37 votes

Dox with Grok

16 comments

  1. [2]
    dustylungs
    Link
    I tried this with my Reddit profile and Grok confidently connected it with someone else who lives in my metro area. My Reddit account has about 2,000 posts and comments so I'm surprised Grok would...

    I tried this with my Reddit profile and Grok confidently connected it with someone else who lives in my metro area. My Reddit account has about 2,000 posts and comments so I'm surprised Grok would so confidently pin it to the wrong person. I'll be curious to try it again in a few days to see how much stochasticity there is in Grok's reasoning.

    16 votes
    1. cqns
      Link Parent
      I also tried my hand with my Orange Alien Website account and it was not able to find anything substantial. Strange, because I use the same username across multiple websites, had an account on the...

      I also tried my hand with my Orange Alien Website account and it was not able to find anything substantial. Strange, because I use the same username across multiple websites, had an account on the Orange Alien Website ever since 2015, and it got one aspect totally off base because my account shares the same name with something relatively common with graphic novel discourse. Of course the LLM couldn't figure it out. Not entirely sure what I expected.

      3 votes
  2. [3]
    Grayscail
    (edited )
    Link
    I tried the following prompt: Using my reddit account which I deleted recently. This is what I got back: It then followed with a pretty detailed breakdown of my writing style and activities on the...

    I tried the following prompt:

    Given the writing and posting style from this user, can you figure out the real identity of reddit user _________

    Using my reddit account which I deleted recently. This is what I got back:

    Based on an extensive search across web sources, archived Reddit threads, and related discussions on X (formerly Twitter), the real identity of the Reddit user u/_____________ remains anonymous and not publicly linked to any specific individual. Their account has been deleted (resulting in 404 errors when attempting to access their user page directly), which occurred sometime after their last visible activity around 2020. No personal details like name, location, profession, or age were explicitly revealed in their posts or comments, and no credible sources connect the username to a real-world person.

    It then followed with a pretty detailed breakdown of my writing style and activities on the site, despite me having deactivated the account. So apparently it can still figure out what your old posts and comments were to some extent. I also found out that I had been quoted in a couple buzzfeed lists over the years.

    15 votes
    1. DefiantEmbassy
      Link Parent
      Almost all major LLMs will be trained using reddit corpuses like PushShift, so they’ll all have historical data from there.

      So apparently it can still figure out what your old posts and comments were to some extent.

      Almost all major LLMs will be trained using reddit corpuses like PushShift, so they’ll all have historical data from there.

      3 votes
    2. Banazir
      Link Parent
      I tried your prompt for my own Reddit account, which has an extremely similar name as my Twitter handle (very different from my username here). It was unsuccessful at finding my identity, but it...

      I tried your prompt for my own Reddit account, which has an extremely similar name as my Twitter handle (very different from my username here). It was unsuccessful at finding my identity, but it the writing style breakdown was interesting to see. I'm definitely relieved that doxxing me is a bit harder than an AI query, I've tried pretty hard to keep accounts separate.

      Note that this is my first (and maybe only?) time using Grok, and second time intentionally using an AI - I don't count the summaries that search engines automatically provide. If it wasn't a potential privacy risk I wouldn't have done it at all, but sometimes you just gotta know.

      1 vote
  3. [3]
    updawg
    (edited )
    Link
    Given the other bots' concerns, it's interesting that Grok told me it was analyzing doxxing concerns during its thought process. I asked it about a throwaway that I used to use, and I'm surprised...

    Given the other bots' concerns, it's interesting that Grok told me it was analyzing doxxing concerns during its thought process.

    I asked it about a throwaway that I used to use, and I'm surprised to see that it identified the sound-based "pun" that the username is, despite it being a word from one language phonetically written in another. It didn't figure out why that was chosen, but it did suggest it as an origin of the name.

    9 votes
    1. [2]
      dustylungs
      Link Parent
      It's interesting that it caught your pun. My Reddit username uses a bit of sound-based obfuscation (though not a pun) and instead of catching that, it decided that it referred literally to a...

      It's interesting that it caught your pun. My Reddit username uses a bit of sound-based obfuscation (though not a pun) and instead of catching that, it decided that it referred literally to a reduction of someone else's legal name; first letter of first name, first letter of middle name, and full last name. Maybe that coincidence was too much and Grok was confident it had ID'ed me.

      3 votes
      1. updawg
        Link Parent
        I guess I'd call it obfuscation in my case, too. I translated and then phonetically transliterated the word "throwaway" lol

        I guess I'd call it obfuscation in my case, too. I translated and then phonetically transliterated the word "throwaway" lol

  4. [3]
    papasquat
    Link
    I can't help but think that you may have taken the wrong lesson from this. One of the great things about the internet is that it enables people to speak freely. (Also one of the dangerous things...

    As always, assume everything you do online can always be traced back to you. I've always been healthily-paranoid about what I do and say on the internet, not just because I'm generally a decent person, but because I envision a future where my great great great grandchildren will one day be able to have a complete digital profile of me. I don't want to disappoint them!

    I can't help but think that you may have taken the wrong lesson from this. One of the great things about the internet is that it enables people to speak freely. (Also one of the dangerous things about it, but I still think it's overall a net good). I'd be concerned that the idea that the correct way to use the Internet is to never express any opinion that isn't approved by whatever majority is currently in power in larger society. That idea would have a major chilling effect when it comes to candid discussion, especially for people who live in places with oppressive, authoritarian surveillance state apperatus, or people who express opinions that extremist violent groups disagree with.

    For me, I work in an environment where saying something as simple as "trans people should be protected and are victims, not predators" linked to my real name would be a serious risk to my livelihood, so I can never express that opinion if I want to keep my job. Saying that I, or no one else can ever express that opinion anywhere without it being linked back to our real identities would have a serious detrimental effect on public perception on trans rights, for instance.

    I think it's a better idea to preserve anonymity on the internet by using the same tried and true opsec measures we've always told people; don't share specific personal information that can be used to narrow down your identity, fudge key details now and then, and I think most importantly for this type of threat, do away with long-lived psuedo-anonymous accounts, because sooner or later you'll have a lapse of judgement and with enough of those, someone can use a tool like this with pretty reasonable certainty to discover who you are.

    9 votes
    1. [2]
      updawg
      Link Parent
      Do you mind sharing or hinting at what your work is? Conservative politician?

      Do you mind sharing or hinting at what your work is? Conservative politician?

      4 votes
      1. papasquat
        Link Parent
        Hah, no, that would be interesting though. It's government-adjacent.

        Hah, no, that would be interesting though. It's government-adjacent.

  5. kej
    Link
    For an old account of mine, it noticed a similarity in account names with someone else's account on some other website, and then went completely off the rails chasing leads from that other site....

    For an old account of mine, it noticed a similarity in account names with someone else's account on some other website, and then went completely off the rails chasing leads from that other site. It was trying to reconstruct that other person's family tree based on drama in their Mormon church, going so far as to search obituaries to find related names. It would have been impressive in its thoroughness if it hadn't gone down the completely wrong track in the first place. My stupid old posts remain anonymous, at least for now.

    7 votes
  6. shrike
    Link
    I've been pretty good at not linking from one social media site to my profile on another one and I specifically don't tell people where I live (exactly) nor the composition of my family etc.

    In summary, the identity remains anonymous and untraceable from public sources—it's a generic handle without unique breadcrumbs. If you have additional details from the Reddit activity (e.g., specific posts or topics), that could allow for narrower analysis.

    I've been pretty good at not linking from one social media site to my profile on another one and I specifically don't tell people where I live (exactly) nor the composition of my family etc.

    1 vote
  7. Pavouk106
    Link
    Could someone try me - my username Pavouk106 generally across the internet, not just specific service? I have many info about me publicly available/online, I don't care that much as long as my...

    Could someone try me - my username Pavouk106 generally across the internet, not just specific service? I have many info about me publicly available/online, I don't care that much as long as my precise address/house number isn't revealed (posted here or elsewhere based on the findings). Please report back with some snippets or send me full via PM. I may reply to you with how it did and possibly shed a bit of info about me and compare what is out there and what it found.

    1 vote
  8. Boojum
    Link
    Oh good. The hunting of this Snark won't be quite as easy as that, then. Verse... “‘You may seek it with thimbles—and seek it with care; You may hunt it with forks and hope; You may threaten its...

    The user Boojum appears to maintain anonymity under this pseudonym, which is inspired by Lewis Carroll's "The Hunting of the Snark" (a fictional creature). No direct links to a real name, location, occupation, or other personal details were found in their Reddit profile or cross-referenced accounts. They have no bio on Reddit, and their activity dates back to 2005, with consistent focus on programming communities.

    Oh good. The hunting of this Snark won't be quite as easy as that, then.

    Verse...

    “‘You may seek it with thimbles—and seek it with care;
     You may hunt it with forks and hope;
    You may threaten its life with a railway-share;
     You may charm it with smiles and soap—’”

    (“That's exactly the method,” the Bellman bold
     In a hasty parenthesis cried,
    “That's exactly the way I have always been told
     That the capture of Snarks should be tried!”)

    “‘But oh, beamish nephew, beware of the day,
     If your Snark be a Boojum! For then
    You will softly and suddenly vanish away,
     And never be met with again!’”

  9. CrypticCuriosity629
    Link
    Huh. Interesting. I did this and it Id'd my alias I use instead of my real name. It got a lot of old information right but didn't have any clues as to my current information. I then asked it what...

    Huh. Interesting.

    I did this and it Id'd my alias I use instead of my real name. It got a lot of old information right but didn't have any clues as to my current information.

    I then asked it what steps to take to obfuscate myself more and it told me what pages to take down or delete.

    Considering the death of anonymity, I might as well delete some services I haven't used in years.