An IP address is worth 1,000 words

If I told one of my friends to click a link that would give me their IP address, they probably wouldn’t click it… because then I’d have their IP address! (Oh, no!)

But if I told them to check out my latest post on lincolnmaxwell.com, join my Minecraft server, or go do some research for a school project, they’d go ahead and visit my website, or log into my Minecraft server, or click on a bunch of random internet links.

I suppose the value prop is different in the two cases. In the first case, they get nothing. But in the second case, they get some form of entertainment or information. But in both cases, they give their IP away.

We don’t really think about the links we click. In the first case, my friends were concerned about giving up their IP address “because you’ll know where I live;” but in the second, they could’ve given their location to 1,000 different server administrators.

An IP by itself isn’t terribly interesting. But I think this graph is much more interesting:

I’ve anonymized the users and IP addresses to protect their privacy.

This is a graph of users and the IP addresses that they connected from as part of my Minecraft server. Users invited each other to the server to play. Here’s how to read the graph:

The core insight

If an IP address is some physical place, then the graph now tells us a much richer story: we’re actually looking at a social network of people that know each other.

Okay, but what does this actually mean?

The implications of an IP address

This way of thinking leads us to many interesting (and possibly disturbing) insights!

Same location inference

First, users who are connected to the same IP address were at the same place at some point in time.

And this turns out to be true! Most of my friends are from my school, and many of them connected to the server during lunch times, homeroom times, and study halls. The lone orange dot in the middle is my school.

More likely to know each other

Second, assuming the first insight, users who are closer together in the graph are also more likely to know each other in real life. For example, if someone had friends over their house, they probably all joined the same WiFi network. This would bring them closer together in the graph because they all connected through the same IP address.

Finding “alt” accounts

Third, also assuming the first insight, users who create “alt” accounts will be close together in the graph. An example is above from an earlier time in the server’s history. While running the server, there were actually a few cases when I needed to de-anonymize people (users could choose their own username) and find their alt accounts, so I used this method and was accurate.

The bigger picture

Consider Snapchat’s Snap Map. Let’s say Person A chooses to share their realtime location with Snapchat, but Person B does not. Because on the insights from before, if Person A invites Person B to have coffee at their house, Person B is very likely to connect to Person A’s WiFi network. If Person B does, then Snap knows Person A and Person B are at the same or similar location at this point in time.

Consider a malicious organization wants to find out who attends a certain political meeting, religious gathering, or private event. They don’t need everyone to volunteer their location. They just need a few.

Consider that your IP address hits a news site’s ad network, a gaming platform, a streaming service, and a social media app around the same time from the same IP address. Suddenly, your anonymous Reddit account and your real-name Spotify profile are the same person, because they keep showing up from the same address at the same hours.

This is sometimes called the mosaic effect. No single piece of data is identifying on its own, but with enough snapshots, the picture becomes clear.

For example, an IP address is one snapshot. Your posting schedule is another. Your sleep pattern, inferred from when your devices go quiet, is another. None of these feel like privacy violations in isolation. Together, they’re a portrait.

When metadata becomes identity

We tend to think of privacy in terms of the information we put on the internet, unlike in the previous example:

What messages did you send?

What photos did you post?

What files did you download?

But content isn’t the only meaningful piece of information. Metadata is too.

An IP address doesn’t tell someone what you said, but it tells them where you were. And if you collect enough of those “where” moments, you can start to figure out the “who.” And after the “who,” you could figure out the “how” - how does one person know another person? Where and when were they introduced?

A graph like the one from my server starts simple. It’s just connections between users and IPs. But if you think bigger:

• Repeated overlap at the same residential IP could suggest likely family members.
• Overlap at an IP during weekdays could suggest classmates or coworkers.
• Overlap at a specific home IP on weekends could suggest close friends.

Now scale it by a global factor and you know where someone lives, you know who lives together, you know who visits whom, you know who travels together, you know who changes accounts but doesn’t change networks, and so on.

THE KICKER: You can de-anonymize without ever reading a single message!

The psychological lens

My friends didn’t want to click a link that would give me their IP address. But they happily gave it to game servers, social media platforms, random blogs, ad networks, governments, and so forth. And so did I!

Psychologically, we distrust individuals, but we trust groups. And, when you click a link, you imagine what you get in return. Not the server logs.

An IP address is worth 1,000 words

My message is not new. But I hope I’ve convinced you that there’s more to this issue than is given enough recognition. The danger is knowing where people live AND surveillance, control, and the gradual loss of our freedom.

The truth is that these systems can help fight criminal activity.

But they can also be abused very easily, and we might not even know about it.