Slashdot Log In
The Face of One AOL Searcher Exposed
Posted by
CmdrTaco
on Wed Aug 09, 2006 07:26 AM
from the knew-it-wouldn't-take-long dept.
from the knew-it-wouldn't-take-long dept.
Juha-Matti Laurio writes "No. 4417749 conducted hundreds of searches over a three-month period on topics ranging from "numb fingers" to "60 single men" to "dog that urinates on everything., report NYT journalists Michael Barbaro and Tom Zeller Jr., but with a permission from Mrs. Thelma Arnold, 62. "Those are my searches," she said, after a reporter read part of the list to her, continues the article."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What a ho (Score:5, Funny)
At her age. I think she should be happy with a couple, but 60... gotta admire her!
SQL injection target? (Score:5, Informative)
http://www.aolsearchdatabase.com/ [aolsearchdatabase.com]
I did a search on there this morning, and it displays the SQL statement for me, which is very handy...
Select SQL_CALC_FOUND_ROWS * from search_data WHERE match (anon_id,query,click_url) against ('4417749 ') LIMIT 0,30
Interestingly, if you do the standard SQL injection, searching for something like "4417749') LIMIT 0,30; DROP TABLE SQL_CALC_FOUND_ROWS;--", I bet you will screw it up for them. Kids, don't try this at home. I'd never encourage people to do something illegal!
The point of this posting is:
Learn about SQL Injection, and protect against it.
Don't display your SQL query to your users.
If you don't know what SQL injection is, try a simple example: Search for "1','0" (skip the double quotes, but not the single quotes) and you'll see it in action without causing harm.
Parent
Hmm (Score:5, Funny)
User 48956332 HTML 4, whats the big deal
User 48956332 Howto use sandboxen in development
User 48956332 What is CSS
User 48956332 Unit testing
User 48956332 Spelcheking
User 48956332 Why is Digg growing so fast?
Re:Hmm (Score:5, Funny)
User 48956332 Preventing Dupes.
User 48956332 Preventing Dupes.
User 48956332 Preventing Dupes.
Parent
Re:Hmm (Score:5, Funny)
Note the timestamps of the last two lines, sounds like he had, well, an evening that did not go as planned
Parent
Search string (Score:5, Funny)
But at least it looks like my code isn't the only place invaded by quote-abducting aliens.
Nothing we can do! (Score:5, Insightful)
What a load... there is plenty you can do AOL. You can promise not to release this data again, you can actively hunt for it on the web. You can promise to delete your copy. You can promise that you won't keep data like this anymore. You can implement better security policies so that you know where your data is, and what is hapenning with it. You can limit the people who have access to posting stuff on your website.
Useless bastards!
Re:Nothing we can do! (Score:5, Insightful)
Parent
Re:Nothing we can do! (Score:3, Funny)
"C'mon, these are AOL users we are talking about...we never expected them to find out".
Re:Nothing we can do! (Score:3, Insightful)
More like what they meant to say was, "there is not a whole lot we can do right now because our lawyers are threatening to castrate us if we say anything else to people who have been affected by this".
Re:Nothing we can do! (Score:5, Insightful)
Parent
Re:Nothing we can do! (Score:3, Interesting)
Erase it from peoples hard drives, remove it from all the pipes that its in, drug everyone who has seen it?
The fact they have this data is one thing, releasing it to the public is another.
Re:Nothing we can do! (Score:5, Insightful)
The data is out there, what exactly could they do? Erase it from peoples hard drives, remove it from all the pipes that its in, drug everyone who has seen it?
The fact they have this data is one thing, releasing it to the public is another.
When it is data that they *care* about, corporations seem able to do plenty. If it's their source code, the code to decss, TimeWarnerAol's labels' mp3 files, the latest incriminating memos/emails ... they are positively rabid about protecting it. Cease and desist orders fall like rain, sites get shut down, people get sued for millions and prosecuted to the fullest extent of the law. But if it's their customers' data, like these searches, their email addresses, their credit card numbers, etc. They just shrug and say "Oh well. What canya do?"
It's typical, frustrating, and complete bullshit. If the privacy laws were enforced and these corporations were punished for such egregious mishandling of our data maybe then they might think they can do something. But unless it directly affects them, they just are not going to care and will continue to take no precautions.
Parent
Re:Nothing we can do! (Score:4, Funny)
Tubes, my friend. Tubes.
Parent
Re:Nothing we can do! (Score:5, Insightful)
Parent
Re:Nothing we can do! (Score:3, Informative)
Re:Nothing we can do! (Score:5, Insightful)
"Not keeping data like this" doesn't make any sense at all and doesn't accomplish any good for customers. Indeed there is great value in understanding what searches are made and how the search process can be improved. Keeping this kind of data secure is sufficient in my mind. The last two sentences are something I would agree with.
I just have to wonder who would be stupid enough to not realize the ramifications of doing this. It doesn't take "thorough vetting" to figure out that this would cause a firestorm of bad publicity.
Of course, the real lesson here is: Don't do anything on the Internet you wouldn't want your mother to find out about. There is no anonymity on the Web. It doesn't take a stupid decision by a large company to prove this.
Parent
Re:Nothing we can do! (Score:3, Insightful)
That is not enough. It is one thing when you get caught kicking a dog to say, "I won't kick the dog again." It is another, and far more noble, thing to say, "I will begin actively campaigning for the ASPCA." There has to be some accountability; not necessarily punishment, but retribution. For example, AOL could take steps to prevent any company from doing this again (promoting corporations to have data privacy built into their custome
Torpark (Score:5, Informative)
Keep those IPs changing so they can't track and accumulate your searches I guess. I don't want a dossier of my searches available to the public.
Re:Torpark (Score:5, Insightful)
Whilest protecting your privacy does, on the surface, seem like a good thing, I wonder if it might count against you if you were ever suspected of a crime. We've already seen 'he has some encrypted data' used as evidence (even though the contents of the encrypted file weren't known) in one successful conviction, I suspect 'he's using privacy protection software called Tor' may go down the same way.
Remember, only people who have something to hide care about protecting their privacy.
Parent
Privacy as evidence of nefarious character (Score:5, Insightful)
This is exactly why I think it's so critical to evangelize with regard to using privacy measures. I want my mother, Aunt Sally, and 8-year old neice to be using TrueCrypt and Tor at a minimum (or, something providing similar functionality). Privacy / anonymity suites need to become as commonplace as antivirus, firewall and anti-spam software.
Helping strong privacy measures become the status-quo serves other important goals too. It makes it more politically costly to try to legislate them out of use, and it reduces the usefulness of developing new data mining programs that require person:transaction relationships - both for the government and for private industry.
In short, when everyone's Aunt Sally can be expected to have countermeasures against activity monitoring running on her home PC, the world will have become a safer place for all of us.
Parent
Re:Torpark (Score:5, Insightful)
A customer of AOL searching through AOL has their searches linked to you as an individual. If you search through google then they get your IP address, and your ISP knows which IP address links to which individual at any one time (open Wifi networks aside). But at least the same company doesnt know both.
The data AOL released was the equivalent of any other search engine releasing its searches with IP addresses, so the same damage could be done by any other search engines logs, but imagine how much a marketing company would pay for that info from AOL with the personal details for each user included (i.e. Age, Sex, location etc.).
Parent
Re:Torpark (Score:3, Insightful)
That is not completely correct. Remember, your ISP knows both who you are and what you searched for at any of the search engines.
The next big privacy nightmare may be an ISP (and not a search engine) opening up its logs.
Re:Torpark (Score:3, Insightful)
Re:Torpark (Score:4, Insightful)
Your ISP has access to everything you do online unless you're using an encrypted channel like SSL. Your HTTP requests go through your ISPs routers, which see all. Not just search terms, everything. Cox will see this submission when I send it through, and has seen each preview. Cox sees every email I send, including the full content and any attachments. Some ISPs may not be recording it, but for AOL a big part of their business is selling aggregated data to advertisers, and enterprise grade storage costs a few dollars a gig. They'd be stupid to throw away HTTP requests, and I'd lay 20 to 1 odds that they are not. At least until we have laws that require them to. But then, I think we're more like to have laws that require them to keep the data. The EU already does.
Everything you do online is watched. It's just a question of whether you can trust your ISP. We currently lack any serious accountability for privacy breaches. The public is blissfully ignorant, and the government, far from promoting privacy, actually wants the data. In fact, depending on how far you think Epic/Carnivore/TIA goes, they already have it. Your phone records are protected by federal law, and they have those. What of data that isn't protected? Do you think they don't have it?
Parent
1 down, 24.9999 million to go... (Score:5, Insightful)
Re:1 down, 24.9999 million to go... (Score:3, Insightful)
Well, you can look at it one of two ways: User 17556639 is a diseased member of society or User 17556639 is a coroner doing research. Which is it? How do you decide based on just search information? And what does "steak and cheese" suggest?
Yes, AOL releasing this information was the longest in a series of boneheaded decisions, and when it finally dies, no one will mourn its passing. However, unless you're a card-carrying member of the tin hat brigade, there's not much to fear. Yes, someone can potentially
Re:1 down, 24.9999 million to go... (Score:3, Informative)
So it suggests that this person, while they may have had an idle curiosity towards the subject, was either well-versed or well-instructed enough about such things to know the name of that site, which I had no idea existed until today.
Re:1 down, 24.9999 million to go... (Score:5, Insightful)
That is sad. "Funny" sure. But "Insightful?"
Here's the person's searches in question:
17556639 how to kill your wife
17556639 how to kill your wife
17556639 wife killer
17556639 how to kill a wife
17556639 poop
17556639 dead people
17556639 pictures of dead people
17556639 killed people
17556639 dead pictures
17556639 dead pictures
17556639 dead pictures
17556639 murder photo
17556639 steak and cheese
17556639 photo of death
17556639 photo of death
17556639 death
17556639 dead people photos
17556639 photo of dead people
17556639 www.murderdpeople.com
17556639 decapatated photos
17556639 decapatated photos
17556639 car crashes3
17556639 car crashes3
17556639 car crash photo
If you want this person investigated, you are worse than the "thought police." First off, it's clear (to me, at least) that this guy isn't thinking about killing anyone. He just wants to see some gory photos. "steakandcheese" is a site like rotten.com. Even if he is thinking about killing someone, that's OK. There's a comment further down on the site you linked to that I find to be "insightful" about an old twilight zone episode. The main character could read minds and he reads the mind of a bank security guard who is thinking about robbing the bank! He has the man investigated, but nothing comes out of it. In the end, the guard admits he was thinking about robbing the bank... in fact he's thought about it almost every day. It's just a fantasy he has to make the day go faster... not something he'd ever act on.
And having been a regular visitor to rotten.com in the past myself, I know that just wanting to see some of the reality of death that we tend to keep hidden in American society is not a crime. It's not even thinking of a crime. It's perfectly natural and healthy curiosity. Neither is daydreaming about terrible things you would never do -- or want to have happen -- in real life. Fantasy is normal and healthy.
In fact, if you've never been to rotten.com or a similar site, I'd recommend you go sometime.
Parent
Re:1 down, 24.9999 million to go... (Score:3, Insightful)
This is really an example of a common failure in logic. If you were the least bit rational, you'd hope that the bank's security people are thinking about how to rob the bank. If not, they're incompetent and should be replaced with people who do think about obvious job-related problems.
Actually, I've seen this sort of failure in person. I've worked with
Re:1 down, 24.9999 million to go... (Score:4, Insightful)
Hello, I'm user 17556639, and I'm a crime novelist.
Actually, I'm not but it is simply not up to AOL or the government or anybody to snoop into my business without probable cause. And probable cause is limited to the government, the rest stay the fuck out of my business.
Anything taken out of context can look completely different, and it simply is NOT the duty of a citizen to chronically prove their innocence.
A) Its sometimes impossible to prove that I was home alone asleep.
B) I'm innocent until proven guilty. Even after being charged and possibly jailed until my court time.
So, yes, I'm one of those "Fuck the children" people. I'm one of those people that respects my privacy. I'm one of those people that believes in free speech. Yes, I vote libertarian too.
Parent
but with permission... (Score:5, Funny)
In other words, the journalists tracked down about 20 AOL searchers, but Mrs Arnold was the only one to give permission for the article as hers was the only search term list that didn't include 'midget porn'.
Re:but with permission... (Score:4, Funny)
Parent
Who uses AOL? (Score:3, Funny)
I don't know how the NYT reporters were able to track her down. After all, this describes most AOL users!
Legal Standing? (Score:3, Interesting)
Now what kind of legal recourse can people expect from these search results? Can the man who searched for ways to kill his wife be tracked down? How about all of the paedophiles who searched for child pr0n? Oh, I can just see all of the "Come on AOL, think of the children...tell us who that was..." How closely tied are these numbers to the user's AOL Accounts, I mean, I'm sure AOL left themselves some tie to the user in their copy. What's stopping feds from making many major busts on people?
Re:Legal Standing? (Score:3, Interesting)
Re:Legal Standing? (Score:3, Insightful)
AOL - "Bypassing the 5th Amendment for You!" (Score:3, Interesting)
AOL has went one step further and given their customer's information to the world. I googled the news to see if this story is being reported in the mainstream media, and it is minimally (minimal b/c of TimeWarner?) but I have to laugh as it is characterized as a "goof" and a "gaffe". Laughably understated and nice words for something that at best can be described as sheer bumbling negligence and at worst as a breach of privacy of the worst sort.
Even more ironic, the first news story to pop up on google has nothing to do with this but is:
"AOL offers free security software"
http://www.vnunet.com/vnunet/news/2161980/aol-off
Quick! (Score:4, Funny)
"Officer, those searches can't be mine, I'm not an 18 year old lesbian movie actress!"
Re:Quick! (Score:3, Funny)
pictures of dead people
*no, that didn't work*
killed people
*hmm, no good, maybe try "dead pictures"*
dead pictures
*hmm, no results, lemme try again*
dead pictures
*0 searches, cmon! one more try*
dead pictures
*no, nothing... how about...*
murder photo
*ah fuck it, lemme go on Slashdot.*
=reads ttys00's comment=
Quick, make a bunch of bogus searches! That way you will have some plausible deniability when The Man knocks on your door with a list of your searches.
*oh shit... he's right. Lemme go make so
She should stay at AOL (Score:4, Funny)
She shouldn't. There's absolutely no way AOL will ever do anything like that again. On the other hand, if she switches to another online provider, who still hasn't been burned, it's a quite a bit more likely they'll screw up like this as well. She'd be "safer" staying at AOL.
Re:She should stay at AOL (Score:5, Funny)
At the end of the article, she says she's cancelling her AOL account as a result.
Correction, she's going to try to cancel her AOL account.
Parent
Oblig. Prisoner (Score:5, Funny)
You're on AOL.
What do you want?
Search information.
Whose side are you on?
That would be telling. We want information. Information. Information.
You won't get it.
By hook or by crook, we will.
Who are you?
The new ad-funded AOL Number 2.
Who is Number 1?
You are Number 4417749.
I am not a number -- I am a free gran!
Re:Oblig. Prisoner (Score:3, Funny)
Technology in the NY Times (Score:5, Interesting)
won't hurt yahoo (Score:3, Funny)
21528558 http com yahoo com wont hurt wont yahoo 2006-04-21 15:31:20
I'm amazed by the masses of stupid search strings that are given, why are so many search strings complete (or non working) http adresses? (e.g. www.yahoo.com) Seems like a lousy database to me anyway.
AOL's apology vs. Dilbert's boss (Score:5, Funny)
"This was a screw up, and we're angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted..."
This is sounding very much like Dilbert's boss's public apology made years ago:
"It was wrong for us to sell keyboards with no 'Q' We're sorry. We're morons. We're dumber than squirrels. We hear voices and do what they command. I have broccoli in my socks. "
user 4417749's Search Records (Score:5, Funny)
4417749 60 single men
4417749 dog that urinates on everything
4417749 landscapers in Lilburn, Ga
4417749 bill arnold
4417749 carpet shampoo rental
4417749 julie arnold
4417749 stan arnold
4417749 homes sold in shadow lake subdivision gwinnett county georgia
4417749 gwinnet county animal services
4417749 stan arnold
4417749 pecan pie recipes
4417749 McGyver DVDs
4417749 pet euthanasia services
The most importane part of TFA (Score:3, Interesting)
Now, what can we do?
How about making sure "this conversation" happens, and continues to happen.
And not just here on /.
How to achieve change (Score:4, Interesting)