Sherlock: Hunt down social media accounts by username across 400 social networks

Original Article ↗ Hacker News Discussion ↗

An open-source tool called Sherlock, which scans hundreds of social platforms for a given username, is prompting debate over how easily online identities can be correlated and what that means for privacy, security, and harassment. Commenters outline both legitimate uses—like OSINT investigations, personal footprint audits, or brand protection—and more troubling scenarios such as stalking, doxxing, and automated impersonation aided by large language models. They also highlight practical issues with the tool’s accuracy and UX, and share broader strategies for managing online identities, from unique usernames and burner emails to accepting that true anonymity and long‑term “forgetting” on the internet are increasingly difficult.

Perceived Uses and Misuses

  • Suggested “non‑creepy” uses: OSINT / cybercrime research, awareness training about how linkable traces are, self‑auditing your own footprint, cleaning up accounts before running for office, finding a consistent username to register, importing content across sites.
  • Several commenters argue there is effectively no non‑creepy use; the tool is inherently suited for stalking, harassment, brigading across platforms, and cancel campaigns.
  • Some see it as an educational shock: a concrete demo that online anonymity is fragile.

Privacy, Anonymity, and Online Footprints

  • Many note how easy it is to correlate identities by username, email, phone, profile photo, time zones, and especially writing style (stylometry).
  • Some now assume all activity will be deanonymized and self‑censor accordingly, fearing future lawsuits or professional repercussions for old posts.
  • Others advocate embracing a public identity and simply not posting anything you’d regret, or using multiple personas/accounts depending on context.

Usernames, Identity, and Impersonation

  • Split advice:
    • Use unique usernames everywhere to make tracking harder.
    • Use the same username everywhere to build a clear, controlled public identity.
    • Claim your “main” handle widely to prevent impersonation, then use separate ones for sensitive topics.
  • Concerns that usernames alone are weak evidence; attackers can pre‑emptively register your handle on new platforms and damage your reputation.
  • LLMs and bots can now impersonate style, further muddying authenticity.

Technical Characteristics and Limitations of Sherlock

  • Tool essentially loops over ~400 sites, fetches profile URLs, and regex‑matches “user not found.”
  • It runs client‑side, querying sites directly rather than a central database.
  • Users report false positives (including for nonsense usernames) and links leading to 404s; some find it less useful than Google.
  • Critiques: overengineered for what is conceptually a simple script; CLI‑only and not very user‑friendly; UI on the website is confusing.

Legal and Ethical Context

  • Some jurisdictions reportedly restrict employers from searching candidates without consent, but commenters argue such rules are often unenforceable and widely ignored.
  • Debate over whether digging up old posts (10+ years) should be disqualifying, with tension between accountability and recognizing people can change.