I Block You Because I Love You: Social Account Identification Attack Against a Website Visitor

## Overview

The presentation addresses social account identification attacks aimed at website visitors, exploring how interactions between web visitors and social platforms can de-anonymize individuals. The transcript touches on themes of stalking, social engineering, and the manipulation of user identity through web services, CRM systems, and online platforms. The talk specifically focuses on distinguishing and tracking individuals via social accounts and web tracking mechanisms, referencing marketing campaigns, live shopping, gaming, and betting environments.

## Mechanisms and Identification Techniques

The core attack methodology discussed revolves around contrasting blocking and non-blocking account states to differentiate and profile targets:

* **Blocking vs. Non-Blocking States:** The mechanism leverages differences between a "blocking" and "non-blocking" account status (noted in relation to services and platforms like pokernews.com and Facebook). The variation between these states acts as a differentiator to identify specific accounts or visitor profiles. * **Interface and Social Actions:** The procedure examines user interfaces, social actions, and CRM system integrations to monitor how a targeted account reacts. * **Cross-Media and Web Tracking:** The attack model references tracking user page views (noting page view metrics such as eighth page view), content sources like YouTube, and cross-media tracking vectors across web domains (referencing sites like pz-news.de, pokernews.com, and dgap.de). * **Platform and Device Context:** The technique evaluates mobile platforms, multi-platform display sources, and account derivations across social environments, including tests observing movements into Facebook accounts.

## Experimental Setup and Observations

The speaker outlines experimental parameters and observations assessing the realism of the attack:

* **Experimental Design:** An IT distributor experiment was structured to test whether aggressive account blocking and interaction behaviors could simulate realistic social actions. * **Account Differentiation:** The methodology tests how an ideal target account is differentiated across visits, evaluating whether specific profiles (e.g., historical user data, archive materials, or targeted content streams) can be isolated. * **Contextual Variables:** The experiments observed account status under varied visitor environments, tracking device conditions, mobile usage in different regional contexts, and service provider integrations.

## Impact on Anonymity and Privacy

The primary outcome highlighted is the compromise of user anonymity:

* **Destruction of Anonymity:** The attack demonstrates that manipulating social account states (such as blocking mechanisms) can destroy expected anonymity, particularly in private browsing situations. * **Visitor De-anonymization:** By associating website visitor behaviors with distinct social platform states, an attacker or tracking entity can identify the specific social account of an otherwise anonymous web visitor.