Researchers Can ID Anonymous Twitterers

narramissic writes "In a paper set to be delivered at an upcoming security conference, University of Texas at Austin researchers showed how they were able to identify people who were on public social networks such as Twitter and Flickr by mapping out the connections surrounding their network of friends. From the ITworld article: 'Web site operators often share data about users with partners and advertisers after stripping it of any personally identifiable information such as names, addresses or birth dates. Arvind Narayanan and fellow researcher Vitaly Shmatikov found that by analyzing these 'anonymized' data sets, they could identify Flickr users who were also on Twitter about two-thirds of the time, depending on how much information they have to work with.'"

Comments

Who promised?

[plover]

Who ever promised this data would be anonymous? Do you really expect privacy when posting personal stuff on line, even if you don't sign your name in advance?

Re:Who promised?

[vux984]

Who ever promised this data would be anonymous? Do you really expect privacy when posting personal stuff on line, even if you don't sign your name in advance?

1) People still assume that if don't sign their name on the internet then its anonymous. People need to be educated otherwise. Articles like this help.

2) While a lot of people are still grappling with #1 above, there are a lot of more sophisticated people who need to learn that even if they ARE behind 7 proxies, using tor, ssh, on a hacked wifi they are accessing via a pringles can-tenna from across state or even national lines... and then use that super anonymous connection to participate anonymously in 'social networking' sites like twitter, facebook, etc... even if they never reveal a single personal detail about themselves, their place within the social network itself can be reliably used to unmask them once they've had their anonymous account linked to real friends.

People REALLY need to be educated about this.

Re:Who promised?

[Anonymous Coward]

Clearly, you're both me.

Re:Who promised?

[petermgreen]

The important thing is that anyone or anything that links your "real persona" and your "anonymous persona" is a potential threat to your anonymity both through things they willingly or mistakenly do and through things they could be coerced or forced into doing.

It's all too easy to put lots of thought into making it bloody hard to trace your connection but then link your "anonymous persona" to your "real persona" through common friends, accidently logging into a site using the wrong account for the connection you are using, forgetting to flush cookies (and any similar tracing objects) when moving between your "nonanoymous connection" and your "anonymous connection" and so on.

Re:Who promised?

[arvindn]

Hi. I'm one of the authors. Please read our FAQ. It answers that very question. In short, our de-anonymization algorithm applies to far more than public social networks like twitter, including some very sensitive ones.

Re:Who promised?

[ssintercept]

how 'bout not using twitter, myspace, facebook, etc??

don't you use those services to be noticed?

Re:Who promised?

[MadAhab]

I agree, but I think it's an age and culture issue. These issues are new.

In 10 years, no one would expect that a Twitter account couldn't be connected to your FB account any more than they would think you could cheat on your partner by taking your partner-in-crime to a pub you and your date frequent. The principle is no different - if two social spheres overlap, you've given up your relative anonymity.

That's why Larry Craig tapped his toe in an airport bathroom in a stop-over airport - low likelihood of running into someone who might know him.

Tin foil!

[mc1138]

Must... cover... everything...

Twits

[brkello]

Slashdotters care about privacy. People on these social networking sites want their lives to be on show for everyone. I don't think people who twit every 5 minutes where they are and what they are doing are really to concerned about their privacy.

Re:Twits

[LandDolphin]

This.

However, I don't think a lot of people fully understand the negative side of placing your life online for all to see. They fail to realize that placing their discussion about smoking pot (or other dubious activity) on twitter might one day cause them a job.

Re:Twits

[Animaether]

They fail to realize that placing their discussion about smoking pot (or other dubious activity) on twitter might one day cause them a job.

That's right - The Netherlands are hiring again!

You mean like willyhill?

[tepples]

Willyhill managed to ID fourteen Twitter accounts. Or is this something completely different?

Social network can-o-worms

[xixax]

Are there really any surprises here? Social networks behave a lot like the Internet, with many routes pointing to your front door.

For example, use whatever falese names you want. Your email address makes a dandy primary key squirreled away in all your friends mailboxes, just waiting for Facebook to Hoover it up and join the dots.

Your privacy and anonymity is defined by the aggregate social stupidity of your friends.

Xix.

Please read our FAQ

[arvindn]

We have an FAQ about this paper. It answers many of the misconceptions expressed in the comments here. In particular, our algorithm applies to much more than public social networks like twitter and flickr. A variety of networks including the phone call network are being shared behind your back in anonymous form, and our de-anonymization techniques apply just as much. You'll probably agree that people expect more privacy there. See my blog for a variety of demonstrations and thought-experiments of de-anonymization.