Police arrested a suspect today for posting threats against black University of Missouri students on bulletin-board style messaging app Yik Yak. This isn’t the first time a jackass has been arrested in connection with making threats on the app — because Yik Yak is not anonymous.
Yik Yak plays up the fact that you don’t have to attach your name to what you post on its virtual board. At one point, its tagline was, straight up: “No profile, no password, it’s all anonymous.”
But, you know, it’s not.
Your name doesn’t appear publicly attached to stuff you post on Yik Yak, but if you do something criminal, like threaten to kill students, the app cooperates with law enforcement. It can provide your account information, geolocation logs, and other identifying data. Yik Yak can turn everything it has over to police in cases like the Mizzou threats to help catch the shit jockeys posting bile.
Investigators have already used Yik Yak’s identifying data to catch students making threats against schools in New York, Michigan, Indiana, and Alabama.
This isn’t a PSA for wannabe terror trolls. It’s good that these people got caught. It is, however, a reminder that “anonymous” apps rarely provide anonymity.
Yik Yak doesn’t securely conceal identities at any time. Last year, hackers found an exploit that made it easy to identify Yik Yak users. Yik Yak fixed the exploit, but the incident made it clear that identifying data wasn’t being anonymized in any secure way. It’s not like Tor, which hides your online traffic footprint. Yik Yak collects data, like your IP address and phone model info, and then doesn’t delete it.
Yik Yak also doesn’t stop third parties from identifying people who use the app, as it states in its privacy policy:
We do not identify you by name or contact information to other Yik Yak users. However, we cannot prevent others from determining your identity from the content you post or how you share content through third party sites.
Yik Yak’s only claim to anonymity is that it chooses to allow users to adopt a posture of pseudonymity — as long as they don’t violate terms of service, break the law, or get identified by someone else. People treating the app like an invisibility cloak are ignorant.
Image: Wikipedia