7 ms·

De-anonymizing Users of French Political Forums [pdf]

100 points by adulau 13y ago

lstamour 13y ago
I've often thought Gravatars were less-noticed privacy violations. Nice to see that confirmed here. Of course, if the websites don't have SSL-always, then governments can listen between your ISP and the web host to get your cookie, and from there, get your email address or track your activity. This, obviously, is more open since anyone can view a gravatar, or even previously generated ones via archive.org.
- selmnoo 13y ago
  Also noteworthy is that it's getting increasingly harder to even have pseudonyms -- and not be outed. About a week ago, I really wanted to get in touch with a HN user (who did not have any contact information in his profile), so I set out to do a little detective work... and after about 2 hours I basically got his e-mail address. Innocently and guilelessly I wrote him a message, and I found him to be just bewildered that I found out his identity... I felt very sorry of course for having scared him like that. This was a big moment for me. Because I also prefer to be anonymous on comment forums, and I'm generally pretty careful to not give clues as to my identity, but I still can't help but wonder if it's all gonna come back to me and maybe hurt my career in some manner.
  - lstamour 13y ago
    Yeah, I know that even making a separate email account and using every trick not in the book to hide myself still won't help me. I'm too honest in the language I use. Or, like other usernames I've Googled, it becomes easier to pin someone down when they use the same name across multiple sites. If nothing else, it shows your interest in those sites, which can together, sometimes, uniquely identify you.
  - unimpressive 13y ago
    Things I noticed going through your comment history: Your race. What car you drive. Hints at your political ideology. Where you grew up/that you're not originally from the United States/wherever you live now. You've undergone an IQ test in a professional environment. You've probably donated to Lavabit's legal fund. What OS you use, when you last bought a new computer. Since you talk about a computer engineering class with 250+ people, you've probably been to college. (Scratch that, you've definitely been to college.) You have a first church of atheism near you, and are probably a member. ---- That seems like enough to uniquely ID you.
    - lstamour 13y ago
      Upon hearing "I'm generally pretty careful to not give clues as to my identity", Mr. unimpressive here appears to have said "Challenge Accepted." and followed through. https://www.google.ca/search?q=barney+stinson+challenge+accepted https://www.google.ca/search?q=barney+stinson+challenge+acce... Perhaps somebody has too much time on their hands? Personally I'm more worried by non-personal, bulk attacks based on database leaks. Oh and don't forget. selmnoo has Java disabled likely because he or she is on a Mac, so that's another vector out. Probably the fastest way to get any individual on HN is to reply to their comment and mention some site on which you've installed a payload, or not even that complicated: just ask for their email address. Done. :)
      - unimpressive 13y ago
        >Personally I'm more worried by non-personal, bulk attacks based on database leaks. While a personal attack is much less likely than a non-personal bulk attack, I would guess that anybody who goes through the trouble of personally looking over your words with a magnifying glass has a much higher chance of being very dangerous. That scary amounts of information are floating around about you has always been true though. The things you can get from your local courthouse may surprise you.
        lstamour 13y ago
        Sure, but when anyone takes an interest in someone else, we all know the odds "something bad" will happen, even if "bad" is simply "embarrassment of the person with the interest". Similarly, I suppose what I'm getting at is there really is no such thing as complete anonymity, just the temporary pretence of it. I mean, of course, lack of interest and luck can contribute to your anonymity these days, and time might diminish the odds that something can get traced back to you, but ... you never know. ;-) Edit: I posted this elsewhere but it's relevant here too - http://pandodaily.com/2013/10/26/i-challenged-hackers-to-investigate-me-and-what-they-found-out-is-chilling/ http://pandodaily.com/2013/10/26/i-challenged-hackers-to-inv...
      - deleted 13y ago
        [deleted]
  - nraynaud 13y ago
    I use my real name, and I lost my last job triggered by online comments I made (not the only factor). I still don't think it's a big deal in general, I also have reference threads on quite technical subjects.
korethr 13y ago
Interesting. What this shows to me is that md5 needs to die. Perhaps it was a good in times past, but now it is too easy to crack with commodity computer hardware. The rig shown in the article costs <$2000 USD when priced out on newegg.com. Top-shelf gaming GPUs are only going to get faster. I was surprised to read that the right to freedom of speech is not recognized in France. Anyone here from France willing to affirm or refute article's claim in that regard?
- deleted 13y ago
  [deleted]
- ludwigz 13y ago
  We have what we call "Liberté d'expression" http://fr.wikipedia.org/wiki/Libert%C3%A9_d'expression http://fr.wikipedia.org/wiki/Libert%C3%A9_d'expression but it's limitated by the law. For example you can't say racists things in public.
  - camus2 13y ago
    Lol,there is no "Liberté d'expression" in France. Even if you say something the most gentle way you'll get sued because you said so. There is only "la liberté d'exprimer son accord avec la pensée unique". But things might change, for better or worst. France is living a very interesting time. Things can blow up anytime.
    - abolibibelot 13y ago
      I'm curious to see some references and figures here. As far as I know, only Hate Speech, and holocaust-denial are forbidden. Libel laws apply too, and some people are trigger-happy with them though.
      - patrickaljord 13y ago
        But accusations of Hate Speech are being broadly abused. For example, a guy I disagree with on almost every issues (economy and immigration) Eric Zemmour was accused and found guilty of hate speech for saying that most people in jail are Arabs in France. This is a fact that was confirmed by many judges and yet the guy was still sentenced cause he hurt some people's sensitivity (I guess...). I'm half Arab myself and still it's obvious to me that most people in jail in France are Arabs (mostly cause they're the poorer), but still, it's true.
dmix 13y ago
I was ready to dismiss this as "de-pseduonomizing" people, because in order for Gravatar to work (suitably well), they submitted their actual email address to the website host. Intentionally "anonymous" individuals don't use real email addresses. But the slides turned out to be pretty interesting when it gets to the email cracking part.
- slig 13y ago
  > Intentionally "anonymous" individuals don't use real email addresses. You'd be surprised. Even DPR fucked it up.
- DanBC 13y ago
  > Intentionally "anonymous" individuals don't use real email addresses. (http://ritter.vg/blog-deanonymizing_amm.html http://ritter.vg/blog-deanonymizing_amm.html) Here's an analysis of de-anonymizing posts to alt.anonymous.messages - those people want to stay anonymous. They make some trivial mistakes. > Then I go into a large analysis of the types of PGP-encrypted messages there are. Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all!
maximegarcia 13y ago
Very smart, I like it. Gravatar is obviously wrong in its defense of the md5 choice. The md5 of an email is way more significant as we know in advance the structure, and for 80% of the population, we have a strong guess of the domain, the format. Rainbow tables can be specialized for one domain (*@gmail.com) via the reduce phases or for the "first_name dot last_name" structure... & so on.
- nwh 13y ago
  There's also massive wordlists in the form of scraped and compromised emails to look through.
Udo 13y ago
I'm surprised Gravatar claims the hash is about privacy in the first place. I thought it was about generating a short, standardized URL. If sites wanted to protect their user's anonymity, they'd cache the gravatars with different file names on their servers. Also, as a user I would never sign up for a site with my "real" address when I'm not comfortable with it being known eventually, Gravatar or not.
rolleiflex 13y ago
The government could just as well pinpoint the hosting provider, and pull some strings to take the site offline, then read through the captured database. When the stakes are nation-state level, quite a large amount of very disturbing things start to become practical. Shameless self plug: They should be using Aether. ( http://www.getaether.net http://www.getaether.net ) It's a distributed network that creates forum–like, anonymous and encrypted public spaces— something I created and launched a few days ago. It's an app I created for this express purpose. I don't sympathise (at all) with their views, but no one gets to choose who gets free speech and who doesn't.
- comex 13y ago
  This sounds like an interesting project, and you should submit it as a link, although I'd expect various concerns about security to be thrown around.
  - rolleiflex 13y ago
    I did, about three times. Nobody looks at 'new', apparently :/
- seszett 13y ago
  Well, governments cannot usually "pull some strings" to take offline a website hosted in a foreign country (Sweden in this case). Except maybe the US, but even then some foreign hosts won't be very cooperative, especially when the purpose is to curb freedom of speech.
- nraynaud 13y ago
  The French government is simply keeping a tab on the individuals, not the electronic forum per se. Basically they let them say a lot of racist stuff and demonstrating, but they are checking that they are not colluding for an assassination (the Jacques Chirac scare is still in the memories) and that they are are not colluding for some big destruction. And they don't want them to demonstrate too close from the presidential Palace (ie Champs Élysée is off-limit), because the proximity tends to make everybody more crazy. One leftish guy got killed recently in a brawl, and the Government decided to dissolve the involved gang (the simple act of meeting together would be a crime now), without doing anything on the electronic or media level.
telephonetemp 13y ago
Interesting preservation. I also couldn't help but notice that the slides themselves were beautiful. I wonder if they were generated using a recent version of, e.g., Microsoft Office (the fonts look like those used in Modern UI) or if there's a beamer theme that looks like that. If there is one, do tell.
- telephonetemp 13y ago
  "Interesting preservation" should read "interesting presentation".
rgovostes 13y ago
I published an identical attack in 2010: De-Anonymizing Web Communities with Gravatar https://web.archive.org/web/20111219233019/http://rgov.org/2010/11/27/gravatar/ https://web.archive.org/web/20111219233019/http://rgov.org/2...
yetanotherphd 13y ago
Great article, and they make a good point that it is the right-wing whose political freedoms are most threatened by attacks against anonymity.
abolibibelot 13y ago
A little context here. The FDeSouche blog (a pun on "Français de souche" which could be translated as "stock French" or "purebred French", really meaning "White French") is an extreme-right blog whose commenters are pretty tame compared to what you could read on, say, Pam Geller's site. The commenters have internalized the French Hate Speech laws and mostly use innuendos. The "mariage pour tous" (="marriage for all" i.e. same-sex marriage) was opposed by a semi grassroot movement called "la manif pour tous" ("the protest for all") made mostly of our religious right. The protests were huge, and some people have compared it to the Tea Party (minus the guns).
- masklinn 13y ago
  > The protests were huge, and some people have compared it to the Tea Party (minus the guns). And either better dressed or significantly less dressed (many, both inside and outside the country, wondered at the existence of such fabulous anti-LGBT protesters)
  - abolibibelot 13y ago
    The lack of self-awareness was hilarious: http://americablog.com/2013/07/frances-gayest-homophobes-strike-again.html http://americablog.com/2013/07/frances-gayest-homophobes-str...

100 points by adulau 13y ago

I've often thought Gravatars were less-noticed privacy violations. Nice to see that confirmed here. Of course, if the websites don't have SSL-always, then governments can listen between your ISP and the web host to get your cookie, and from there, get your email address or track your activity. This, obviously, is more open since anyone can view a gravatar, or even previously generated ones via archive.org.

selmnoo 13y ago
Also noteworthy is that it's getting increasingly harder to even have pseudonyms -- and not be outed. About a week ago, I really wanted to get in touch with a HN user (who did not have any contact information in his profile), so I set out to do a little detective work... and after about 2 hours I basically got his e-mail address. Innocently and guilelessly I wrote him a message, and I found him to be just bewildered that I found out his identity... I felt very sorry of course for having scared him like that. This was a big moment for me. Because I also prefer to be anonymous on comment forums, and I'm generally pretty careful to not give clues as to my identity, but I still can't help but wonder if it's all gonna come back to me and maybe hurt my career in some manner.
- lstamour 13y ago
  Yeah, I know that even making a separate email account and using every trick not in the book to hide myself still won't help me. I'm too honest in the language I use. Or, like other usernames I've Googled, it becomes easier to pin someone down when they use the same name across multiple sites. If nothing else, it shows your interest in those sites, which can together, sometimes, uniquely identify you.
- unimpressive 13y ago
  Things I noticed going through your comment history: Your race. What car you drive. Hints at your political ideology. Where you grew up/that you're not originally from the United States/wherever you live now. You've undergone an IQ test in a professional environment. You've probably donated to Lavabit's legal fund. What OS you use, when you last bought a new computer. Since you talk about a computer engineering class with 250+ people, you've probably been to college. (Scratch that, you've definitely been to college.) You have a first church of atheism near you, and are probably a member. ---- That seems like enough to uniquely ID you.
  - lstamour 13y ago
    Upon hearing "I'm generally pretty careful to not give clues as to my identity", Mr. unimpressive here appears to have said "Challenge Accepted." and followed through. https://www.google.ca/search?q=barney+stinson+challenge+accepted https://www.google.ca/search?q=barney+stinson+challenge+acce... Perhaps somebody has too much time on their hands? Personally I'm more worried by non-personal, bulk attacks based on database leaks. Oh and don't forget. selmnoo has Java disabled likely because he or she is on a Mac, so that's another vector out. Probably the fastest way to get any individual on HN is to reply to their comment and mention some site on which you've installed a payload, or not even that complicated: just ask for their email address. Done. :)
    - unimpressive 13y ago
      >Personally I'm more worried by non-personal, bulk attacks based on database leaks. While a personal attack is much less likely than a non-personal bulk attack, I would guess that anybody who goes through the trouble of personally looking over your words with a magnifying glass has a much higher chance of being very dangerous. That scary amounts of information are floating around about you has always been true though. The things you can get from your local courthouse may surprise you.
      - lstamour 13y ago
        Sure, but when anyone takes an interest in someone else, we all know the odds "something bad" will happen, even if "bad" is simply "embarrassment of the person with the interest". Similarly, I suppose what I'm getting at is there really is no such thing as complete anonymity, just the temporary pretence of it. I mean, of course, lack of interest and luck can contribute to your anonymity these days, and time might diminish the odds that something can get traced back to you, but ... you never know. ;-) Edit: I posted this elsewhere but it's relevant here too - http://pandodaily.com/2013/10/26/i-challenged-hackers-to-investigate-me-and-what-they-found-out-is-chilling/ http://pandodaily.com/2013/10/26/i-challenged-hackers-to-inv...
    - deleted 13y ago
      [deleted]
- nraynaud 13y ago
  I use my real name, and I lost my last job triggered by online comments I made (not the only factor). I still don't think it's a big deal in general, I also have reference threads on quite technical subjects.

korethr 13y ago

Interesting. What this shows to me is that md5 needs to die. Perhaps it was a good in times past, but now it is too easy to crack with commodity computer hardware. The rig shown in the article costs <$2000 USD when priced out on newegg.com. Top-shelf gaming GPUs are only going to get faster. I was surprised to read that the right to freedom of speech is not recognized in France. Anyone here from France willing to affirm or refute article's claim in that regard?

deleted 13y ago
[deleted]
ludwigz 13y ago
We have what we call "Liberté d'expression" http://fr.wikipedia.org/wiki/Libert%C3%A9_d'expression http://fr.wikipedia.org/wiki/Libert%C3%A9_d'expression but it's limitated by the law. For example you can't say racists things in public.
- camus2 13y ago
  Lol,there is no "Liberté d'expression" in France. Even if you say something the most gentle way you'll get sued because you said so. There is only "la liberté d'exprimer son accord avec la pensée unique". But things might change, for better or worst. France is living a very interesting time. Things can blow up anytime.
  - abolibibelot 13y ago
    I'm curious to see some references and figures here. As far as I know, only Hate Speech, and holocaust-denial are forbidden. Libel laws apply too, and some people are trigger-happy with them though.
    - patrickaljord 13y ago
      But accusations of Hate Speech are being broadly abused. For example, a guy I disagree with on almost every issues (economy and immigration) Eric Zemmour was accused and found guilty of hate speech for saying that most people in jail are Arabs in France. This is a fact that was confirmed by many judges and yet the guy was still sentenced cause he hurt some people's sensitivity (I guess...). I'm half Arab myself and still it's obvious to me that most people in jail in France are Arabs (mostly cause they're the poorer), but still, it's true.

dmix 13y ago

I was ready to dismiss this as "de-pseduonomizing" people, because in order for Gravatar to work (suitably well), they submitted their actual email address to the website host. Intentionally "anonymous" individuals don't use real email addresses. But the slides turned out to be pretty interesting when it gets to the email cracking part.

slig 13y ago
> Intentionally "anonymous" individuals don't use real email addresses. You'd be surprised. Even DPR fucked it up.
DanBC 13y ago
> Intentionally "anonymous" individuals don't use real email addresses. (http://ritter.vg/blog-deanonymizing_amm.html http://ritter.vg/blog-deanonymizing_amm.html) Here's an analysis of de-anonymizing posts to alt.anonymous.messages - those people want to stay anonymous. They make some trivial mistakes. > Then I go into a large analysis of the types of PGP-encrypted messages there are. Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all!

maximegarcia 13y ago

Very smart, I like it. Gravatar is obviously wrong in its defense of the md5 choice. The md5 of an email is way more significant as we know in advance the structure, and for 80% of the population, we have a strong guess of the domain, the format. Rainbow tables can be specialized for one domain (*@gmail.com) via the reduce phases or for the "first_name dot last_name" structure... & so on.

nwh 13y ago
There's also massive wordlists in the form of scraped and compromised emails to look through.

Udo 13y ago

I'm surprised Gravatar claims the hash is about privacy in the first place. I thought it was about generating a short, standardized URL. If sites wanted to protect their user's anonymity, they'd cache the gravatars with different file names on their servers. Also, as a user I would never sign up for a site with my "real" address when I'm not comfortable with it being known eventually, Gravatar or not.

rolleiflex 13y ago

The government could just as well pinpoint the hosting provider, and pull some strings to take the site offline, then read through the captured database. When the stakes are nation-state level, quite a large amount of very disturbing things start to become practical. Shameless self plug: They should be using Aether. ( http://www.getaether.net http://www.getaether.net ) It's a distributed network that creates forum–like, anonymous and encrypted public spaces— something I created and launched a few days ago. It's an app I created for this express purpose. I don't sympathise (at all) with their views, but no one gets to choose who gets free speech and who doesn't.

comex 13y ago
This sounds like an interesting project, and you should submit it as a link, although I'd expect various concerns about security to be thrown around.
- rolleiflex 13y ago
  I did, about three times. Nobody looks at 'new', apparently :/
seszett 13y ago
Well, governments cannot usually "pull some strings" to take offline a website hosted in a foreign country (Sweden in this case). Except maybe the US, but even then some foreign hosts won't be very cooperative, especially when the purpose is to curb freedom of speech.
nraynaud 13y ago
The French government is simply keeping a tab on the individuals, not the electronic forum per se. Basically they let them say a lot of racist stuff and demonstrating, but they are checking that they are not colluding for an assassination (the Jacques Chirac scare is still in the memories) and that they are are not colluding for some big destruction. And they don't want them to demonstrate too close from the presidential Palace (ie Champs Élysée is off-limit), because the proximity tends to make everybody more crazy. One leftish guy got killed recently in a brawl, and the Government decided to dissolve the involved gang (the simple act of meeting together would be a crime now), without doing anything on the electronic or media level.

telephonetemp 13y ago

Interesting preservation. I also couldn't help but notice that the slides themselves were beautiful. I wonder if they were generated using a recent version of, e.g., Microsoft Office (the fonts look like those used in Modern UI) or if there's a beamer theme that looks like that. If there is one, do tell.

telephonetemp 13y ago
"Interesting preservation" should read "interesting presentation".

rgovostes 13y ago

I published an identical attack in 2010: De-Anonymizing Web Communities with Gravatar https://web.archive.org/web/20111219233019/http://rgov.org/2010/11/27/gravatar/ https://web.archive.org/web/20111219233019/http://rgov.org/2...

yetanotherphd 13y ago

Great article, and they make a good point that it is the right-wing whose political freedoms are most threatened by attacks against anonymity.

abolibibelot 13y ago

A little context here. The FDeSouche blog (a pun on "Français de souche" which could be translated as "stock French" or "purebred French", really meaning "White French") is an extreme-right blog whose commenters are pretty tame compared to what you could read on, say, Pam Geller's site. The commenters have internalized the French Hate Speech laws and mostly use innuendos. The "mariage pour tous" (="marriage for all" i.e. same-sex marriage) was opposed by a semi grassroot movement called "la manif pour tous" ("the protest for all") made mostly of our religious right. The protests were huge, and some people have compared it to the Tea Party (minus the guns).

masklinn 13y ago
> The protests were huge, and some people have compared it to the Tea Party (minus the guns). And either better dressed or significantly less dressed (many, both inside and outside the country, wondered at the existence of such fabulous anti-LGBT protesters)
- abolibibelot 13y ago
  The lack of self-awareness was hilarious: http://americablog.com/2013/07/frances-gayest-homophobes-strike-again.html http://americablog.com/2013/07/frances-gayest-homophobes-str...