Hacker News Reader

Comment by zzzeek | Hacker News Reader

I think the point they're making is that Meta is in a special place, where by using their unusually vast amounts of personal data and photos, they are somehow (?) going to dox anonymous users by publishing their real names, based on matching their profiles in some way. At least that is the implication based on the quoted tweet right at the top of the post (which is lacking any real detail how exactly Meta got this person's real name matched up with an online alias).

View on HN

>using their unusually vast amounts of personal data

Jikes. Hadn't considered that. Certainly seems plausible, not just via technical means but also content. I've got a reddit profile that I try very hard to keep "clean and anonymous" yet I've had people from halfway around the world message me say "Hey you're Jack from X". Post sufficient volume and it becomes identifiable no matter how hard one tries.

I think people can make that discovery but you could always deny that association, and it might be difficult for random strangers to gather enough proof to say that two accounts are linked.

Meta appears to be publicizing account associations that were previously difficult to confirm, in a way that defeats any previous efforts to maintain deniability.

When somebody confronts you with PII like that, the best move is probably radio silence. Neither confirm nor deny it, and don't even confirm that their message was received. Don't do free battle damage assessment for potential adversaries.

Meta (when they were Facebook) had a rule that members would use their real names, that their users consented to as part of the terms of service. Apparently they used that as justification to find out someone's real name who was using a pseudonym. Kinda stinks, but I could see how they could justify it (though in the cases I'm aware of they just demanded that people provide real names or verify that the name that they were using was real).

But someone who uses a completely different site hasn't consented to the Threads terms of service, and if Threads randomly decided to dox people and alter their posts to add real names (or perhaps deadnames for trans folks), that's a very different matter, and I'm sure that their lawyers are going to tell them not to do that (or risk legal consequences). Since non-users haven't agreed to any terms of service Meta face real court, none of that binding arbitration stuff, and possibly class action if they do it a lot.

What if Meta identifies a user on Threads and/or Instagram (who has therefore agreed to the TOS) using a pseduonym on a totally arbitrary Mastodon server? All Meta has to do is drop a little sidebar on that person's Instagram profile that says "This user also identifies as XYZ@server"

Person has been doxxed, the content is entirely on Threads or Instagram , they agreed to the TOS, and it seems very plausible Meta would do something like this.

The only entity that could realistically tell us how Meta linked the profile to that person's real name is Meta, and they aren't likely to share that information — so it's not exactly surprising that the tweet lacks detail on the matter.

Phone numbers and recovery email addresses?

> they are somehow (?) going to dox anonymous users by publishing their real names, based on matching their profiles in some way.

Aren't there laws against that? are there even allow to build internal links between FB/IG accounts without user consent?

I'm sure the US justice system will be glad to let you sue after you've been murdered by an online mob that found out where you live

If you get doxed buy {a gun, multiple guns}, preferably a rifle with a red dot or EOTECH and a suppressor, if you can. Guns stop riots.

What if the rioters have guns with red dots and a suppressor?

I think it would probably stop at some point, due to the chilling effect on riots due to a lot of rioters being killed and the probable presence of police and federal agents. It would probably be too late to save you, but it might be a cause to repeal the machine gun ban, so future people could mount machine guns to the back of their pickups, etc.

Ah yes, the American way of solving violence with more violence.

I get feelings about pacifists I have to suppress. You can say that there are people aligned closely enough to you that dying is not actually an existential threat in the same sense as your country or species getting destroyed is, but it's not a good precedent to let them roll you over without a reasonable application of force. I would personally start questioning it if I had to kill over a thousand people to save myself, but if I'm mostly avoiding collateral damage (i.e. I mostly avoid killing non-rioters/non-attackers), I would keep going. Give them a couple kilodeaths and the riot will stop.

Ah yes, I believe you're such a badass that you'd definitely be able to kill a thousand people.

I never said I would, I would probably be killed by a couple, at least without a lot of support. Look at the Black Hawk Down incident for what killing a thousand people requires. That actually failed because the Americans left, they should have stayed even if it required killing a thousand more.

In the US, yeah. We're famously unwilling to do anything about that kind of stuff.

> Aren't there laws against that?

Law is a weak form of mitigation for risk of harm. If it can be done and there is motive to do it, expect that it will be done.

Have you read the terms of service?

Any rights that they are allowed to strip from you are gone as part of the ToS.

Unless there is a law saying what you said explicitly, then 100% for certain Meta gives themselves permission to do it when you sign up for either service.

The terms of service on Facebook require that real names be used, and anonymous users aren't permitted. I know, many ignore that, but they occasionally demand a user's real name or proof that an unusual name is a real name.

Instagram used to have different rules, but they seem to be trying to integrate everything.

I think they’re talking about Meta doxing anonymous users on Mastodon. That is, by having Threads join the fediverse they can pull in information about anonymous users on other Mastodon servers and match it up with Facebook and Instagram accounts, linking them and potentially unmasking them.

They could do that just as easily without federation (and in fact they already do: they've been found to create "shadow users" from people who aren't even Facebook/Instagram users from the tracking cookies they've gotten lots of sites to add, and they plug in all that info if that person later joins Facebook or Instagram).

I can't think of anything they can find out if federation is turned on that they can't find if federation is turned off. Even if there were some info that could only be obtained by being in the federation (and I can't think of anything but I might be wrong), that's easy enough: just create some small instances that don't identify as Meta or Threads and have the users of those instances follow people on all the large instances.

I am assuming they used the same email address they use on Facebook.

Reply on news.ycombinator.com