We’re now going to talk about 2
how much personal information you might be reveling 3
on the social sites that you use in forums, 4
and when you fill out forms, 5
and really, any time where you’re providing information, 6
and we’re going to look at using identity strategies 7
to limit your exposure to your adversaries 8
when revealing personal information. 9
Increasingly it’s getting harder and harder 10
to not provide information 11
if you want to function in the modern world. 12
Our children simply won’t understand 13
the concept of privacy 14
in the same way that we do, 15
but the clear facts are 16
that the less information about you that is out there, 17
the more security, privacy and anonymity 18
you can grasp, attempting to attain. 19
The less information out there about you, 20
the better protected against identity theft, 21
phishing attacks, spam, conman, social engineering, hackers, 22
nation state surveillance, local law enforcement, 23
basically everything. 24
But you have to balance 25
your personal information disclosure 26
with your need for an identity or identities online. 27
Here is a scrolling list of 28
information you should consider 29
before revealing online 30
or consider before giving to companies. 31
The more of this personal information 32
that is out there about you, 33
the more of a complete picture 34
an adversary can have of you. 35
Questions to consider when putting this information online 36
or providing it to companies. 37
Who can ultimately access the information? 38
You might think it’s just your friends, 39
or just the company, 40
but they can forward the information on. 41
If it’s a social site, the social site 42
will have access to it, if it’s a company, 43
the company will have access to it. 44
Your adversary then may also have access to it. 45
Who controls and owns the information 46
that you are disclosing? 47
You might find that 48
some of the sites you use 49
own the content you publish. 50
Did you know that? 51
Can the information ever be taken back 52
or taken down that you've disclosed? 53
The answer is probably no, 54
because other sites and services 55
archive the internet, so ultimately, 56
even if it is taken down, 57
it may be archived somewhere else. 58
And as we know, nation states are archiving data as well. 59
Will your associates mind if you share 60
information about them with other people? 61
What information about you 62
are your associates passing on to other people? 63
Do you trust the people 64
in organizations you’re connected to? 65
They can forward on information you have posted. 66
Even if you post on a private forum, 67
you should consider the information 68
still public because you no longer 69
have control over that information anymore. 70
Are you relying on a social site 71
or other site as a primary host 72
for your content or information? 73
What happens if that site disappears, 74
if it goes down, will you lose 75
those precious pictures? 76
Are there photos of you online? 77
Do people tag you in photos 78
even if you don't post pictures yourself? 79
Consider the risk associated 80
with the information you post online. 81
Could an unfortunate post on social media 82
for your career, or posting your opinions 83
get you fired? 84
What are the consequences of posting, viewing or creating 85
this sort of content online 86
that you wish to do freely? 87
Just re-tweeting or forwarding 88
a message indicates your views on a topic? 89
Are you comfortable that your social media presence 90
creates a profile of you online 91
that can be used by employees 92
and your adversary? 93
Do you want to mix colleagues with friends and family? 94
Are you doing that now? 95
Do you have distinctly private activities 96
that you don't want associated with your real identity? 97
Do you perform activities that 98
law enforcement agencies or nation states 99
have laws against? 100
Will the information you disclose 101
lead to the targeting of your friends 102
and family members by your adversaries? 103
Will your children appreciate 104
you posting photos and information 105
about them when they get older? 106
Does this make them more vulnerable? 107
I recommend this site here 108
who do a great breakdown 109
of the terms of use and privacy policies 110
of companies that you use. 111
They also have a browser plugin, 112
so if you are interested 113
in the social sites that you’re using, 114
so let's for example look in Facebook, 115
and here we get a breakdown of 116
what this particular social site 117
has to say in their policies. 118
So the breakdown here, very broad 119
copyright license on your content, 120
this service tracks you on other websites, 121
Facebook automatically shares your data 122
with many other services, 123
Facebook uses your data for many purposes, 124
the Android app can record 125
sound and video from your phone at anytime 126
without your consent. 127
And if we click here, 128
we can see more details 129
if you want to see a breakdown, 130
So what I do, 131
what I suggest is that 132
if you are using social media websites 133
and you want to know 134
what they’re doing with your information, 135
this is a good site to go, 136
check out the detail 137
for the social sites that you use or other sites, 138
and see whether or not, you know 139
you’re happy with what it is 140
that they are potentially doing with your data. 141
You need to determine if these terms 142
are really in line with 143
what you’re currently posting online. 144
If they aren't, then you 145
need to consider a different identity strategy. 146
In the section on Op Sec, 147
we discuss identity strategies, 148
so let's revisit them in terms of 149
giving away personal information 150
and how you can use identity strategies 151
to manage the information that you’re giving out. 152
So the strategies I’m going to list 153
are in order of preference 154
for limiting the reveling of personal information. 155
So first is the avoidance strategy. 156
This is the best strategy for reducing risk 157
related to giving out personal information. 158
And the avoidance strategy is simply 159
avoiding using certain social media, 160
not posting, not filling in forms, simply not registering, 161
just not giving out that information. 162
This is often unrealistic 163
and deprives you from the advantages 164
of the internet and modern living, 165
and just may simply not be possible 166
in some circumstances. 167
But a common example might be 168
not having social media accounts 169
and limiting your accounts to the bare minimum. 170
This way, you release 171
the least personal information. 172
It’s recommended to use 173
the avoidance strategy where possible. 174
The less information that is out there, 175
the less vulnerable you are. 176
Where avoidance isn't possible, 177
you can use compartmentalization. 178
This is having contextually separate identities 179
from each other and your real identity. 180
For example, you could maintain 181
a social media account under an alias, 182
so you could have a Facebook as John Smith, 183
or whatever name, and you might 184
reveal information about you, 185
but it’s separate from your real identity. 186
So if your adversary or a HR department 187
do a search on you, there is nothing 188
linked to your real identity. 189
I have a number of friends, 190
who both in the real world and online, 191
are known only by an alias, 192
it’s an effective strategy for them 193
to separate their social and professional identities. 194
Next is the content strategy 195
where you’re only giving out 196
carefully considered information 197
against your real identity. 198
This is effective if you manage to 199
always put out carefully considered information, 200
but this strategy is risky as you could 201
inadvertently reveal information 202
you didn't intent to release. 203
A simple example could be 204
you download an app, you register 205
under that app as your real identity, 206
and not realize the default settings 207
are revealing your location 208
or some other personal information. 209
Then you have the audience strategy, 210
which is a step a little bit more risky. 211
This is keeping, as an example, 212
your personal and professional network separate 213
by using Facebook for friends and family, 214
and LinkedIn for your personal network. 215
This can limit the exposure of your personal information, 216
but it is still out there. 217
You know, do you own that information? 218
Can you remove it? Will someone copy it? 219
Will your adversary be able to find it? 220
Do you trust your audience with that information? 221
Ultimately, if you have put personal information out 222
to an audience, it can be passed onto another audience 223
or viewed potentially by another audience. 224
This is where you get into 225
your privacy settings on those sites. 226
You configure your privacy settings 227
to attempt to reduce the audience, 228
but obviously, if one person can view it, 229
one person can pass it on. 230
And then the most risky strategy 231
is the open strategy. 232
This is using your real identity 233
and being transparent and authentic. 234
Some people do live their lives like this 235
and in the public eye. 236
This is suitable for certain situations and cultures, 237
but this is obviously risky and makes you vulnerable. 238
Even though you’re using an open strategy, 239
you should still restrict the personal information you give out, 240
and generally an open strategy is not going to be suitable 241
for someone who is interested in privacy 242
and their anonymity and security. 243
And the final strategy is the custom strategy, 244
which is probably the best general strategy 245
for most people that will allow you to exist 246
on the internet 247
and limit information disclosure 248
by using a combination of the strategies 249
that we’ve gone through: avoidance, 250
audience, content, compartmentalization. 251
When information is custom to the audience, 252
there is less risk. 253
When identity is custom to the content, 254
there is less risk. 255
Whichever strategy you choose, 256
you should post only the amount 257
of personal information as is necessary. 258
Even if you don't care about privacy or anonymity, 259
you are better protected against identity theft, 260
phishing attacks, spam, 261
conman, social engineering, hackers, etc, etc., 262
if you limit the amount 263
of personal information you give away. 264
Another good site that provides information 265
on how different companies protect you 266
from government requests is this one here, 267
Who Has Your Back? 268
Another site from the EFF 269
and if you check this out here, you’ve got: 270
“Follows industry-accepted best practices, 271
Tells users about government data demands, 272
Discloses policies on data retention, 273
Discloses government content removal requests, 274
Pro-user public policy opposes back doors”. 275
And you can have a look through here 276
and see what it says about the social site that 277
you may happen to be using. 278
So here we can see Facebook 279
and it doesn't have a star here 280
for disclosing government content removal requests. 281
So check that out. 282
In the section on passwords and authentication, 283
we discuss two factor authentication. 284
Enable this on any social sites that you use 285
where you disclose personal information, 286
wherever possible. 287
So see the sections on passwords 288
and authentication for more details on that. 289
Some social sites will allow two factor authentication, 290
others may not, 291
but we detail that in that section. 292
Depending on what social sites you use, 293
they will potentially have privacy settings. 294
So you should investigate the best options 295
for you based on your identity strategy. 296
Here is a good guide, 297
one of the best guides I have found 298
on Facebook privacy settings. 299
Facebook obviously is one of the most 300
popular social media sites. 301
Another good read here 302
is on Twitter's privacy settings. 303
If you’re using Twitter, I suggest 304
you investigate the privacy settings on whatever social sites 305
and forums and things that you use and visit, 306
and make them in line with your identity strategy. 307
Another consideration is you can use 308
decentralized social networks 309
where you control the content, 310
and where they are happy for you to not use 311
your real identity, and do not own your data. 312
Here are three decentralized social networks that I recommend. 313
The first one is this one, Diaspora 314
the second one is this one, Friendica, 315
and the third one is GNU’s social network. 316
So check those out as alternatives. 317
Some of these integrate with existing social media sites, 318
while you attempt to migrate away 319
from those centralized sites to these decentralized sites, 320
so you can slowly move away 321
and bring your friends 322
to these more privacy-focused decentralized social networks.