OSINT cluster research: email-account existence and Google identity pivots #179

New issue

Open

opened 2026-08-29 10:28:07 +00:00 by nsaspy · 1 comment

nsaspy commented

2026-08-29 10:28:07 +00:00

Owner

Goal

Deeply research email-centric identity tools and techniques, especially Holehe and GHunt, and extract only the reusable capabilities StarIntel needs.

Architecture rule

These belong under the Identity Domain Server unless research proves a separate boundary. Do not create one actor per upstream tool.

Holehe research

Enumerate and verify:

service/account-existence checking model
request/registration/reset-flow strategies
per-site modules and signatures
response classification
rate limiting and blocking behavior
concurrency
false positives / ambiguous outcomes
custom module extension
output formats
safe evidence retention without storing secrets

GHunt research

Enumerate and verify:

Google account/profile discovery surfaces
identifiers accepted and derived
public metadata returned
Maps/reviews or other public Google ecosystem pivots
calendar/account metadata techniques where publicly exposed
authentication/session requirements
caching/state
rate limits and failure modes
structured output and provenance

StarIntel target

Determine how these fold into:

identity.enrichEmail
identity.findPublicProfiles
identity.pivotContacts

with typed outcomes and provenance rather than opaque tool stdout.

Implementation preference

StarLang first; extend StarLang if needed; Common Lisp next; Python only as a last-resort external adapter where an upstream protocol/client is impractical to reproduce safely.

Output gate

Stage findings only in the internal OSINT ledger and issue until explicit human instruction to add research to ARARD/ARADR docs.

## Goal Deeply research email-centric identity tools and techniques, especially Holehe and GHunt, and extract only the reusable capabilities StarIntel needs. ## Architecture rule These belong under the Identity Domain Server unless research proves a separate boundary. Do not create one actor per upstream tool. ## Holehe research Enumerate and verify: - service/account-existence checking model - request/registration/reset-flow strategies - per-site modules and signatures - response classification - rate limiting and blocking behavior - concurrency - false positives / ambiguous outcomes - custom module extension - output formats - safe evidence retention without storing secrets ## GHunt research Enumerate and verify: - Google account/profile discovery surfaces - identifiers accepted and derived - public metadata returned - Maps/reviews or other public Google ecosystem pivots - calendar/account metadata techniques where publicly exposed - authentication/session requirements - caching/state - rate limits and failure modes - structured output and provenance ## StarIntel target Determine how these fold into: - `identity.enrichEmail` - `identity.findPublicProfiles` - `identity.pivotContacts` with typed outcomes and provenance rather than opaque tool stdout. ## Implementation preference StarLang first; extend StarLang if needed; Common Lisp next; Python only as a last-resort external adapter where an upstream protocol/client is impractical to reproduce safely. ## Output gate Stage findings only in the internal OSINT ledger and issue until explicit human instruction to add research to ARARD/ARADR docs.

nsaspy referenced this issue

2026-08-29 10:28:13 +00:00

ADADR: StarIntel OAuth authorization-code provider for Bixby user accounts #144

nsaspy commented

2026-08-29 10:28:16 +00:00

Author

Owner

ARDR promotion completed for this seed under the current Auto-Research policy in #170.

Canonical research: #180 — READY_FOR_DESIGN
Canonical design/adversarial review: #181 — DESIGN_READY_FOR_OPERATOR_REVIEW
First bounded implementation proposal: lost-rob0t/starintel-server#131
Implementation approval: PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL

Key architecture decision: email account-existence checks extend the same Identity Platform Probe Registry from #173 using identifierType=email; no second email registry, Holehe service, or GHunt service. Holehe-style transport/rate-limit ambiguity must never become notFound. Google enrichment remains a richer drift-prone Identity source with typed partial/unknown results and opaque credential/session refs. Side-effecting signup/reset/recovery probes fail closed by default.

No product code was changed and nothing was exposed to RAGE.

ARDR promotion completed for this seed under the current Auto-Research policy in #170. - Canonical research: #180 — `READY_FOR_DESIGN` - Canonical design/adversarial review: #181 — `DESIGN_READY_FOR_OPERATOR_REVIEW` - First bounded implementation proposal: `lost-rob0t/starintel-server#131` - Implementation approval: `PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL` Key architecture decision: email account-existence checks extend the same Identity Platform Probe Registry from #173 using `identifierType=email`; no second email registry, Holehe service, or GHunt service. Holehe-style transport/rate-limit ambiguity must never become `notFound`. Google enrichment remains a richer drift-prone Identity source with typed partial/unknown results and opaque credential/session refs. Side-effecting signup/reset/recovery probes fail closed by default. No product code was changed and nothing was exposed to RAGE.