We’re now going to talk about
how much personal information you might be reveling
on the social sites that you use in forums,
and when you fill out forms,
and really, any time where you’re providing information,
and we’re going to look at using identity strategies
to limit your exposure to your adversaries
when revealing personal information.
Increasingly it’s getting harder and harder
to not provide information
if you want to function in the modern world.
Our children simply won’t understand
the concept of privacy
in the same way that we do,
but the clear facts are
that the less information about you that is out there,
the more security, privacy and anonymity
you can grasp, attempting to attain.
The less information out there about you,
the better protected against identity theft,
phishing attacks, spam, conman, social engineering, hackers,
nation state surveillance, local law enforcement,
basically everything.
But you have to balance
your personal information disclosure
with your need for an identity or identities online.
Here is a scrolling list of
information you should consider
before revealing online
or consider before giving to companies.
The more of this personal information
that is out there about you,
the more of a complete picture
an adversary can have of you.
Questions to consider when putting this information online
or providing it to companies.
Who can ultimately access the information?
You might think it’s just your friends,
or just the company,
but they can forward the information on.
If it’s a social site, the social site
will have access to it, if it’s a company,
the company will have access to it.
Your adversary then may also have access to it.
Who controls and owns the information
that you are disclosing?
You might find that
some of the sites you use
own the content you publish.
Did you know that?
Can the information ever be taken back
or taken down that you've disclosed?
The answer is probably no,
because other sites and services
archive the internet, so ultimately,
even if it is taken down,
it may be archived somewhere else.
And as we know, nation states are archiving data as well.
Will your associates mind if you share
information about them with other people?
What information about you
are your associates passing on to other people?
Do you trust the people
in organizations you’re connected to?
They can forward on information you have posted.
Even if you post on a private forum,
you should consider the information
still public because you no longer
have control over that information anymore.
Are you relying on a social site
or other site as a primary host
for your content or information?
What happens if that site disappears,
if it goes down, will you lose
those precious pictures?
Are there photos of you online?
Do people tag you in photos
even if you don't post pictures yourself?
Consider the risk associated
with the information you post online.
Could an unfortunate post on social media
for your career, or posting your opinions
get you fired?
What are the consequences of posting, viewing or creating
this sort of content online
that you wish to do freely?
Just re-tweeting or forwarding
a message indicates your views on a topic?
Are you comfortable that your social media presence
creates a profile of you online
that can be used by employees
and your adversary?
Do you want to mix colleagues with friends and family?
Are you doing that now?
Do you have distinctly private activities
that you don't want associated with your real identity?
Do you perform activities that
law enforcement agencies or nation states
have laws against?
Will the information you disclose
lead to the targeting of your friends
and family members by your adversaries?
Will your children appreciate
you posting photos and information
about them when they get older?
Does this make them more vulnerable?
I recommend this site here
who do a great breakdown
of the terms of use and privacy policies
of companies that you use.
They also have a browser plugin,
so if you are interested
in the social sites that you’re using,
so let's for example look in Facebook,
and here we get a breakdown of
what this particular social site
has to say in their policies.
So the breakdown here, very broad
copyright license on your content,
this service tracks you on other websites,
Facebook automatically shares your data
with many other services,
Facebook uses your data for many purposes,
the Android app can record
sound and video from your phone at anytime
without your consent.
And if we click here,
we can see more details
if you want to see a breakdown,
So what I do,
what I suggest is that
if you are using social media websites
and you want to know
what they’re doing with your information,
this is a good site to go,
check out the detail
for the social sites that you use or other sites,
and see whether or not, you know
you’re happy with what it is
that they are potentially doing with your data.
You need to determine if these terms
are really in line with
what you’re currently posting online.
If they aren't, then you
need to consider a different identity strategy.
In the section on Op Sec,
we discuss identity strategies,
so let's revisit them in terms of
giving away personal information
and how you can use identity strategies
to manage the information that you’re giving out.
So the strategies I’m going to list
are in order of preference
for limiting the reveling of personal information.
So first is the avoidance strategy.
This is the best strategy for reducing risk
related to giving out personal information.
And the avoidance strategy is simply
avoiding using certain social media,
not posting, not filling in forms, simply not registering,
just not giving out that information.
This is often unrealistic
and deprives you from the advantages
of the internet and modern living,
and just may simply not be possible
in some circumstances.
But a common example might be
not having social media accounts
and limiting your accounts to the bare minimum.
This way, you release
the least personal information.
It’s recommended to use
the avoidance strategy where possible.
The less information that is out there,
the less vulnerable you are.
Where avoidance isn't possible,
you can use compartmentalization.
This is having contextually separate identities
from each other and your real identity.
For example, you could maintain
a social media account under an alias,
so you could have a Facebook as John Smith,
or whatever name, and you might
reveal information about you,
but it’s separate from your real identity.
So if your adversary or a HR department
do a search on you, there is nothing
linked to your real identity.
I have a number of friends,
who both in the real world and online,
are known only by an alias,
it’s an effective strategy for them
to separate their social and professional identities.
Next is the content strategy
where you’re only giving out
carefully considered information
against your real identity.
This is effective if you manage to
always put out carefully considered information,
but this strategy is risky as you could
inadvertently reveal information
you didn't intent to release.
A simple example could be
you download an app, you register
under that app as your real identity,
and not realize the default settings
are revealing your location
or some other personal information.
Then you have the audience strategy,
which is a step a little bit more risky.
This is keeping, as an example,
your personal and professional network separate
by using Facebook for friends and family,
and LinkedIn for your personal network.
This can limit the exposure of your personal information,
but it is still out there.
You know, do you own that information?
Can you remove it? Will someone copy it?
Will your adversary be able to find it?
Do you trust your audience with that information?
Ultimately, if you have put personal information out
to an audience, it can be passed onto another audience
or viewed potentially by another audience.
This is where you get into
your privacy settings on those sites.
You configure your privacy settings
to attempt to reduce the audience,
but obviously, if one person can view it,
one person can pass it on.
And then the most risky strategy
is the open strategy.
This is using your real identity
and being transparent and authentic.
Some people do live their lives like this
and in the public eye.
This is suitable for certain situations and cultures,
but this is obviously risky and makes you vulnerable.
Even though you’re using an open strategy,
you should still restrict the personal information you give out,
and generally an open strategy is not going to be suitable
for someone who is interested in privacy
and their anonymity and security.
And the final strategy is the custom strategy,
which is probably the best general strategy
for most people that will allow you to exist
on the internet
and limit information disclosure
by using a combination of the strategies
that we’ve gone through: avoidance,
audience, content, compartmentalization.
When information is custom to the audience,
there is less risk.
When identity is custom to the content,
there is less risk.
Whichever strategy you choose,
you should post only the amount
of personal information as is necessary.
Even if you don't care about privacy or anonymity,
you are better protected against identity theft,
phishing attacks, spam,
conman, social engineering, hackers, etc, etc.,
if you limit the amount
of personal information you give away.
Another good site that provides information
on how different companies protect you
from government requests is this one here,
Who Has Your Back?
Another site from the EFF
and if you check this out here, you’ve got:
“Follows industry-accepted best practices,
Tells users about government data demands,
Discloses policies on data retention,
Discloses government content removal requests,
Pro-user public policy opposes back doors”.
And you can have a look through here
and see what it says about the social site that
you may happen to be using.
So here we can see Facebook
and it doesn't have a star here
for disclosing government content removal requests.
So check that out.
In the section on passwords and authentication,
we discuss two factor authentication.
Enable this on any social sites that you use
where you disclose personal information,
wherever possible.
So see the sections on passwords
and authentication for more details on that.
Some social sites will allow two factor authentication,
others may not,
but we detail that in that section.
Depending on what social sites you use,
they will potentially have privacy settings.
So you should investigate the best options
for you based on your identity strategy.
Here is a good guide,
one of the best guides I have found
on Facebook privacy settings.
Facebook obviously is one of the most
popular social media sites.
Another good read here
is on Twitter's privacy settings.
If you’re using Twitter, I suggest
you investigate the privacy settings on whatever social sites
and forums and things that you use and visit,
and make them in line with your identity strategy.
Another consideration is you can use
decentralized social networks
where you control the content,
and where they are happy for you to not use
your real identity, and do not own your data.
Here are three decentralized social networks that I recommend.
The first one is this one, Diaspora
the second one is this one, Friendica,
and the third one is GNU’s social network.
So check those out as alternatives.
Some of these integrate with existing social media sites,
while you attempt to migrate away
from those centralized sites to these decentralized sites,
so you can slowly move away
and bring your friends
to these more privacy-focused decentralized social networks.