someone who went to the high school, then send them the picture and ask who it is. Concoct some reasonable non-creepy story like "I found this person's wallet and I want to return it".

waterside81 13y ago

Since the reply is buried down below, here's how they did it: https://news.ycombinator.com/item?id=6369859 https://news.ycombinator.com/item?id=6369859

michaelmior 13y ago
Actually, if you read the fully reply, that's NOT how they did it. They ended up finding her via another approach. Phil mentioned the other approach which he thought would have worked.
- swah 13y ago
  I fell for the same thing, the wording is ambiguous in the first sentence. :)

gregors 13y ago

Knowing the high school and approx age in Austin... You probably know the year she graduated, you can run subsequent queries using +-1 based off of that graduation year. What you're after at first are rosters. The end goal is to place a picture for each name discovered. Over 10 years since high school graduation? I'd be looking at one of the classmate or facebook groups regarding reunions. Less than 10 years since graduation? I'd still look trying to compile a list of names from these places. Old high school sports and club rosters maybe? Build a graph of people who did go to that high school during those years. Start building 1 degree of separation. Once you've gotten a list of names, start cross referencing local groups, meet ups, colleges starting with the University of Texas -- possibly even spamming people using generated you've collected )lastname_firstletter@utexas@edu). Perhaps a phishing Email as follows "information regarding blah blah, looking for the person in this pic, we think they left their purse/cell phone etc"? Or post something in a local Austin Reddit. I'd also do simple searches based on individual names and generated college emails. Start cross referencing all college clubs past/present with names and/or generated emails. If the person is/was in graduate school they will probably have even more school related information online. If the person has graduated, start working the job route. Online career profiles monster, linkedIn, facebook. Have they done any sort of volunteering? Lot's of pics associated with volunteer work are out there. 5K results are a treasure trove, location, name and age ripe for searching. Some 5K's have corresponding flickr sets where you can match name to race number to a face. Once you have faces either look at them or run them through some CV for possible matches. Even if the name you've found isn't the person you're looking for such pictures might lead you to them anyway, if that person appears in a picture with your target. If you know that the person you found knows your target, start looking at that person's information. Who do they follow on pinterest, twitter, etc... Does this person own a house do searches against the tax databases for full address of home. Even if the address isn't useful you might learn their middle name - re search with middle initial and middle names in lieu of first names. Look at old social networking sites like myspace - the target might have old profiles up?

ssijak 13y ago

Made an ad campaign on Facebook targeting her high school and girls of her age saying in the ad something like "Click on this link darling, need to see this, Justin Gold ;)" and redirecting her to some fake (made by you) rosy website with hearts on them where she is socially engineered to leave her name. Probably not this, but I would try it for the fun.

b_emery 13y ago

Possibilities: - they looked at signups at close.io after the evening, thus narrowing a list of female names for image searching. They could further limit this to IP's from the austin area. - They bought the ad words 'justin gold', and 'justinbgold'. Then waited for her to google you, thus revealing IP addresses for further googling.

abalone 13y ago

Wow. It is stunning how oblivious nearly everyone on this thread is to how douchey it is to BET YOUR BROGRAMMER PALS THEY CAN CYBERSTALK A GIRL. Advice to woman: Run. Advice to startups: Don't let your sales and engineering teams be giant douche canoes and if they are certainly don't publicly brag about it.

jlees 13y ago
I feel like the majority of folk are treating this as a purely intellectual challenge. Which it sort of is (to the HN crowd, since the actual photo information is missing) but please, let's not forget the context here.
bunkat 13y ago
Yeah, this was my thought too. This whole situation is just creepy and its even creepier that so many people have a million other ways they would stalk somebody. Sure you can do all of these things, but if you have ethics you just don't.
philfreo 13y ago
Or, have some faith in humanity, considering: - This was just a fun bet between friends. Justin really didn't think it could be done and I wanted to show him how a little information goes a long way online. - Justin treated this girl well and she even knew about this bet. - "Look up online" != Stalking - None of the discovered information has been posted publicly online. This isn't even her photo.
- jbg331 13y ago
  When I told her about the bet she laughed and took it all in stride. She thought it was funny.
  - masterzora 13y ago
    Did you tell her about it/get her permission beforehand? Or did she say something when you met her that indicated it would be okay? If so, great. If not, this is still in the creepy / douche canoe area and the fact that she happened to be okay with it after the fact doesn't really change that.

dlss 13y ago

This is dumb. You can get a private investigator to do this for $100 - $200, with almost surely a better method that Phil used. Given what Phil does, the most cost effective (rational) method he could have used was to spend those hours working, and then pay a private investigator. If he wanted to do it himself, the easiest way is to facebook search for people who went to her high school in the right date range, then ask them who is in the photo. Given the start time and end time, Phil probably didn't do that, he probably browsed their photos & friends until he found her. Not a very good use of time, but it would work. I think guessing the exact method used isn't interesting, because the problem isn't a particularly hard one. He's done the social engineering equivalent of picking the lock on your filing cabinet.

MAGZine 13y ago
except that this is an intellectual challenge, more like a puzzle. You could pay a puzzle solver to solve a puzzle, but that defeats the purpose.
- dlss 13y ago
  http://lesswrong.com/lw/iq/guessing_the_teachers_password/ http://lesswrong.com/lw/iq/guessing_the_teachers_password/ A good riddle is about the best way to do something, not about the way someone else happened to do it.

saalweachter 13y ago

I think what makes this feel creepy instead of cool is that you've just described an exploit without giving any thought to mitigating the threat. So you've found an attack vector where you can get a woman's name and address off the 'net with a picture and a small amount of information. Maybe it doesn't work all the time, but it worked at least once. What are you going to do with that attack vector? Are you going to make an iPhone app, so that others can snap pictures of random women and recreate your exploit automatically? Or are you going to come up with ways the attack vector can be shut down, things that either individuals (eg, the woman herself) or organizations (like Facebook or Google) can do to block the attack?

philfreo 13y ago
> What are you going to do with that attack vector? Huh? Nothing... this was a just a fun bet between two friends with no bad intentions. I didn't discover anything, as evidenced by the dozens of others in this discussion with similar ideas.
VLM 13y ago
There is some redeeming social value in publicly defusing paranoia. Coincidentally this is 9/11 day... It turns out that anyone of room temp or above IQ can easily do something fairly awful, but the fact it almost never happens provides some faith in humanity that basically no one (on a statistical basis) is actually awful.

gingergirl 13y ago

As someone who happens to be good at finding people on the internet (true confessions), the approach I would have taken would have been related to FB likes, or log-ins at the bar that they met on Facebook. I.e. they were all at the same bar in Austin, so search for people who have checked-in at the bar. And perhaps the other photo the engineers had was another location that she liked, or another piece of information about the bar in question. Then, it's just a matter of narrowing down results based on age and location. The fact that they knew the high school would have made this quest even easier. I once found an individual from a first name and the name of the bar they work at in (comically) downtown Austin. It took forever, but I had patience. :) The internet has all sorts of shortcuts to finding people if you know how to look!

VLM 13y ago

She looks pretty; At least for guys pretty = memorable. When I was single I was pretty bold with the ladies and I'd have flirted with her first (perhaps getting shot down, oh well), remembered at least some demographic information, and then used it to completely F with my coworker's mind for awhile. When I was younger I was quite the practical joker. Note the convoluted written responses about not talking to anyone he knew and so forth which technically does not exclude the girl, herself, saying her own name. The other alternative is she's somebody's buddy/family member so it would be trivial to know before hand that she's so and so's ex or sister or whatever and given that intel, figure it out.

jmccree 13y ago

Is it just me or is this spectacularly creepy? "I bet you can't cyber stalk my friend! I bet you we can!" I could understand if this was at defcon or a security/privacy related conference and all parties involved were in the field, but just cyber stalking some random woman? What's the point?

OGC 13y ago
No, it's not just you. It's spectacularly creepy, lacking reflection _and_ a thinly disguised ad for their site/product ("look, our engineers are fucking evil geniuses! Amazing."). And of course, like others already have said, HN fell for it. This stuff should worry you, not be lauded as some kind of amazing engineering feat. 4chan does this all the time and they call it doxxing.
philfreo 13y ago
Looking up online != "stalking", and there was no "point" - it was a simple fun bet between friends.

pbreit 13y ago

Reverse image search? Facial matching image search?

espeed 13y ago
Google Plus and FB's facial tag suggestions.

somberinad 13y ago

Did you use Tineye or Google Image search to see if there were other photos from the event? A combination of her dress and the time of her arriving there?

telephonetemp 13y ago

Although this most probably isn't the case here, note how making a post impersonating the person who'd lose the bet would be a great way to solicit methods to win the bet.

brownbat 13y ago

Did you recently add her on any social network? Even if her FB is inaccessible, yours isn't... maybe a friend recommendation engine would eventually suggest her if someone just friended and unfriended you repeatedly? Did she sign up for a free trial of close.io?

georgemcbay 13y ago

This thread kind of exists as it does based on the fact that people were assuming there was something clever and software related that lead to the information because that's what the sales guy thinks, but the incomplete information we have from the developers suggests that they simply had a second photo that probably had some kind of identifiable information in it like her name that they saw via ZOOM,ENHANCE and a bit of Google which anyone could have done, even the sales guy. FWIW, as others have pointed out, I do find this a bit creepy too, on two levels. First, the initial bet is a bit creepy. Guy involved said girl laughed it off, but that doesn't necessarily mean she didn't find it creepy that some guy she recently met was betting other people they couldn't track her down Enemy of the State style. And then on top of that, inviting the entire Internet into the game via the second obscured photo adds a much bigger layer of creep on to it, especially since in the process a lot of secondary information on her was leaked. Probably enough along with the photo of her face missing for others to find her, and you've kind of made that a public challenge indirectly. (Not one I have any interest in pursuing because like I said, the whole thing seems a bit creepy to me).

wojcikstefan 13y ago
The photo used in the blog post is not of the girl the bet was about.
- georgemcbay 13y ago
  Are you sure? (serious question here, since I'm not) philfreo said: "This isn't the actual photo but looks similar, except that she was alone. Justin was afraid of reposting the same photo after the results of handing over a photo last time :)" Which to me suggests it is the same girl in a different photo. I would still find it creepy even if the photo is not of her at all, though somewhat less so.
  - jbg331 13y ago
    The photo used in the story is not her. I am 100% certain. The photo in the blog is a picture of a random girl who lives in another part of the country, has different physical attributs, and is a different age than the original girl in question

jimzvz 13y ago

The bet is fine but writing a blog post about it on your company blog is in bad taste in my opinion.

jimzvz 13y ago
If I was the girl, I would be pretty pissed off that I was the subject of some kind of marketing ploy.
- jbg331 13y ago
  This is not a marketing ploy and has nothing to do what our company does. This was a bet between friends, and everyone I told this story to got a kick out of it. That, plus the fact I hoped someone on HN could help me solve this puzzle led us to post the story.

nu2ycombinator 13y ago

My bet is people who gets it right will be contacted by close.io recruiter

kjs3 13y ago
Exactly this.

csa 13y ago

tl;dr -- fiverr 1. Compose tactful email text explaining the bet. This is optional if you don't care about tact or a potential negative impact on your or your company image. 2. Go to fiverr and get a person or three to find teachers, administrators, and students who were at the same high school around the same time. Have them send the letter you composed to these potential teachers, staff, and peers. Track with close.io. 3. Get answers and try to confirm results. 4. With new data, iterate text of email and/or task request for fiverr if appropriate. If you are skilled at chatting up gatekeepers (many sales folks are good at this), then you can call the school admin, explain the situation to her, and the answer would be yours in a few minutes. There are some other options that are of questionable legality and/or ethics, but I will stay away from those.

plaban123 13y ago

To all those people who are complaining about stalking: If the girl and the engineers have no complain about each other, who the fuck are you to decide?

bsaul 13y ago

Did anyone mention twitter ? Maybe seing her tweet at some time and looking for tweets happening at the same time in some region lead you to her tweet account. Then from a tweet account to a blog, then to her name ?