Username reuse: finding and separating your own linked accounts

Why reuse matters

Using the same handle everywhere makes it trivial to connect a professional profile to a gaming account, an old forum, or a dating profile. Each connected account can add details such as age, location, and interests, and an old account with a weak password is an easy target for takeover.

Checking your own handles

Sherlock and the WhatsMyName project check hundreds of sites for a given username by requesting profile URLs and reading the responses. Results include false positives, because some sites return a page for any name, so open each hit and confirm it is actually yours. Run these only for usernames you own.

python3 -m pip install --user sherlock-project
sherlock arivera_dev --print-found --csv
# open each result and mark: mine / not mine / false positive

Lab: separate your identities

Run the check for two of your own handles. Sort confirmed accounts into three groups: keep public (professional work), keep but make private, and delete. For accounts you keep private, rename them to an unrelated handle and enable multi-factor authentication. For accounts you delete, export anything you need first and follow the site’s deletion process.

Going forward

Use separate handles for professional, personal, and anonymous activity, and a password manager so each account has a unique password. Unique handles also make it easier to spot impersonation, because a match on your professional handle elsewhere is a signal worth checking.

• Separate handles per identity
• Unique passwords from a manager
• Multi-factor on accounts you keep
• Delete dormant accounts