Silk Road forums
Discussion => Security => Topic started by: ZenAndTheArt on August 02, 2012, 09:54 pm
-
From reading these forums for the past four months I've got to know some of the general personal details of the regular posters.
If LE is also reading the posts on this forum, they could be creating (to a greater or lesser extent) personality profiles on some of the members.
If I can read between the lines and fill in the gaps to get a general idea of some members details (jobs, location, marital status, wealth, sex, colour etc.) then a professional profiler would do a much better job. Do you think this is something we should worry about or does it not matter that much? Could they really use it effectively against us? Thoughts anyone?
*gets tin foil hat out* :-X :-X :-X
-
Excellent post for discussion! +1!
Not only can they profile you based on your personal traits, but also your typing style, spelling, etc. Always be self-conscious of the personal image you are creating with your words. Never give away anything (or a combination of things) unique to you or your immediate geographical area. Don't get too personal either; if you have to, just make shit up without coming off as a bullshit artist trying to inflate their ego. Obviously this applies to vendors and other high risk members more so than occasional buyers, however, you never know where you are going to end up one day. You may be a buyer today and then decide to become a vendor tomorrow. Always keep your buyer and seller personas completely separate! Tell absolutely no one about your SR activies except trusted business partners that NEED to know. I know it's hard, but either you run a tight ship or go to jail. Need to boost your ego? Get off your ass and accomplish shit so that you have the confidence not to brag!
-
I think we definitely are.
-
time to make a new account then .... again ,-)
-
Yeh, I agree, it's really the mods and vendors who have to worry about this. I mean, if you've got thousands and thousands of posts here, surly all those little details start adding up and when you read between the lines. You don't have to openly state something for it to be obvious. If you talk enough about yourself sometimes the things you don't say start building a picture. For example, someone may go on about how their watching such and such on TV, then they say a bunch of times that they're going to the shop, then cooking etc. etc. A picture of their domestic life builds up. It soon becomes apparent they live alone, precisely because they have never mentioned someone else. All that domestic info, a wife or husband (or even roommate) has a big impact on the homelife, so the very fact that impact on their domestic life is missing from all that info suggests the person lives alone.
I don't know? I interested in how useful our personal info is to LE, how much should we worry? There are the obvious things like, date of birth, age, address, name etc. But, important are the smaller details?
-
I'm a transgender mixed race Inuit with a stuttering problem, a small penis and I live in a tar paper shack.
OH...MY..GOD!!!
I never thought I'd meet anyone else like me!
Are you pre-op girl to boy? Because I'm pre-op boy to girl? Let's get married and have kids.
Fuck all these drugs I've meet my dream girlboy ;D
-
lol at all of you. ;D silly rabbits. trips are for kids.
-
If LE was making a profile on me based on my posts, they'd know:
I live in the USA
I'm an adult male
I live alone
I live in the mid-high class in terms of my financial security
I live near the west coast
I live a few hours from the beach
I live an hour away from any major city
However, that is based off of some of my posts. If you read some of my other posts, you could assume that I'm:
A teenage female living in Canada who lives with her mom in Virginia.
I change up the little details of my posts a lot. I'm pretty paranoid about this kind of thing, so I've made it my goal to "accidentally" slip up and give away details which may or may not be false in my posts. I highly recommend giving several different kinds of false information in posts, just in small snippets, so LE can't build a profile for you. However, giving them information could make them waste their time trying to verify if any of the information at all is legit, while you may just be wasting their time.
-
Trust me, there's shoals of red herring around here. :D
A lot of assumptions you can make trying to profile people in real life, kinda rely on people being relatively consistent.
This is a darknet drug forum. Fairly paranoid people. On anonymity software. On drugs. On the Internet.
Even if we all told the the truth and 'nutting but da truth'... Good luck with that.
Paranoid Pine
P.S. Look into anonymouth if you're interested in defeating adversarial styleometry (a way of fingerprinting you digitally from your style of posting).
-
My name is JOHN and i live with my MOM in our WINNEBAGO and her PIE fills me UP when I am DOWN.
-
P.S. Look into anonymouth if you're interested in defeating adversarial styleometry (a way of fingerprinting you digitally from your style of posting).
this tool was never finished, it'll likely require at least two more years of senior design classes to finish it
I agree, I mean the version number is 0.0.1! But in the meantime an alpha version trumps nothing at all or doing it manually, which is not really feasible.
After all, technically the Tor Project itself isn't finished. You get what you're given. :P
-
I am a vegetarian psychologist... from the north western coast.
:)
I like salads with 1000 island dressing and I don't EAT MEAT YOU FUCKERS!
And I love Jagged Little Pills! ;)
-
If LE was making a profile on me based on my posts, they'd know:
I live in the USA
I'm an adult male
I live alone
I live in the mid-high class in terms of my financial security
I live near the west coast
I live a few hours from the beach
I live an hour away from any major city
However, that is based off of some of my posts. If you read some of my other posts, you could assume that I'm:
A teenage female living in Canada who lives with her mom in Virginia.
I change up the little details of my posts a lot. I'm pretty paranoid about this kind of thing, so I've made it my goal to "accidentally" slip up and give away details which may or may not be false in my posts. I highly recommend giving several different kinds of false information in posts, just in small snippets, so LE can't build a profile for you. However, giving them information could make them waste their time trying to verify if any of the information at all is legit, while you may just be wasting their time.
Personally I've already revealed that I am :
- Male
- Early thirties
- Work in Hedge Funds for a High Street bank in the UK
- Live on the Isle of Man (population 80,000 or 40,000 if you only count the men)
- Own my own house complete with wind turbine
- In a committed relationship with a long term partner who has a teenage daughter
- Have worked in London in the past.
- Have recently opened a bank account in the Caribbean.
Come on LE, I really couldn't make it much easier for you! :-)
V.
-
Styleometry is really overrated. I seem to remember a few years back that the author of a book entitled "Primary Colors" was revealed to be none other than journalist Joe Klein. Apparently, literary analysis by an academic had earlier fingered Mr. Klein, but he denied authorship.
What needs to be remembered is that for such analysis to be carried out, you need two things:
1) A large volume of material written by the ostensible author; and
2) A large volume of material written by the Anonymous would-be author.
As a journalist, Joe Klein had a huge amount of material published under his own name. The problem with styleometry, is that it requires a large amount of material written under your real identity, to compare the anonymous/pseudonymously authored materials to.
If one is careful not to post under their real name, there is nothing identifiable to compare the anonymous/pseudonymously authored material with.
Guru
Right now? Yes, sure thing. I mean the whole concept has only come into its own with computation sorta recently as far as I can tell.
I think there have been some decent advances in styleometry though. I've been keeping an eye on the Drexel Group's work on styleometry evasion, and here are some numbers of where it's at these days:
You can, if you have 50 or less suspects, ~6500 words from an author IDed source as a benchmark and only 500 words from an anonymous source, identify with a very high degree of accuracy who that person is.
Now, I'm certainly not claiming you can just obtain our posts here on SRF and then compare it to every tweet and forum on the web to get results. But... certainly very powerful organizations are working very hard indeed to obtain exactly those kinds of powers. Brennan says the results can be good intelligence for a set containing 100s, even 1000s of suspects.
My real concern is that our data is pretty much stored forever, and therefore the improvements in technology, software and hardware could eventually evolve it into a genuine threat, esp. combined with other intelligence forms. The fundamental principal of counting is the ultimate enemy.
Hence: paranoid pine.
-
for this very reason, i create a new account here whenever i get to around 250 posts. i recommend you all do the same.
i know its tough because we get so attached to our names and presence here, but this really isn't the kinda place where you want to be a celebrity post whore. better to be like a ghost.
-
Or just don't be yourself?
:P Remember, it is an anonymous network
-
first time ive smiled reading sr forums thank you
-
Use google translate to translate each sentence to latin then copy paste the latin and go back to english. It'll be so garbled I don't think they can figure out who you are. Unless you use the same method on any social media you use.
-
I got so high I forgot I was/am.. so.. Idk how anyone could find me.
-
I got so high I forgot I was/am.. so.. Idk how anyone could find me.
Are you saying using disocciatives would be one way to keep your personality from showing through in your posts? I suppose they might.
-
+1 for the paranoia boost - a little never hurt anyone.
I really attempt to not leak out too many details but nobody is perfect.
-
If they are doing this then if I get any other title than "Massive Cunt" I shall not be impressed. If you are out there reading SOCA/FBI/DEA/Whoever else in the Alphabet Spaghetti is out there I want the title "MASSIVE CUNT" and that is spelled capital M, capital A, capital S, capital S, capital I, capital V, capital E - SPACE - capital C, capital U, capital N, capital T just in case you didn't know. :)
-
If they are doing this then if I get any other title than "Massive Cunt" I shall not be impressed. If you are out there reading SOCA/FBI/DEA/Whoever else in the Alphabet Spaghetti is out there I want the title "MASSIVE CUNT" and that is spelled capital M, capital A, capital S, capital S, capital I, capital V, capital E - SPACE - capital C, capital U, capital N, capital T just in case you didn't know. :)
I'm sure SOCA won't have too much trouble with the second word - it's only four letters long and they must hear it often enough anyway. :-)
V.
-
If they are doing this then if I get any other title than "Massive Cunt" I shall not be impressed. If you are out there reading SOCA/FBI/DEA/Whoever else in the Alphabet Spaghetti is out there I want the title "MASSIVE CUNT" and that is spelled capital M, capital A, capital S, capital S, capital I, capital V, capital E - SPACE - capital C, capital U, capital N, capital T just in case you didn't know. :)
I'm sure SOCA won't have too much trouble with the second word - it's only four letters long and they must hear it often enough anyway. :-)
V.
Ha you aren't wrong mate.
-
for this very reason, i create a new account here whenever i get to around 250 posts. i recommend you all do the same.
i know its tough because we get so attached to our names and presence here, but this really isn't the kinda place where you want to be a celebrity post whore. better to be like a ghost.
Ok, but that doesn't even work.
I mean, on the handle level or SRF usernames level, that works for anonymity. You're right there. It's a trade off of whether you want the added value of a reputation vs more anonymity. But adversarial styleometry attacks would actually very easily reveal who all your alts are as long as you spent >= 500 words on them per alt (for just the drexel group's software).
I mean, I could easily just use something like Jstylo, and then take random samples of 50 people from the entire forum against 1 poster's text as a benchmark. Then you could just repeat that process hundreds of times until you've processed all possible combinations of SR users in blocks of 50 within the universal set of SR members. Finally, you would collate all that data and look for the 'top performers'. It's a bit of work, could probably be made a lot simpler, but there's nothing complicated about it conceptually that I can see.
However, if you used Anonymouth, and modified the features for each alt, then this is impossible.
You can't do that for the Internet, because it's fucking huge. This combinatorial algorithm grows exponentially. But on just 1 forum, it's trivial.
Finally, editing or deleting your posts is a waste of time if the enemy is page scraping everything. Which they are unless they're bumbling idiots. In fact edits or deletions are likely to attract more attention rather than less.
Paranoid enough yet? ;-)
-
^^That's one thing. For most users, giving away personal information will only be a major concern if they are already being pursued/suspected through other means.
Say LE has a suspect, a list of potential suspects, or even a small geographical area where a known SR user resides. They can then use personal details to either narrow the search, or confirm that a real person (prior suspect) is a user on SR. All it takes is for someone to rat you out or indirectly compromise part of your anonymity. Then LE can go to a judge, show them an affidavit stating that Person X--who was identified as SR User X by a CI or some security breach--is always online when SR User X is, gave away things like age/occupation/gender/appearance during correspondence on SR that match Person X, etc. etc.... and get a warrant. Even if they don't have enough for a warrant, you can still expect to be put under heavy surveillance and harassed while driving, etc.
-
One of these days when I am feeling bored - I will fill out requests for each governmental agency to see what kind of a file they have on me. One thing to remember, all US agencies are US bureaucracies, you can get information from all of them on what they know about you and I assume you would know more by what you don't get... I always imagine getting a memo with all but a few nouns redacted with a note"redacted due to ongoing investigation" or something of that nature. For example here the site to request info from the FBI http://www.fbi.gov/foia/requesting-fbi-records/
-
I got so high I forgot I was/am.. so.. Idk how anyone could find me.
Are you saying using disocciatives would be one way to keep your personality from showing through in your posts? I suppose they might.
Whale hell... that's the plan!
-
damn, I want to try Anonymouth but can't seem to make it work on my computer...thing won't even unpack
-
Ask Pine.
I am sure she can help all day every day.
-
damn, I want to try Anonymouth but can't seem to make it work on my computer...thing won't even unpack
Probably downloading the wrong thing. It is a folder with a .jar file you run (you'll need to install java for it to work). Called jsan-0.0.1.
The file size is 61,878,272 in bytes, please check to confirm that number or better yet confirm a PGP signature from the developers and obtain their public key or double confirm a checksum with them (caution! paranoid pine at work!).
-
damn, I want to try Anonymouth but can't seem to make it work on my computer...thing won't even unpack
Probably downloading the wrong thing. It is a folder with a .jar file you run (you'll need to install java for it to work). Called jsan-0.0.1.
The file size is 61,878,272 in bytes, please check to confirm that number or better yet confirm a PGP signature from the developers and obtain their public key or double confirm a checksum with them (caution! paranoid pine at work!).
+1
pewpew
-
Do you think anyone is aware of my wanton desire for drugs? I don't want that in my profile, people might judge me!
(but fo sho: this is a legit thing to keep in mind for everyone postin. I just pretend like you guys are all out to get me).
-
That's because we are...
-
That's because we are...
Wait--what? FUUUUUCK. All these benzos were just startin to calm me down too.
*returns to cave in the mountains*
*makes yeti move his fat ass over*
-
Pine and guru, thanks for the responses. I'm going to do some more poking at it in the morning.
-
Pine and guru, thanks for the responses. I'm going to do some more poking at it in the morning.
Like Guru was saying, it's quite formidable for a user new to stylometry, but have a crack at it nonetheless for the experience. I'll see about posting a straight forward jargon free tutorial when I get a shot of free time (lol, so many projects right now), it's not as bad as it looks at first, you just have to learn some new concepts, it's cutting edge technology, and that kind of stuff very rarely has intuitive GUI designs at first. They assume you know stuff in advance. For the same reason, the implications of stylometry don't particularly worry pine at this moment in time, this is really for getting ahead of the curve in one or two years time when LE starts to thinking about using such tech as a standardized practice (interweb cops!), so I don't expect SR customers need to worry about this :D
Any stylometry explorers are welcome to post tutorials too, the more the merrier! :)