Hacker News Reader

Comment by mirimir | Hacker News Reader

There's a fourth option: use Facebook with your real name, and separately with fake name(s). For the real-name account, carefully manage "friends" to avoid problems with family, friends, coworkers, etc. Make sure that there's no leakage between your real-name account and fake-name accounts, or among fake-name accounts. Practice good compartmentalization OpSec.

View on HN

That is becoming harder and harder to do as Facebook increases their level of knowledge

Just the Facial Recognition alone has caused problems for people attempting to do this.

Further OpSec is not just on you, I know a couple of people that have tried this only to have OTHER people expose thier data or information by posting things on facebook and other sites about them.

Yeah that 'tag your friends' stuff was pure evil. Brilliant, but evil.

One aspect of compartmentalization OpSec is not telling your meatspace friends about your fake-name accounts. And vice versa. And you wouldn't use real photos in fake accounts.

The problem comes in when/if you use your Alternate Identity (I dislike "fake" as it is no less real than your government approved Identity IMO), to attend events, meetups, or other real world activities.

I know many people are a part of Real Worlds clubs, attend conferences, or other events under Identities that do not match their government issued documents. They do this for a verity of reasons.

The problem is, for very good reasons, most public venues don't like masked people visiting.

Since you can't easily change your face there is a very substantial risk that some human you run across will recognize you, or that some computer algorithm will ask a human likely to to confirm it's tagging of you in a picture they have no context on.

Yes, that is the downside. Miririr doesn't attend meatspace meetings :( But perhaps that will become possible as robotics develops. Snowden attends many meetings via robot. Of course, people help and accommodate that because he's famous. But maybe robotic-presence services will develop. Consider attendant reductions in global climate forcing! I like the vision of temporary bodies in Kevin MacArdry's Last Trumpet Project.[0]

[0] https://anarplex.net/hosted/files/last_trumpet/LTP.pdf

Oh for goodness' sake, not everyone wants to have to think like an espionage agent just to enjoy casual conversation on line. The people who suffer worst from harassment aren't opsec geniuses like you that screw up at critical moments, they're relatively clueless types who don't recognize the level of antagonism they might encounter - just as people in a new town are often ignorant of which neighborhoods are more or less safe (and for who, and why), and just as sheltered people may not be able to read subtle clues that a real-life situation is potentially dangerous.

I am so sick of this 'better security' argument - it's a roundabout way of saying you don't have a good answer. The whole 'better security' argument is based on the notion that conflict is inevitable so it should take priority over everything else (which might be why defense is such a large part of the US' discretionary budget). But taking that as your guide results in substantially worse quality of life. If crime goes up in my city, is the best response for everyone to put bars on their windows and dress in body armor etc. etc.? No, that would suggest we've given up on the idea of being able to reduce crime by any other method. Putting bars on my windows is near the bottom of my list of responses to crime, because it would make me feel like I'm living in prison - in which case, what's the point in being law-abiding, I might as well take up crime myself and hope I don't get caught than spend money on turning home into a fortress.

This isn't an argument against self-defense, but against security costs as a negative externality.

There's even a fifth option: see it for what it is, and apply social pressure. Sure, people are free to use Facebook while accepting it as it is, and I'm free to cut them off for that. It's not like I am not offering arguments, but at this point the burden isn't on me anymore. We're all adults, we all have internet access and history books. It's our choice whether we follow fools or digest the hard lessons of wise men and women, and I for one am not interested in arranging deck chairs or making friends on Titanics. For all things we could feel superior to the old greeks to, I think this is spot on:

https://en.wikipedia.org/wiki/Idiot

> An idiot in Athenian democracy was someone who was characterized by self-centeredness and concerned almost exclusively with private—as opposed to public—affairs. Idiocy was the natural state of ignorance into which all persons were born and its opposite, citizenship, was effected through formalized education. In Athenian democracy, idiots were born and citizens were made through education (although citizenship was also largely hereditary). "Idiot" originally referred to "layman, person lacking professional skill", "person so mentally deficient as to be incapable of ordinary reasoning". Declining to take part in public life, such as democratic government of the polis (city state), was considered dishonorable. "Idiots" were seen as having bad judgment in public and political matters.

Step one is to recognize the problem, and that's compared to the seriousness we should have, we're all idiots. And we no longer can afford it, we have invented to many idiocy multipliers. If that hurts anyone's feelings I'm real sorry, but considering all those war profiteers we host I'd rather be able to look wise people and dead people in the eye, than the people who can't look those people in the eye. The world's a dirty, dark, and more than anything a foolish, petty and derpy place; but cleansing one's own "soul" is possible, to a degree.

Actually I would eventually consider re-opening a Facebook account should they introduce an alias/identity system so that I could manage easily and separately my différents circles.

Of course ads profiling of each identities should also be kept separated. And of course a strong privacy statement backed up by some technical information on the architecture should also be a part of that change (Apple iOS security guide is a good example to follow IMHO).

Unfortunately this look so far away from the current Facebook approach to new users "hey trust us type in your IMAP credentials so we can scrape all your acquaintances by snooping all your mails!"

Google requires phone or text verification on new accounts. I'm not sure about Facebook, but they do require an email address, and that has to come from somewhere. Eventually, you will require verification via phone or text, and that's when it gets harder to prevent these services from linking back to you. I'm not sure what it takes to create a burner phone number not linked to you these days.

None of that really matters if you just want to maintain an anonymous persona aside from your real identity. However, you're still only a subpoena away from the government tracking you down. I haven't even given it that much thought, but it seems really hard to cover your tracks these days.

A few months ago, worrying about such things seemed kind of silly to me. Now, I think I understand the need better.

> A few months ago, worrying about such things seemed kind of silly to me. Now, I think I understand the need better

I am assuming you are now concerned because of the incoming administration. I find this puzzling.

Do you remember this character? https://en.wikipedia.org/wiki/John_Ashcroft

GP might not be old enough for John Ashcroft to be relevant to them. I, on the other hand, remember Ed Meese. We all become aware when we are ready to become aware.

I remember the name and face but had forgotten the details. Here is a nice quote courtesy of Ed Meese's wiki page:

    Suspects who are innocent of a crime should [have Miranda rights]. 
    But the thing is, you don't have many suspects who are innocent of 
    a crime. That's contradictory. If a person is innocent of a crime,
    then he is not a suspect.

For those too lazy to parse this claptrap, the quote logically reduces to "all suspects are guilty".

Yes, it's a pain. So it's simplest to just buy fake-name accounts. Just as spammers do ;) But there's no point, unless you have a pressing need.

If your OpSec is adequate, subpoenas aren't an issue.

> I'm not sure what it takes to create a burner phone number not linked to you these days.

Cash transaction for a prepaid phone. Pretty easy, if not a little inconvenient.

But wouldn't your fake profile start showing up in 'People you may know' section? I've heard Facebook uses IP adresses to link accounts.

So suddenly you have to explain to your real friends/family/coworkers why you have a fake account.

If your compartmentalization OpSec is adequate, there will be not more linkage between your real-name and fake-name accounts than there is between them and my accounts.

That's just a special case of (3). Essentially you're saying 'spend a lot of time and effort on security, much of which may be arbitrarily zeroed by your counterparty.' That's a shitty proposition, because it's basically offloading the cost of doing that onto someone who is at a comparative disadvantage, and allowing FB to exploit the resulting economic gap - indeed, this is their business model.

Naturally people want to use FB because it's convenient to be able to communicate with and make new friends through a consistent convenient interface. FB has a comparative advantage in terms of privacy protection, anonymity etc., simply because it has the data centers and the database and the developers - there's little additional technical cost to going with one policy over another (although there may be a substantial business cost). There's a relatively high technical cost for the individual user in doing all this compartmentalization etc. so most people don't bother - partly because they don't want to pay it and partly because they don't know the business value of the information they are giving out about themselves, and can't easily estimate the economic impact of their decisions.

I'm not saying that maintaining fake-name Facebook accounts makes any sense for most people. As you say, it's too much work, and there's too much risk of losing accounts. But if you need fake accounts, for whatever reason, it's doable.

I don't think that it's a special case of (3). It's rather a combination of (2) and (3).

Or just have a mostly unused real-name account that you use for contacting your friends, when you can't reach them otherwise.

Why even have a fake facebook account? Facebook will know it's you. The government will too.

If you don't want the whole world to be privy to what you post, then why even use Facebook? Just post your green frogs and political opinions on forums and websites that do not base their revenue around tracking you 24/7.

Yes. Unless you have a reason to need other Facebook accounts. To get anonymous logins on other sites. Or whatever.

I think anonymous logins and Facebook accounts just do not combine very well.

No, they don't. But there are use cases where it's worth it.

You're saying that the network effect benefits of Facebook (making new friends or staying in contact with existing ones) are exactly equal to the costs (loss of privacy). They're not; FB chooses what that cost:benefit ratio is by how they set their terms of service and (naturally) puts its economic advantage first. Competitors can't deliver the same network effects as FB so the benefits they can offer are very limited by comparison.

that, in a nutshell, s why we could really use a good social networking protocol rather than a platform. Platforms are like land, land has landlords, and landlords want rents.

Reply on news.ycombinator.com