Daniele Perito: How Unique and Traceable are Usernames?

Usernames are ubiquitously used for identification and authentication purposes on web services and the Internet at large, ranging from the local-part of email addresses to identifiers in social networks. Usernames are generally alphanumerical strings chosen by the users and, by design, are unique within the scope of a single organization or web service. In this paper we investigate the feasibility of using usernames to trace or link multiple profiles across services that belong to the same individual. The intuition is that the probability that two usernames refer to the same physical person strongly depends on the “entropy” of the username string itself. Our experiments, based on usernames gathered from real web services, show that a significant portion of the users’ profiles can be linked using their usernames. In collecting the data needed for our study, we also show that users tend to choose a small number of related usernames and use them across many services. To the best of our knowledge, this is the first time that usernames are considered as a source of information when profiling users on the Internet.

The speaker was invited by Sonja Buchegger.

The paper got the best student paper award at this year's PET (Privacy Enhancing Technology) Symposium. The authors are Daniele Perito, Claude Castelluccia, Mohamed Ali Kaafar, Pere Manils, all from INRIA Rhone Alpes, Montbonnot, France {perito,ccastel,kaafar,manils}@inrialpes.fr

Daniele Perito (http://planete.inrialpes.fr/~perito) is a PhD candidate at INRIA in France, where he is supervised by Prof Claude Castelluccia. His research interests span from machine learning and security, to secure embedded systems design. During his PhD he has interned at UC Irvine, Stanford and UC Berkeley. Daniele received his master degree in computer science from the University of Rome, La Sapienza.