Same Handle Everywhere: Linking Accounts to a Real Name
The challenge
An anonymous account uses the handle 'm_bianchi' but never posts a real name. Open the sources and correlate them: the same handle appears across a code repo, a social account, and a forum, and one of those profiles slips up. Find the person's real name and submit it.
What you'll learn
- Pivot a single reused username across multiple platforms
- Confirm accounts belong to one person via shared avatars and cross-links
- Read a git commit's author name field as a real-name leak
- Use a Gravatar tied to a leaked email to confirm the link
- Understand why handle reuse defeats anonymity
Skills tested
Prerequisites
- Familiarity with social, repo, and forum profiles
- Basic understanding of git commit authorship
How it works
People who want to stay anonymous often reuse a single memorable handle across every site they touch. That convenience is exactly what an investigator exploits: a username is a search key, and finding it on a second platform links the two accounts. Once a few accounts are linked - by a shared avatar, a cross-posted project, or a profile signature pointing at another site - the question becomes which of the linked profiles accidentally exposes a real name.
In this case the handle m_bianchi appears on a code host, a social account, and a forum, and all three are tied together by the same home-lab-scripts repository and a shared avatar. None of the public bios show a real name. The leak is in git itself: a commit records the author name from the committer's local git config, and here it reads Marco Bianchi. The email in that author field, [email protected], has a Gravatar that lists the same accounts and a hometown, closing the loop.
The OSINT board shows each profile as a card. No card has a 'real name' field filled in - the social, forum, and Gravatar name fields are blank. The answer comes from correlating the linked identity with the one artifact the user could not easily blank: the git commit author. They resolve to Marco Bianchi.
Common mistakes
- Submitting the handle.
m_bianchiis the username, not the real name the question asks for. - Stopping at the social or forum profile. Their display-name fields are deliberately blank; only the git author field leaks the name.
- Not linking the accounts first. You need the shared avatar and repo to be confident the GitHub author is the same person.
- Ignoring the commit metadata. The username and the commit author name are different fields - read both.
How to defend against it
If you want to keep an online persona separate from your identity, the discipline starts with never reusing the same handle and never letting tooling stamp your real name into artifacts. Git is the classic culprit because it silently records whatever name is in your config.
- Use a distinct, unlinkable username per persona, and a different avatar for each.
- Set a pseudonymous
git config user.nameand a dedicated email for public commits. - Do not cross-link your accounts in signatures, pinned posts, or Gravatar.
- Audit your own footprint with username-search tools the way an investigator would.