The limits of social network privacy
The Lone Ranger was one of my favorite shows growing up. With his trusty side kick Tonto, he would always appear just in time to foil the bad guys and leave everyone wondering…”who is that masked man?” Was it really that hard to determine his identity?
Many people today ride into Facebook, MySpace, Linkedin, and other social network sites with their masks on, expecting privacy and anonymity. But how hard is it to find them?
I was looking for an old colleague of mine who is not on any social sites so I searched Linkedin for his friends in the Washington DC area. I figured they could tell me how to find him. While looking at the company listings in the area, I came across a guy who, figuratively speaking, had his mask on. His name was listed as “Private” because he had clicked on some privacy setting in Linkedin. Wearing a privacy mask in a public room tends to draw more attention to oneself so out of curiosity, I wanted to know who he was. (Out of respect for Jon’s privacy I won’t disclose him.) But it took me about 10 seconds. I will show you how easy it is.
But first, back to the Lone Ranger. We can assume the Lone Ranger lived in the area because he was always foiling bad guys within the same desert geography. One can only travel so far and so fast on horse. So from a given population within a reasonably limited radius, we are looking for someone with the following characteristics:
1. Unique facial features-Square jaw, dark eye color, short black hair
2. Race (White)
3. Body type-Estimated height (5’10-6′), weight (185-200 lbs), and build (muscular)
4. Social circle-Hangs around with an Indian named Tonto. If you find and “friend” Tonto, you find LR.
5. Pets-Rides a white stallion. It’s the biggest horse in the area and it leaves BIG tracks for ease of following. It’s also the only white horse living in the area. Goes by the name Silver. Find white stallion, find LR.
So who was the masked man? If they had Internet connectivity at the ranch back then, they could run this query in the Google search box:
location: los angeles county “lone ranger” “tonto” “white stallion”
Go ahead and copy and paste that line as is into Google. You should find his name pretty quickly. He passed away in December 1999 at the age of 85.
To find a Linkedin private profile, you follow the same logic. Search the area with 3 or more characteristics.
So in practice you would search among the web population of Linkedin profiles and pick for example: Job Title, Company, Location, and Educational Institution as identifiers. The odds are very low that two people have the same set of identical backgrounds but you might have to narrow your search by adding more identifiers if you get multiple profiles. Searching within Linkedin will likely lead you to privacy blocks. But search from outside in, via Google, and you’ll see things from a new angle.
Here’s the sample query I ran and confirmed with 100% certainty the identity of the Linkedin masked man:
Site:Linkedin.com “Company name” “Washington DC” “ABC University”
The Site command tells you where on the web to conduct your search. In this case, the Linkedin.com domain. Put quotes around your identifiers to make your query more specific and add a few more if you need to, like previous employer.
There are over 1,000 private profiles in Linkedin. If you have a real need or desire to remain private on a social network site then maybe you need to rethink your strategy.

March 19, 2010 | Posted by Eagle
Categories:
Tags: