I’ve been sent bomb threats, had family called from people abroad, and been threatened to have my wife told absolute misinformation about my “criminal history”. This is the reality of having an internet presence when it goes beyond “casual Reddit troll” and “I run meme websites and shit post on it”.
The reality is, it’s my own fault. See, in the early to mid 2000’s, cybersecurity wasn’t the typical “budget cost center” or “afterthought” or even “something for a cyber insurer to worry about”. It was like a party line in the 70’s or a modern discord server where you overshare.
The way you talk (type) is absolutely a fingerprint, and I’m doing it right now with this blog. I use too many ellipses, lists, and subtle dry nuance where: applied correctly, could uncover a wealth of other places I’ve posted. Maybe my information is in an Ashley Madison dump when they were exploited, and my chat history has some juicy & life changing chats in there (it doesn’t, but try anyway), maybe I wrote a threat to a sitting US government member (I haven’t), maybe I’ve shared a controversial stance on some current topic (numerous examples). “A decade ago I even started writing a tool to strip out these quirks — I should probably finish it. More on that later.
What you share when you type online shows a great deal of information, which is why Google exists — to harvest your interests and turn that into advertising conversions (sales):
- I belong to a needlepoint group, and I’ve been asking what the group suggest I use for a particular pattern I want to make = an ad notably marked down for the items that address my need — even if the viewer doesn’t plan to buy it, a price may compel them
- Take baking, for example. If I ask “How long should I bake bread at 350°F?” — that one sentence leaks geography. Only a handful of countries still use Fahrenheit: the U.S., Bahamas, Cayman Islands, Liberia, Palau, Micronesia, and the Marshall Islands. Right there, I’ve narrowed you to ~4% of the world’s population.
- Or food. “I had a pop at White Castle and it was terrible, so I stopped at Jewel and picked up a Green River.” That’s a bullseye on the Midwest. White Castle, Jewel-Osco, Green River soda: all regional. And saying pop instead of soda? That nails it further.
- Or money. “The barber only takes cash, so I ran to my bank across the street for $20.” Alone, that’s subtle. But stack it with the other clues? Now I know your currency (USD), your habits (cash withdrawal for small services), and even something about your town layout (bank across from the barber).
- I can’t wait to get to bed, it’s been a long day. So Glad It’s Friday! — These are geographical pointers. I used to work overnight, so most of my friends on the internet would talk about their mates, blokes, or utes — These kind folks down in Australia would easily pick up a standard American saying they’re “tired” when it’s noon their time, because it’s late AF here.
- My audience is probably a good share of folks in the US, so when I start talking about how I drove 120 down a road — even if I don’t qualify it as km/h, it throws flags. But… talking about going 25MPH down a road is mundane to people in the US — internationally, that’s just as jarring.
- What about spacing? Do you still put two spaces after a period? That’s not random — it’s a fingerprint. It usually marks you as older, or at least someone who had MLA drilled into them back when typewriters (and early teachers) insisted on it.
Pictures Tell on You Too
A picture really is worth a thousand words, sometimes more.
My aunt once posted a photo of a car accident outside her house. In the background? A local general store and a McDonald’s. With one Google search I could pinpoint her exact town and even the room in her house where the picture was taken. I messaged her to lock it down.
Same thing with nature shots. If I share a picture where the maple trees are green in January, that’s an instant clue: Southern Hemisphere. Post a storm cloud? Someone with too much time can pull up live weather radar and triangulate exactly where that system is.
Add in a stray license plate, a storefront, or a regional chain sign, and suddenly your “harmless” picture is a breadcrumb trail.
Even the “Hidden Stuff” Leaks
I used to think I was good at hiding who I was online. Then I got cheap. Instead of paying $7.99 for a domains-by-proxy service to anonymize my WHOIS info, I let it slide. Instantly, my name and address were public record.
That one little oversight connected everything back to me — and eventually fed into the threats, the bomb scares, the phone calls to family. Not because the attackers were geniuses, but because I left a breadcrumb in plain sight.
2+8=10, 5+5=10, 1+9=10
Notice the math? When you add two numbers, there is zero reliable way to determine what numbers fed into the equation. This is simple “addend masking”, I can tell you two numbers as a passcode, and if they add up to the goal number, then we’re in.
Weird pivot? No — Adversarial Stylometry is what’s on the menu. What’s Stylometry? Remember “-metry” is the measurement of, so we’re measuring “stylo” — or your unique style.
Ignore the above, unless you’re completely new to having problems with people on the internet, that’s all obvious. What isn’t — is the way you type. We’re measuring your unique style.
What typos do you make often? Farenheight? AlGoreIthm? The famed there/they’re/their? What sort of shorthand do you use? “k”, or maybe “lol” or maybe “tysm”?
What about inconsistent use of contractions? They are? They’re?
It’s all about the dataset — if you homogenize on the majority, you will mask it. If you use a shared tool that many people use, then a great deal of the obfuscation fingerprint will blend into the ether, as everybody is expressing an idea in general terms.
Let’s talk other markers — Did you know that 1,000 and 1.000 are the same number? It’s true. In some countries, the thousands separator is a decimal (.) and in most I’ve seen it’s a comma (,). Or dates — I’m a nerd and I love dates in the YYYY/MM/DD format because computers can sort it easy, it goes into SQL natively, and to me, going biggest to smallest unit (like an address in China) makes a lot more sense that janky US MM/DD/YYYY or worse — MM/DD/YY. The Europeans have a somewhat solution for this They usually say 04-Apr-2025, meaning the 4th of April… But that ties to English naming of months. Furthermore, there are different calendar systems out there.
Can You Hide It?
You can’t stop being yourself when you type. But you can normalize yourself — collapse those quirks into something generic. That’s where a tool comes in.
I’ve been experimenting with software that strips out the obvious tells: expanding LOLs, flattening contractions, evening out punctuation, even randomizing word choice in subtle ways. The point isn’t to give you a new fingerprint — it’s to bury yours in a crowd, so you look like “just another user.”
It’s not perfect (nothing is), but it makes stylometry work a lot harder.
When I finish it, I’ll make another post here — this tool will 100% operate in your browser, so you could download local copies or repurpose it. Notably, being an English speaker, it’ll stop there. There will likely be some “Americanisms” because that’s where I live. So I’m happy to take feature suggestions and patches to make it into something that everybody can benefit from.
I learned the hard way that breadcrumbs add up. Stylometry is just the newest one. If we don’t normalize our quirks, we’re leaving a trail… one typo at a time.
Leave a Reply