A Practical Attack to De-anonymize Social Network Users