What Your Username Doesn't Hide

The usual privacy advice is sound: use a different username on every site, avoid repeating the same biography, and do not link accounts together. Those steps remove the easiest connections. They do not make a person unfindable.

That is because identity does not leak only through the information someone types on purpose. It can also leak through routine, style, metadata, and the relationships between otherwise separate clues. A careful researcher may notice those patterns. A careful researcher must also know when they are not enough.

The necessary floor

Separate usernames are still the right starting point. So are different profile photos, bios that do not repeat the same unusual phrase, and URLs that do not expose an old handle. Turning off public account discovery and removing direct cross-links also closes obvious doors.

Think of this as the minimum privacy layer, not complete protection. It defeats exact-string searches and casual browsing. It does not erase the patterns created by using several accounts as the same person.

Behavior has a shape

People tend to go online at familiar times. Two accounts that repeatedly become active during the same narrow hours, disappear for the same workday, and shift together during daylight-saving changes may suggest a shared timezone or routine. One matching evening means very little. A sustained pattern can become more interesting.

Writing also carries habits. Sentence length, punctuation, spelling preferences, repeated turns of phrase, emoji choices, and the way someone corrects themselves can resemble a fingerprint. This kind of comparison is often called stylometry. It can be useful across enough text, but it is vulnerable to shared community slang, deliberate imitation, editing tools, and small samples.

Interests add another layer. Liking one popular game or one common band proves nothing. A rare intersection can be more distinctive: the same obscure game mode, specialist hardware, local event, and niche hobby appearing across two otherwise separate accounts. The strength comes from the combination, not any one interest.

Metadata people forget

A new avatar is not always a new image. Perceptual image matching can recognize visual similarity after cropping, resizing, compression, color changes, or a border has been added. Reusing the same photo in modified form can therefore reconnect profiles even when filenames and dimensions differ.

Files can carry details that are easy to overlook: an author name inside a document, a device or editing application in image metadata, a timezone in an exported log, or a local username inside a path. Public code contributions can expose commit names and email addresses that differ from the visible profile. Removing metadata from the page does not remove it from files that have already been published elsewhere.

Timing can correlate accounts too. Several profiles created during the same weekend, followed by the same early communities in the same order, may reflect one migration or setup session. Again, the timing alone is weak. It becomes relevant only when other independent details agree.

The pivot chain

Investigations rarely move from one username directly to a confirmed person. They move through pivots. A gaming handle may appear in an old public Discord quote. That quote may mention a forum account. The forum account may contain a detail about a project, city, or event that also appears on another profile.

No step has to reveal a legal name. The chain becomes useful because each link narrows the possibilities and supplies a new place to check. It also becomes dangerous when a weak link is treated as settled fact. A shared hobby can connect thousands of people. A copied avatar may belong to a fan community. A quoted handle may refer to someone else entirely.

Signal is not proof

A pattern match is a lead, not a confirmed identity. Several weak signals do not automatically become one strong conclusion, especially when they are not independent. Posting time and timezone may describe the same underlying fact. Writing style and community slang may come from the same group. Counting both as separate confirmation exaggerates the evidence.

Before linking accounts, look for disconfirming evidence as actively as confirming evidence. Do the timelines overlap in an impossible way? Do the accounts state different ages or locations at the same time? Is the image actually original, or widely reused? Could the shared phrase come from a template? The right conclusion may remain “possibly related” or “unknown.”

This caution is not just academic. Misidentification can direct suspicion, harassment, or reporting toward the wrong person. The more consequential the conclusion, the stronger and more independent the evidence must be. Public information should be handled lawfully, proportionately, and with respect for context.

Why PROBE shows uncertainty

PROBE starts with usernames because they are useful, visible pivots. It does not claim that matching usernames prove common ownership, and it does not turn an unclear response into a confident match. The same principle applies beyond usernames: surface the lead, preserve the reason, and keep uncertainty visible.

Good privacy practice makes correlation harder. Good research practice prevents “harder” from being mistaken for “impossible,” and prevents “similar” from being reported as “the same person.” Both sides depend on understanding that identity is a pattern of signals, not a single field in a profile.