Yeah, I know. Reddit is getting people to willingly fill out psychological questionnaires about a very broad range of topics that capture their interest, and people are doing it for free. The questionnaires CA got a hold of were primitive compared to this.

I guess I've always known this, but the realization is just now hitting me how much information and knowledge this actually provides. With a massive corpus of preferential data about each user, and the whole dataset about all the users in the system, the machine learning implications are huge. You can apply filters to cancel out noise or filter out bots from the dataset; recognize common or unique patterns on narrow or broad scales; predict affinity for certain pieces of content for either individuals or sets of individuals; and in combination with entities, you could match this specific psychological data with the user's identity. The possibilities are nearly endless.

Reddit is the perfect petri dish for studying how ideas, how memes in the original Dawkinsian sense, actually propagate and mutate across the network. There have been academic studies done on reddit content, but those are just scratching the surface, as all the vote data was anonymized. If the owners and partners of reddit are smart with how they use this data, and can keep the knowledge that they have this data away from the users, they are sitting on an absolute goldmine.

I just wonder who's using it and to what ends.

I doubt it's any one person or entity; it's the entire bureaucracy in a way. Sure, some factions likely have more access to the data than others, but it all gets used for the same control program.

that traffics in sorting users into 3+ categories of "risk".

I think levels of risk is also just scratching the surface. This is multi-dimensional analysis that can know more about you than you or your closest friends know about you. And with unstructured machine learning, they can find patterns they never would have thought to look for and answers to questions they never asked.

The practical applications are far-reaching: Microtargetting of individuals for advertising or propaganda purposes far more accurate and precise than CA, learning what levels techniques of propaganda individuals and populations are susceptible to (e.g. testing the waters for BlueBeam or similar), gauging and molding popular understanding nearly any aspect of society.

Yep, that adds a whole nother layer to it. If you can correlate the private thoughts with the public face, you can classify and predict the discrepancy.

Responding to a deleted comment I already wrote a response to:

I don't know, I see cynical, flippant, and negative comments do very well if they agree with that subculture's general positions: for example, cynical or mocking comments about Trump in r/politics or most other subs do well, as do cynical or mocking comments about Clinton or the deep state in subs like here or T_D. Or when a company like United or Comcast does something unpopular and everyone gets upvoted for hating them.

Two minutes hate is very popular here, as long as you hate the right thing.

Yeah, snoopsnoo is kind of cool, and using the API (and a 3rd party database called pushshift) you can get even more data and run what ever kind of analysis you want on it. But the votes themselves are completely hidden from the public unless you specifically make them public. That data is only known to reddit anyone they share it with.

This one shows you which words a user uses most often. It's not quite mind-reading, but it's not that far off either.

Knowing the votes is even closer to true mind reading, because you can also measure a user's affinity to certain words, topics, ideas, positions, and interests. Most users vote orders of magnitude more than they comment or post.

I'm considering writing a script that can go back through and unvote for every post/comment I've voted on, but I imagine there are limitations on how far back it goes, and reddit might also keep the historical data.

Reddit? No, probably not. Whoever they might be working with, including government and quasi-government agencies? You bet they do. If they're not processing this now, you can bet they will be.

I still vote, especially on my own threads or replies to me, even if I don't necessarily agree I'll give an upvote. I only downvote if someone's actively detracting from the discussion at hand.

since they have one point they think that somebody is upboting everything they say.

I think most people who've been here for longer than a week or so understand that the first upvote is your own.

It's not any study; it's just the data they have, and it's only valuable if they can pull useful knowledge out of the data. Some users are going to have behavior patterns which don't give them much useful information, but many users will show many of their preferences and affinities.

On the whole, the dataset is quite valuable, and even more so if usernames can be tied to other accounts or real identities.

With my premise, 90% of the posts and comments could be lies, and the vote data would still provide useful information, maybe even more useful as the "survey questions" could be better designed to gather the desired information.

The monetary value aside, I am certain somewhere the CIA, FBI, NSA, some three letter agency has done this already.

If one of these agencies has access to the actual vote data, it would have to be because either reddit gave it to them (willingly or coerced), reddit fucked up seriously in their security practices, or HTTPS is compromised (which is possible).

The only reason we are still using Reddit is because of addiction and lack of safe alternatives.

The same with FB I think it's less that we lack real alternatives, or are addicted to this platform per se, but that so many people use this platform. If you want to communicate with people that use reddit, you pretty much have to use reddit at this point. Alternatives exist, but they just don't have the same reach.

As do I, which is why I find smaller subs to be better, at least as far as signal-to-noise ratio goes. I would say that as a whole, reddit has some absolutely excellent content in pretty much any area of interest you may have, but the real problem is finding it amongst all the lower quality content (however you define that).

Other sites may have a higher signal-to-noise ratio, but less quality content in total simply due to the smaller user base to pull from.

always scrub your comments (over-write plus delete)

I'd have to see how their backend is written, but this likely isn't enough, and if reddit isn't recording original comments, you can be sure 3rd parties are. As far as VPN and username switching, it will help against internet detectives, but one slip up from perfect infosec and a sufficiently determined adversary can connect you to all your accounts.

I'm not particularly worried about this as far as it goes; I just use reddit with the knowledge that everything I'm typing can and likely will be tied to me. Reddit is not and should not be thought of as an anonymous platform, which is more what I feel the takeaway should be. If you want real anonymity, onions and zeronode with appropriate precautions are the best bet, but even with that it's more security by obscurity than true security.

No, no, no...I mean, you keep an account for a few months, then you scrub it and move on to a new account that had no associations with the old account

Yeah, I know what you meant, but I'm saying even with that, a sufficiently motivated adversary could tie you to the accounts if you made any deviation from best security practices. At the very least, r/pushshift (ceddit backend) records every public comment in real-time, so unless you're scrubbing comments at the end of every month before it takes a final snapshot, those comments are tied to that username indefinitely, and publicly available. NSA and CIA are almost certainly saving every edit as well.

And as far as linking accounts, there are other statistical methods that used in conjunction could be pretty effective. If you're using a desktop browser, browser fingerprints are fairly effective at this. If you're using the official apps, they're almost certainly matching accounts to devices directly. If you're using a closed-source third-party app, you have no clue what they're doing with your data. Open source apps or third party API clients are probably the best bet, but the smaller userbase will make you stick out more. Voting patterns, patterns in usage time, linguistic patterns, etc. can also provide useful classification data.

I'm not saying you can't or shouldn't try to obscure your identity, but if NSA wants to identify you, I don't think they'll have a hard time at it. I'm just saying use the platform with that understanding.

Pattern analysis between account comments... can never be defeated

Yeah, and I think that even if you can beat the current classifiers, the technology is constantly improving such that in a year or five or ten, they'll almost certainly beat you if they want to. Even matching just three or four independent feature vectors could be enough if they're each unique enough.

All good points and I agree, we should consider the entire internet "public" at this point, there is no privacy and we should act as such.

At least any part of the internet that is not expressly focused on privacy, and maintained and audited by multiple independent parties with a vested interest in privacy. And even then, that privacy should only be partially trusted for a finite amount of time with the expectation that your encryption and privacy scheme will be broken, and past communications will be compromised as well.

If you really want security and privacy, you almost have to go old school. USPS is probably your best bet for sending secure communications over a distance if you can be reasonably sure you're not currently under active surveillance. Even the big boys like NSA will only interfere with that if they have to.

On their own, reddit can tie accounts to IP addresses, devices, browser signatures, the app you use (which possibly provides device information), email if you give it to them.

In many cases, this probably isn't enough to make a positive identification, but it does create a feature vector that can be compared to vectors from other datasets. They could be partnering with other data firms, be purchasing access to other datasets, or be giving data to government agencies, either wittingly or not.

If NSA has full access to reddit internals (which they very likely might), they can easily cross-reference it with their other sources and probably be reasonably confident in identifying 95% of accounts, especially accounts that are active for a period of some months.

I looked into it a while ago, and there are some best practices, but the detection methods are pretty good. Even something like having different fonts installed on your machine or different browser extensions represent a feature which can be used to narrow the pool of users with similar browsers.

Your best bet is to make your browser appear like a lot of other people's browsers. A fresh Windows 10 install with an up to date, barebones chrome is likely the best option, but not having adblock or ghostery/disconnect leaves you open to other attack vectors. Anything you do hide yourself consequently puts you in a category of people trying to hide themselves, which narrows the pool, especially if you try to hide yourself in a different way than everyone else. I really think it's a crapshoot.

But I guess downloading webpages via curl in a *nix terminal and rendering your pages offline would work, but you won't have any javascript functionality, and most interactive sites like reddit would be mostly broken.

Thanks Howard.

;D Still singing!

I reckon noscript, uMatrix and ublock etc. are pretty commonly used at this point.

Yeah, probably, even in that combination there are probably hundreds of thousands if not millions of users. But then within that group, if you have noscript set to disable or enable a feature that a server can detect, that distinguishes you further within that group. There's a site somewhere that will tell you how unique your fingerprint is. You can probably tweak your set up and compare them to find something that minimizes your uniqueness profile.

Edit: And I would not recommend chrome when data protection is the goal.

For sure. I just picked chrome because it's by far the most popular, and therefore least unique, browser out there. Maybe Edge on Win10 is actually better just because it's completely stock, so you'd be lumped in with a bunch of people who never touch their system.

There's so many tradeoffs that you have to weigh what makes the most sense for you, and which privacy concerns you want to prioritize over others (e.g. identifiability vs. data leakage vs. data theft).

Have an upboat!

Pattern analysis between account comments... can never be defeated

Yeah, and I think that even if you can beat the current classifiers, the technology is constantly improving such that in a year or five or ten, they'll almost certainly beat you if they want to. Even matching just three or four independent feature vectors could be enough if they're each unique enough.

All good points and I agree, we should consider the entire internet "public" at this point, there is no privacy and we should act as such.

At least any part of the internet that is not expressly focused on privacy, and maintained and audited by multiple independent parties with a vested interest in privacy. And even then, that privacy should only be partially trusted for a finite amount of time with the expectation that your encryption and privacy scheme will be broken, and past communications will be compromised as well.

If you really want security and privacy, you almost have to go old school. USPS is probably your best bet for sending secure communications over a distance if you can be reasonably sure you're not currently under active surveillance. Even the big boys like NSA will only interfere with that if they have to.