Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Privacy Security

Researchers Can ID Anonymous Twitterers 108

Posted by timothy from the 140-shady-characters dept.
narramissic writes "In a paper set to be delivered at an upcoming security conference, University of Texas at Austin researchers showed how they were able to identify people who were on public social networks such as Twitter and Flickr by mapping out the connections surrounding their network of friends. From the ITworld article: 'Web site operators often share data about users with partners and advertisers after stripping it of any personally identifiable information such as names, addresses or birth dates. Arvind Narayanan and fellow researcher Vitaly Shmatikov found that by analyzing these 'anonymized' data sets, they could identify Flickr users who were also on Twitter about two-thirds of the time, depending on how much information they have to work with.'"
This discussion has been archived. No new comments can be posted.

Researchers Can ID Anonymous Twitterers More

Researchers Can ID Anonymous Twitterers

Comments Filter:

  • Who promised? (Score:5, Insightful)

    by plover ( 150551 ) * on Thursday March 26, 2009 @05:52PM (#27350095) Homepage Journal
    Who ever promised this data would be anonymous? Do you really expect privacy when posting personal stuff on line, even if you don't sign your name in advance?

    • Re:Who promised? (Score:5, Informative)

      by vux984 ( 928602 ) on Thursday March 26, 2009 @06:05PM (#27350235)

      Who ever promised this data would be anonymous? Do you really expect privacy when posting personal stuff on line, even if you don't sign your name in advance?

      1) People still assume that if don't sign their name on the internet then its anonymous. People need to be educated otherwise. Articles like this help.

      2) While a lot of people are still grappling with #1 above, there are a lot of more sophisticated people who need to learn that even if they ARE behind 7 proxies, using tor, ssh, on a hacked wifi they are accessing via a pringles can-tenna from across state or even national lines... and then use that super anonymous connection to participate anonymously in 'social networking' sites like twitter, facebook, etc... even if they never reveal a single personal detail about themselves, their place within the social network itself can be reliably used to unmask them once they've had their anonymous account linked to real friends.

      People REALLY need to be educated about this.

      • Re: (Score:2, Insightful)

        by CannonballHead ( 842625 )

        So, to be anonymous, I need to get behind 7 proxies, use tor and ssh on a hacked wifi that I'm accessing via a pringles can-tenn from across state or national lines and make sure that all of the social network connections I have are to similarly protected people (behind 7 proxies, use tor and ssh on a hacked wifi that they are accessing via a pringles can-tenn from across state or national lines).

        ;)

        That said, I agree. =D

        • Re: (Score:1, Interesting)

          by mail2345 ( 1201389 )
          I'ld prefer chain wi-fi hacking.

          Have a worm infect and propagate via weak passworded/WEP routers.

        • Re: (Score:2, Insightful)

          by Webious ( 1317179 )

          So, to be anonymous, I need to get behind 7 proxies, use tor and ssh on a hacked wifi...

          RTFA - I think you missed the point:

          Our de-anonymization algorithm is based purely on the network topology

          • Re: (Score:2, Insightful)

            by Anonymous Coward

            I think you missed the point actually.

            or should I say... wooosh!

            maybe try reading past the first 19 words before replying to a post?

            • Re: (Score:1, Funny)

              by Anonymous Coward

              I read that and thought "19? did he just pull that out of his ass? 1 2 3... 19! He actually counted the number of words in the quoted text!"

        • Re:Who promised? (Score:5, Interesting)

          by petermgreen ( 876956 ) <plugwash@@@p10link...net> on Thursday March 26, 2009 @06:28PM (#27350513) Homepage

          The important thing is that anyone or anything that links your "real persona" and your "anonymous persona" is a potential threat to your anonymity both through things they willingly or mistakenly do and through things they could be coerced or forced into doing.

          It's all too easy to put lots of thought into making it bloody hard to trace your connection but then link your "anonymous persona" to your "real persona" through common friends, accidently logging into a site using the wrong account for the connection you are using, forgetting to flush cookies (and any similar tracing objects) when moving between your "nonanoymous connection" and your "anonymous connection" and so on.

          • Re: (Score:3, Interesting)

            by Jason Levine ( 196982 )

            Years back, I used my real name for all of my online activities. After my kids were born, though, I reconsidered using my real name and address. So when I started a blog, I made up an "anonymous" name. I'm under no illusion that it is 100% anonymous, but I do my best to keep my "real name identity" and my "blog identity" separate. I'm go "blog identity" on all of the sites I frequent, but I'm unwilling to disappear as "Jason Levine" and either a) pretend to be a newbie at the site for awhile or b) revea

          • It's all too easy to put lots of thought into making it bloody hard to trace your connection but then link your "anonymous persona" to your "real persona" through common friends, accidently logging into a site using the wrong account for the connection you are using, forgetting to flush cookies (and any similar tracing objects) when moving between your "nonanoymous connection" and your "anonymous connection" and so on.

            Yep. Preferably, you want a "sterile" computer for your anonymous activities; it should c

        • Re: (Score:3, Insightful)

          by davester666 ( 731373 )

          "all of the social network connections I have are to similarly protected people"

          No, for you to remain anonymous, you must disavow all knowledge of anybody in your social network, for all 'accounts' or whatever, for all postings that you want to not be readily linked back to you. And they must not have any links to these accounts either (so the easiest way is to not tell them about these 'anonymous' accounts).

          • Re: (Score:1, Insightful)

            by Anonymous Coward

            Exactly. This is what I do.

            If you have a 'real' account and an 'anonymous' account, why do you need to have links to your friends with your anonymous account anyway, when you can just use your real account?

            If you really need to have links to your friends from your anonymous account, then just have them create anonymous accounts too, and have links to those rather than their real account.

        • Re:Who promised? (Score:5, Insightful)

          by ssintercept ( 843305 ) <ssintercept@nOSpaM.gmail.com> on Thursday March 26, 2009 @06:49PM (#27350765) Journal
          how 'bout not using twitter, myspace, facebook, etc??

          don't you use those services to be noticed?
          • Whoosh and all that, but seriously - yes, you do, but I assume some people assume that if they don't put any personal details up, they can't be found... and forget that their 'friends' may have personal information, etc.

            • Re: (Score:2, Insightful)

              by ssintercept ( 843305 )
              whoosh yourself- as per the above article "researchers showed how they were able to identify people who were on public social networks such as Twitter".

              so the first step on concealing your identity is to not use the public social networks.

          • how 'bout not using twitter, myspace, facebook, etc??

            What do you think /. is?

        • No, to be anonymous, you just need to not have any friends.

        • No. You need to do all of that, but not do anything which links you to your friends. Your super-anon account which you've never revealed details about is still vulnerable to a "six degrees of separation" type of attack.

          - Super-anon guy has Bobby, Jim, and Sandra on his facebook friends and he's got Bobby, Jim, and Jessica on his MySpace
          - Logically, Bobby and Jim must know each other, and therefore they both must know Super-anon guy.
          - Bobby and Jim have a lot of pictures on Facebook with a guy tagged "A

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        2) While a lot of people are still grappling with #1 above, there are a lot of more sophisticated people who need to learn that even if they ARE behind 7 proxies, using tor, ssh, on a hacked wifi they are accessing via a pringles can-tenna from across state or even national lines... and then use that super anonymous connection to participate anonymously in 'social networking' sites like twitter, facebook, etc... even if they never reveal a single personal detail about themselves, their place within the soci

      • Re:Who promised? (Score:4, Insightful)

        by Rorschach1 ( 174480 ) on Thursday March 26, 2009 @06:22PM (#27350437) Homepage

        Then again, some of us are very well aware of it and just don't care so much. If I want to post thoughts to a blog that I don't want linked back to me (and I've done so in the past), I'll set up something entirely separate, with a name I've never used before, linked to a new gmail account.

        Anyone with half a brain can figure out exactly who I am, where I live, and what I do for a living, starting from this post, in about 20 seconds. Medical conditions and sexual preference might take a little more work, but I'm sure some of it is out there.

        Frankly, I don't care. I'm self-employed and don't worry about what an employer might think of me. My friends and family seem to like me well enough despite already knowing that stuff. So long as it's not information that's going to result in identity theft (account numbers and such), there's not much that's worth the effort to conceal.

        • Ditto.

          I'm not self-employed, but similar holds true. I'm pretty sure you could identify me from just this online handle, based on posts from this and similar discussion boards.

          Fact is, you won't learn much out about me that I wouldn't have told you to your face anyway. I'm on pretty friendly terms with my employer, and am close with my friends, and I doubt anything I've said online would be news to them.

          And even if you can find out some more intrusive facts about me (medical history, salary, what have you)

          • Or, y'know, somebody who wants to make it to graduation and out of town before mommy and daddy find out that they aren't a heterosexual like jesus wants them to be...

            There are plenty of good reasons that somebody, particularly somebody with limited social power in the real world, might want a separate persona online.

        • Anyone with half a brain can figure out exactly who I am, where I live, and what I do for a living, starting from this post, in about 20 seconds. Medical conditions and sexual preference might take a little more work, but I'm sure some of it is out there.

          With a handle like yours, they just need to look at the results of your test!

        • You're obviously a sadistic masked vigilante with a thing against liberals.

      • Re:Who promised? (Score:5, Interesting)

        by MadAhab ( 40080 ) <slasher.ahab@com> on Thursday March 26, 2009 @06:53PM (#27350817) Homepage Journal

        I agree, but I think it's an age and culture issue. These issues are new.

        In 10 years, no one would expect that a Twitter account couldn't be connected to your FB account any more than they would think you could cheat on your partner by taking your partner-in-crime to a pub you and your date frequent. The principle is no different - if two social spheres overlap, you've given up your relative anonymity.

        That's why Larry Craig tapped his toe in an airport bathroom in a stop-over airport - low likelihood of running into someone who might know him.

        • Re: (Score:3, Funny)

          by EdIII ( 1114411 ) *

          That's why Larry Craig tapped his toe in an airport bathroom in a stop-over airport - low likelihood of running into someone who might know him.

          I thought it was just because he had a "wide stance".

      • Re: (Score:3, Insightful)

        by Runaway1956 ( 1322357 )
        Heh. To right. When I got TOR up and running, I was tempted to sign into a couple places, to look at my - uhh - "internet profile" being presented by browser, etc. Was reaching for the "submit" button, when I realized, "Hey, this is STOOOO-PID!" I'm no longer anonymous once I sign in ANYWHERE!

        • Re: (Score:2)

          by EdIII ( 1114411 ) *

          Your still anonymous if all the profile data is fake. All the data associated with this Slashdot account is completely fictitious and in no way related to accounts hosted elsewhere that have nothing to do with tech blogs. Anytime I am presented with the option, or forced to provide, name and address data anywhere I use completely fictitious information. Everywhere. Also, different every time.

          So, if somebody from Slashdot here either liked or hated me and was including me in their online social profiles i

          • Re: (Score:3, Informative)

            by Runaway1956 ( 1322357 )
            How sure are you, of that idea? You must realize that your IP is recorded again, and again on the web. Do you use Flash, Java, or any other plugins that potentially give away identifying data? Does your browser leave any data that you are unaware of? What about your operating system? Microsoft has this thing (I forget the name, but almost everyone here knows what it is) where you can sign into one account, then automagically be signed into dozens if not hundreds of other sites/accounts. Google has som

            • Re: (Score:2)

              by EdIII ( 1114411 ) *

              How sure are you, of that idea?

              Pretty Damn Sure (tm)

              You must realize that your IP is recorded again, and again on the web.

              You mean the exit node's, proxy's, internet cafe's, etc. public IP address right? Yeah, I realize that. Any IP address that has been assigned to me by a corporation that ALSO possess my name, address, social security number, telephone number, etc. has never been recorded by the destination. I am sure that plenty of TOR nodes and proxy's have that IP address, but I am reasonably sure o

              • I could subscribe to /. and search all your comments. Unless you have been very careful I should be able to learn a lot about you.

                • Re: (Score:3, Informative)

                  by EdIII ( 1114411 ) *

                  True, but that is not the same thing as what we are talking about in the article.

                  If you search my comments and find any postings with my real name, references to my place of work, real people, events, etc. then I do agree you could possibly do research in the real world to identify who I am. Sort of a 20 questions kind of deal.

                  Remember... that is identify , as in gain a positive identification of my real world identity to the point you could then actually find me. Learning about my likes, dislikes, relig

                  • I got to finding a piece of poetry from 2006 on living with insomnia [your-poetry.com] and got bored.

                    • Re: (Score:2)

                      by EdIII ( 1114411 ) *

                      BWAHAHAHAHAHHAHAHAH!

                      I have never written a piece of poetry in my life! I have recited PLENTY of stuff from Andrew Dice Clay, but never written anything.

                      You bring up a good point to make though. You have to make sure it is the RIGHT person, just not named the same person....

                      LOL

                    • My point was that just because you're very careful with your information, doesn't mean that someone else can't pretend to be you and fuck things up for you.

                    • Re: (Score:2)

                      by EdIII ( 1114411 ) *

                      How so? I am still anonymous as a write this, in that my real identity that is typing this on the keyboard is unknown to both you and Slashdot.

                      The only way you could pretend to be me is to compromise my account, change the password, and then start making posts with it. That is a whole other security issue that applies regardless of whether you are obfuscating your real identity. I can attempt to regain my account while still having my real identity unknown to Slashdot.

                      Other than that, you seem to be sayi

      • This & other tricks are possible, yes, but *harder*. I really don't have the creds to pull the tech side of your Point 2, but I have quietly worked to keep the other side down to a whisper, earning strange looks from friends who can't imagine why I Just Don't Wanna Share.

        The Mayans got lucky. Their 2012 date is just accidentally shaping up to be the Data Implosion.

        ~tag: "Let's give everyone what used to be studio grade cameras in their phones, 12 types of mechanisms and reasons to aggregate and pummel c

      • hey my internet aliases were damn anonymous, until Mozilla went and ruined it all but as i don't post much that i wouldn't say to peoples faces it doesn't really matter anyway.

    • Re:Who promised? (Score:5, Informative)

      by arvindn ( 542080 ) on Thursday March 26, 2009 @06:48PM (#27350745) Homepage Journal
      Hi. I'm one of the authors. Please read our FAQ [utexas.edu]. It answers that very question. In short, our de-anonymization algorithm applies to far more than public social networks like twitter, including some very sensitive ones.

      • Hi. I'm one of the authors.

        Wow, clearly you are not bothered about linking your real and Slashdot personas.

        I'm certain most /.ers guard their /. persona, given the blunt nature of the comments found here.

        OT, has there been any research into looking up a person's sex/ethnicity by analysing his or her /. comments? It is already known that the species problem is hard [unc.edu].

  • Tin foil! (Score:5, Funny)

    by mc1138 ( 718275 ) on Thursday March 26, 2009 @06:11PM (#27350317) Homepage
    Must... cover... everything...

    • Re: (Score:2)

      by EdIII ( 1114411 ) *

      Must... cover... everything...

      Just don't cover the naughty parts.... it.. chafes.....

      Or at least on the outside of the underwear.

  • Twits (Score:5, Insightful)

    by brkello ( 642429 ) on Thursday March 26, 2009 @06:16PM (#27350377)
    Slashdotters care about privacy. People on these social networking sites want their lives to be on show for everyone. I don't think people who twit every 5 minutes where they are and what they are doing are really to concerned about their privacy.

    • Re:Twits (Score:5, Insightful)

      by LandDolphin ( 1202876 ) on Thursday March 26, 2009 @06:20PM (#27350419)
      This.

      However, I don't think a lot of people fully understand the negative side of placing your life online for all to see. They fail to realize that placing their discussion about smoking pot (or other dubious activity) on twitter might one day cause them a job.

      • Re:Twits (Score:5, Funny)

        by Animaether ( 411575 ) on Thursday March 26, 2009 @07:47PM (#27351461) Journal

        They fail to realize that placing their discussion about smoking pot (or other dubious activity) on twitter might one day cause them a job.

        That's right - The Netherlands are hiring again!

      • There's also the possible side effect that if people do post how they really live - we can one day over come silly prejudices and preconceived notions about human and social behavior. Ideas like pot smoking being "dubious" need to be challenged.
        • While I can agree that smoking pot is theoretically no different then having a drink (if not better according to some), there is one difference right now. It's illegal. If it should be or not is certainly up for debate (and it should not be), but what is not up for debate is that it is currently illegal.

          Taking part in illegal activities is most certainly "dubious". Risking all that one risks to get high off an illegal substance certainly calls ones decision making skills into question.
          • I reject your contention taking part in illegal activities must always be "dubious". By that argument Rosa Parks was a "dubious" law breaker. Laws are stricken down daily - sometimes they are just wrong. In 14 US states, it is perfectly legal for some people to use/possess cannabis for medical reasons. In several other states marijuana has been decriminalized by voter initiative. Until the law is challenged, how can it change? Having millions of Americans admit they engage in an activity, and yet remain ac
            • There is a huge difference in someone challenging unjust laws and people who just break the law.

              You get X number of people to gather on the steps of the Capitol and Toke up, that's noble and certainly lends itself towards the kind thing that Rosa Parks is linked to. Risking security for a protest of current laws is admirable. But there is nothing to show that any sizable portion of pot smokers are doing anything like that. What is happening far more consistently is that they are hiding their illegal
              • Why do you assume the majority of pot smokers, "just want to get high"? Does actual data support that? I cannot personally attest to the reasons others choose risking arrest to use marijuana. I can only tell you that I am a 95 pound HIV patient. My choice is based on the fact I consider stopping the vomiting, stopping the pain, and possibly generating some appetite a more pressing concern than whether or not I'm violating some law.

                It's also why I'm not currently organizing that mass protest event. Someo
                • Yes, I do not have any evidence to support my position. However, you do not have any to support the opposition. The only logic I have to support mine over yours to to say that the majority of people are not suffering from medical illnesses, like HIV.

                  You smoke to relieve your pain caused by your illenss. There is a reason you smoke besides to just get "high". However, I would not say that your case is the norm; you are an exception. There are thounds (possible millions) of people that smoke for med
    • Twitter seems to be going to critical mass lately. I expect the stampede won't be slowed down much by privacy concerns.

    • Slashdotters care about privacy. People on these social networking sites want their lives to be on show for everyone. I don't think people who twit every 5 minutes where they are and what they are doing are really to concerned about their privacy.

      All we need to do is find a slashdotter who 'tweets' every 5 minutes and you'll implode, a black hole will take your place, and the universe will collapse.

      I think I just found a new hobby. Making gross generalizations? No, that's your job- I'll start using twitter.

  • You mean like willyhill? (Score:5, Informative)

    by tepples ( 727027 ) <tepples.gmail@com> on Thursday March 26, 2009 @06:19PM (#27350405) Homepage Journal
    Willyhill managed to ID fourteen Twitter accounts [slashdot.org]. Or is this something completely different?

  • Social network can-o-worms (Score:5, Insightful)

    by xixax ( 44677 ) on Thursday March 26, 2009 @06:38PM (#27350603)

    Are there really any surprises here? Social networks behave a lot like the Internet, with many routes pointing to your front door.

    For example, use whatever falese names you want. Your email address makes a dandy primary key squirreled away in all your friends mailboxes, just waiting for Facebook to Hoover it up and join the dots.

    Your privacy and anonymity is defined by the aggregate social stupidity of your friends.

    Xix.

    • Your privacy and anonymity is defined by the aggregate social stupidity of your friends.

      Xix.

      That has quite a Zen ring to it!

  • This is new technology to me (Score:4, Funny)

    by moteyalpha ( 1228680 ) on Thursday March 26, 2009 @06:42PM (#27350659) Homepage Journal
    I understand networks and how you can get somebody's IP and translate it to a location or identify them with algorithms that analyze sentence structure or even use some TCP packet tricks.
    The thing that confuses me is the acronym "FRIEND", I have looked in all my technical references and I can't find that tool.

  • Please read our FAQ (Score:5, Insightful)

    by arvindn ( 542080 ) on Thursday March 26, 2009 @06:43PM (#27350671) Homepage Journal
    We have an FAQ about this paper [utexas.edu]. It answers many of the misconceptions expressed in the comments here. In particular, our algorithm applies to much more than public social networks like twitter and flickr. A variety of networks including the phone call network are being shared behind your back in anonymous form, and our de-anonymization techniques apply just as much. You'll probably agree that people expect more privacy there. See my blog [33bits.org] for a variety of demonstrations and thought-experiments of de-anonymization.

  • I can ID anyone using Twitter (Score:3, Funny)

    by FlyingSquidStudios ( 1031284 ) on Thursday March 26, 2009 @07:05PM (#27350987)
    as someone whose every thought I have no interest in reading.

  • The application to twitter anonymous accounts is creative, but otherwise it's a standard timing attack. If user A is active while anonymous data B is passed, user A has a higher chance of having generated data B than the rest of the population.

    Looks like there's some number-crunching using timing of past tweets and whatnot to see if the user is likely to be on, too. I like that.

    Or it could be I'm completely misreading it.

  • Maybe it was a tar baby.

  • I wonder what the accuracy would be if you just scanned for posts referencing new pictures at flickr?

  • "she took her action as a private citizen "tired of giving in". Although widely honored in later years for her action, she also suffered for it, losing her job as a seamstress in a local department store..." - From Wikipedia

    It was not a mass protest event. She just had enough that day, and wasn't bowing to an unjust law regardless of the consequence.

Slashdot Top Deals

This is the theory that Jack built. This is the flaw that lay in the theory that Jack built. This is the palpable verbal haze that hid the flaw that lay in...

Close