Publishing De-Anonymization Attempts

Hopefully this is the right board. What is Lain's opinion on the ethics of publishing de-anonymization data? Users seem to put a lot of effort in setting up secure systems, but not as much in testing them. This seems dangerous. In order to raise awareness of different attacks, I believe pro-privacy websites should actively attempt to de-anonymize their users and publish the data publicly (where appropriate) so people can make informed decisions on how to better protect themselves. To this end, how would Lain feel about publishing the results of a stylometric analysis of lainchan, for example? Or is there another way of encouraging a data-driven approach to anonymity? I don't think it's sufficient to rely on users knowing about websites like check.torproject.org.

it depends on the context, if it's to protect peoples info and better prepare than yes. I would agree that it's good.

>>20134 /sec/ is really the right board

>>20134 Other than causing users some stress, running stylometry on Lainchan isn't going to help much. Even users who bother using Tor on Lainchan aren't really hiding from anyone except Lainchan itself. There is no practical tooling to deal with the stylometry problem.

>>20138 >aren't really hiding from anyone except Lainchan itself. Isn't that all the more reason to test these attacks? Low stakes means there's less potential for harm while still learning the same lessons (if any). >There is no practical tooling to deal with the stylometry problem. Raising awareness of it would spur development of practical tools.

>>20139 >Raising awareness of it would spur development of practical tools. I doubt it. It's been over 3 years since jstylo and others were widely talked about and nothing has been done since.

>>20140 While you're probably right, this is a self-defeating attitude.

>>20141 I cannot refute that, I am cynically hopeless. I'd be happy for someone to prove me wrong. I guess I can wish you luck in spurring some sort of results.

>>20138 >>20140 https://github.com/psal/anonymouth ?

Not everyone here is trying to hide, and essentially doxing them without consent is unethical. I personally would be curious how effective a stylometry attack would be, but I post on an anonymous imageboard things I wouldn't want abused to identify me. Publishing them is abusive and emailing them to me unsolicited would make me suspect you were trying to blackmail me. One option is to set up a thread where users attempt to dox each other, maybe setting up throw-away emails or a Matrix server to send results to. Making the result public is quite harmful to the individual if you succeed. Slightly relevant, I noticed that some sites have talkative admins and you can plot their sleeping hours on a chart. This would aid spammers who want to flood loosely moderated boards or sites.

I would be down, I've long thought that my writing style is distinctive enough that people can pick me out from the crowd. Also your waifu's jacket looks really impractical.

>>20145 My biggest giveaway for older 4chan posts would be the reaction images and filenames. Even in the case that someone else reuses them, they usually don't have the same file name.

>>20143 It's barely maintained though.

>>20138 Most practical way is to write it in another language and use a translator's grammatical errors to obscure a human-ish writing style

>>20150 But how susceptible is that to a pre-image attack? What does that aim to solve? If it's meant to remove words/phrases that you say often, you're assuming that many words are translated to that same output. (I think I am assuming an advanced adversary, not some angry internet guy doxxer. Translators could work find against a stalker kiddo)

>>20144 >doxing them without consent is unethical That's the issue, isn't it? Even if I only target volunteer posts in a designated thread, I'd need to analyze the rest of lainchan to robustly test the effectiveness of the technique. A thread just isn't enough data to be meaningful. Still, I like the volunteer idea as a compromise. There's also another issue. Ideally, the analysis tools should be freely available so that users can then go on to test themselves. However, this makes it easier for unsophisticated malicious actors to abuse it. I already was hesitant just raising the possibility as a hypothetical with this thread. >you can plot their sleeping hours on a chart >>20146 Yeah, that's why I kept the OP open. I don't know which attacks are a serious concern for anonymous imageboards, so testing a wide variety is the only way to be sure. Also hybrid attacks using stuff like post timing may up the effectiveness of otherwise harmless attacks.

Somewhat relevant: "Man is least himself when he talks in his own person. Give him a mask, and he will tell you the truth." - Oscar Wilde I've chatted with a few anons in comfy imageboards and they (me included) tend to be more honest when there's a lack of social pressure to be normal. It's a beautiful benefit of anon cultures, but of course a slight risk for deanonymization. So I've made a habit of adding noise, small inconsequential lies so that if someone could somehow link my posts, what they gather would be littered with false information. Same with some old botnet accounts I was forced to have (some let you download "advertising interests" in their GDPR downloads and most of them are wrong).

>>20154 Terrence Tao wrote a bit about this https://www.gwern.net/docs/cs/2012-terencetao-anonymity.html Can't find the original unfortunately.

>>20134 Depends on which data in particular. Partial stylometric data and IP addresses seem okay.

>>20146 4chanX at least randomizesimage hashes automatically. It doesn't let you change the hash AFAIK, but DDT could probably do that easily by just adding false data. Ideally this should all be doable in browser, to enable easier posting.

Go for it OP! Im curious to see how good that stilometry will perform.

i've thought along similar lines in the past. still don't think i have a firm answer about when/how this should be done but it's worth considering. for example, i like that image posts all have an easy link to a tool which will reveal exif data. most people fuarrrk up once, or see someone else fuarrrk up once, and learn in a low stakes environment that uploading photos from your phone camera without cleaning them is risky. i feel like this approach would work with e.g. user agents or canvas data. it's a good way to get people thinking about fingerprinting. on the other hand, the anonymity here has a purpose beyond privacy. it's also an important part of the culture. i'm not sure it's worth sacrificing that. maybe something like this would be better suited for a forum based around the idea.

what does "where appropriate" mean?

>how would Lain feel about publishing the results of a stylometric analysis of lainchan Just publish it instead of LARPing, ok? It would be genuinely helpful. You could also make assumptions on what time zones post here. Everyone here uses averaged channer style, although it gets deluded with onslaught of twitterites and faceboomers from halfchan. I oftentimes pick up other's post formatting styles and shuffle them around, everyone should to.

>>29160 I also do this. Since lainchan has no control set of messages for whom we know the same poster made them, except for the anal conspiracy spammer and the limited number of mod posts, it's impossible to determine the accuracy of stylometric analysis against posts here.

>>29440 >anal conspiracy spammer But it isn't an conspiracy!

>>29441 The only anal conspiracy is the conspiracy between 99% of men on Grindr to say they want to meet up but then to flake as soon as you show any interest.

>>29460 >The only anal conspiracy is the conspiracy between 99% of men on Grindr to say they want to meet up but then to flake as soon as you show any interest. I've done a fair bit of flaking on grindr, but only after finding out that the guy messaging me is trying to cheat on his wife. I don't enable cheaters.