Monday, August 29, 2011

What Privacy - Orwellian Indexing of Social Media Websites

What Privacy - Orwellian Indexing of Social Media Websites

“Orwellian describes the situation, idea, or societal condition that George Orwell identified as being destructive to the welfare of a free society. It connotes an attitude and a policy of control by propaganda, surveillance, misinformation, denial of truth, and manipulation of the past, including the "unperson" — a person whose past existence is expunged from the public record and memory, practiced by modern repressive governments. Often, this includes the circumstances depicted in his novels, particularly Nineteen Eighty-Four.” (~Wikipedia)


This is a technique that came to my mind when a friend mentioned that most of the popular dating websites actually charge money to initiate contact and have someone else’s identity revealed to you. As a matter of fact, some of those commercial websites will not even allow you to put any contact information in your public profile and screen all pictures for any signs of text when you upload them. Another issue you will encounter is that the other party may actually attempt to cheat you by uploading a picture of some low ranking celebrity. Being frugal in such matters (that is either meet someone in real life, or do not pay money for such websites), I was suggesting a different approach.
Another use case of the technique that I am going to describe is to go beyond hidden profiles on social media websites. Let’s say you met someone that has put some personal information on Facebook or even Google+ that is only visible to a close circle of people and you do not have access this information. Ironically most people are so verbose that they may leak this information somewhere else (forum post, personal website, publicly available job search engine). So the issue is to link the information of the hidden profile to the other piece of information that is currently out there.
A simple yet powerful way to correlate those bits of data is to use a similarity image search, such as Google Image Search. What people do not know is that you can actually search images by similarity there instead of just indexing terms. In order to do so, you need to click on the “camera button” on the Google Image search website then a window will pop open where you can upload any image file that you want to search for.
So the curious task is to go though the profiles that you are interested in, download the profile pictures, and upload them to the search; finally this will link you to the appropriate website. Chances are high that you may actually hit some useful information, especially in the case someone wants to cheat you with a celebrity picture on a website. In addition chances are very high that for convenience people tend to consolidate the images that they use for different social media websites. You can bet that Google already indexed all of them.
For all those computer scientists out there, Google image search actually had a remote API that allowed people to remotely query the search engine. Interestingly they decided to deprecate the interface earlier this year. I guess I am not the only one who figured that there are several interesting games to be played with the search. I bet it is not hard to emulate a simple interface using simple HTTP post and get commands. There are APIs out there for web GUI testing that allow you to simulate form editing.

In Summary

First of all there is no such thing as privacy. Even if you use unique images for each of your presences on social media websites, it will not take long until such image searches embed facial recognition. I used to do research (briefly) in computer forensics before and can assure you that many of those facial recognition algorithms are close to fool proof.
If you on the other hand want to be found the best way to do so is to consolidate the images you use on different social media websites; this is what many people already do, that's why this technique is so effective. In addition to linking profiles of the same person together, you can actually link profiles of different persons together. Think about people using group photos of their club, foundation, or interest group as profile picture. If more than one person of that group does it, you have got them connected.
The technique is especially useful for dating websites or finding people across different social media websites. An image is probably even better than putting that persons email into the search. People tend to protect their email address to avoid spam but are totally unaware of “advances” in image recognition.
If you are looking for more information about these techniques, I can highly recommend Image Processing, Analysis, and Machine Vision. I used to work with this book and forensics in the past (~2004) it has case-studies and hands-on examples how to do magic with image processing and recognition algorithms.
If you find this post creepy, well then thing about various intelligence services, search engines, and large corporations who engage in such activities on a large-scale. Their intentions are not to make a friendly contact with you but to spy you out or market stuff to you that you probably do not need in the first place.

No comments:

Post a Comment