Slashdot Mirror
Disqus Bug Deanonymizes Commenters
alphatel writes "The Swedish company Resarchgruppen has discovered a flaw in the Disqus commenting system, enabling them to identify Disqus users by their e-mail addresses. The crack was done in cooperation with the Bonnier Group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites."
Exactly.
I've always used my real name when commenting, or (in the case of places like Slashdot) made it easy to find my real name. For decades now. There are a couple posts on Usenet I'm embarrassed about (for example, I got my signs reversed trying to explain the link between electricity, magnetism, and Relativity once) but nothing I would be uncomfortable if a prospective employer saw, or appearing on the front page of the newpaper.
PHEM - party like it's 1997-2003!
One company being able to build up a collection your comments and opinions across multiple websites.... Thank goodness I only comment on Slahsdot
Bear in mind, most of the people the world haven't structured their lives to understanding technology. They may like technology, they may be technology groupies, but they probably haven't really contemplated the ramifications of technology or how it can be used differently than their preconceived notions. They probably don't necessarily get that databases can be cross-referenced so easily or that unless they're willing to go through a specific amount of work each and every time they want to obfuscate their identities, it's likely that someone can figure out who they are.
Another thing to remember, it's never really been possible to be truly anonymous when saying something in text. In the days when the printing press was the preferred way, one still had to have trusted people to help print and distribute the words. In early electronic days when dialup was king, there were always phone records and one had to have accounts on bulletin boards, and systems like fidonet kept origination records. In the days of Usenet, messages could at least be tracked back to a newsserver of origin, and assuming that records were kept, the ISP information could be found and then the subscriber account could be identified.
Nowadays, unless the person wants to take the special laptop that's only used for this purpose, with a special add-on wifi adapter, go park next to a public wifi hotspot and use that public connection, being sure to store the equipment far enough away from themselves when not using it for plausible deniability, there's really isn't true anonymity. If one wants to truly remain anonymous, one generally has to not say anything. That's the tradeoff, true anonymity comes at the price of nonparticipation.
Do not look into laser with remaining eye.
Part of the problem is the fact that Europe has been trying to block free speech on it.
I am not supporting racist or care for their ideals. But blocking out hate speech is more dangerous then trying to stop it.
Why?
Because the hate speech goes underground, where there is no sense of the scope of the problem. So the government doesn't understand how big the problem is and unable to do an appropriate protection of the hated groups.
Secondly there isn't a counter dialog going on to discredit the hate logic. So people get this feed of hate in private and told that it is taboo, so they keep it quite, however there isn't anyone pointing out the flaw in their reasoning. So they can create more people who hate.
Free speech is necessary, however it isn't safe or easy.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Disqus has been blocked at my firewall for some time.
Not because of this, but because I was seeing it on so damned many sites it's not funny. Which means I didn't trust it to be anything good for me.
There's so much shit on the internet these days that if you're not using cookie/script/beacon blockers you're just handing over your information to a company for profit.
I believe every hacker on the planet should be working to release the private details of every company executive (and their families) involved in this stuff. If our personal information is a commodity, then don't act like yours is any different. Assholes.
Much like Zuckerfuck fiercely protects his privacy while undermining ours, you don't get to choose that your privacy is more important than mine.
Lost at C:>. Found at C.
Actually Expressen are not revealing the identifies of politicians who commented on expressen.se, they are revealing the identities of commenters on racist / xenophobic sites friatider.se and avpixlat.info. The articles and comments on these sites are mostly very harsh, distastefully racist, and written anonymously. They have identified very racist commenters as members of the controversial, Swedish far-right, and most would say racist, party Sverigedemokraterna. The SD-party works hard to portray a more polished image, with for example a "zero tolerance policy on racism", which equates to you might be kicked out if you say or do something too obviously racist. SD has it roots in the 90s far-right racist movement in Sweden (http://www.youtube.com/watch?v=LZWsZyShR_s), and one their mottos is "Sweden for the Swedish". The party is definitely mostly racist, but their official political stance is more xenophobic and social conservative, with a few immigrants joining their ranks complaining, for example, that it is the Somali or immigrants who are the "real problem".
Researchgruppen used a Disqus security flaw to find out which e-mail addresses were behind some of these racist commenters, and are now revealing that behind the nicknames were SD-politicians. So.. This is a big win for Expressen, since the Swedish mainstream media and most Swedes are sworn enemies to Sverigedemokraterna.
And on another note.. Congratulations to Flashback, the quite huge, Swedish, non-profit, ultra-liberal and quite lawless discussion forum, which has absolute free speech and therefore has become illegal to run from Sweden (it's now run from abroad). Flashback has through the years succeeded in keeping their users anonymity safe and freedom to speak total, no doubt without attempts form the Swedish state, police and media to the contrary - since flashback has become the main for hub for discussions about controversial subjects like drugs, racism and much more.
Morals of the story:
don't leak hashes.
Salt the data before hashing
Don't trust any website to value your anonymity over their profits.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
But seriously, who uses a real email address to register anywhere?
In this case, members of the Swedish racist party "Sverigedemokraterna". They are trying to paint a picture of them selves as "not racist" and "merely anti-imigration", and the party leadership has adopted a policy of excluding anyone who makes racist statements openly. The "avpixlat" site was officially not associated with the party, but it was an open secret that this was where they vented their true opinions anonymously.
Now the hackers have a list hundreds of names linked to incredibly racist quotes that they will presumably publish one at a time in order to do maximum damage to the party before the elections next year.
In Europe we have an increasing problem with racism and hate speech, especially on anonymous internet forums.
Which is appropriately countered with more speech.
Give me Classic Slashdot or give me death!