Researchers uncover privacy flaws that can reveal users' identities