What They Can Already Find
Before anyone attacks an account, they look you up. Most of what identifies you is not stolen — it is public, scattered across posts, records and old breaches, waiting to be assembled.
When I picture an attacker I picture hacking — breaking in. Is that how it usually starts?
Rarely. I start by reading. Open-source intelligenceOSINTOpen-source intelligence — finding out about someone using only public information: profiles, posts, records, and the links between them. — I look you up. Your name, your photos, your old accounts, a breach from years ago. I assemble what is already public before I ever try a password.
And that is the uncomfortable truth of this whole course: most of what gives you away was never hidden in the first place.
A footprint you did not know you were leaving
Your public footprint is larger than it feels. Social posts and the profiles behind them; data brokers that sell assembled dossiers; old breachMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. dumps pairing your email with a password; public records; a photo whose caption or background gives away where you live. Each is minor. The problem is that they combine.
None of these facts is secret: your first name, your city, your employer, your dog's name, your gym. Why would an attacker care about such ordinary things?
The aggregation problem
A single post says little. A hundred posts, cross-referenced with a profile photo, a reused username, and a location tag, say where you work, when you are out, and who you love. This is the same lesson as metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often., pointed outward: an adversary rarely needs one revealing thing when a hundred ordinary ones will do.
# nothing here was hacked. all of it was public.
reused username "wren_h" -> found on 4 old forums
a 2021 breach -> that username + an email + a password
photos geotagged to one neighbourhood, posted every weekday 8am
# a home, a routine, and a password to try. from looking, not breaking.
Why does an attacker collect ordinary, non-secret facts about you — your city, employer, pet, usual coffee shop?
Assuming public means harmless
- Posting routine, location and relationships in the open, under one identity
- Reusing the same username everywhere, linking every account into one profile
- Assuming an old, forgotten account is gone rather than archived and searchableManaging your footprint
- Looking yourself up first, and cleaning up what an adversary would use
- Removing yourself from data-broker sites, and keeping new posts sparse
- Separating identities so no single search returns your whole life
- Assuming anything posted is permanent, because for practical purposes it isYou cannot un-publish the internet, but you can shrink and split your footprint. Match the effort to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: an advertiser buys the aggregate; a determined person assembles it by hand.
So before any clever attack, there is just... looking. And I left most of it out in the open.
Which is good news, oddly: the first improvements are free. Look yourself up, remove what you can, stop linking every account through one username. You raise the cost of the easiest attack there is.
And you take away my favourite tool. I would always rather read you than hack you — right up until you stop leaving the pages open.
Legal
Looking yourself up, and reducing your own exposure, is ordinary self-defence. Assembling a profile of someone else to locate, harass, or impersonate them — doxxing — is a serious harm and often a crime, and it is exactly the practice this lesson teaches you to defend against, not perform.
So the attack usually begins with a search, not a break-in, and the raw material is what you already made public. Look yourself up, shrink and split your footprint, and you defeat the cheapest attack before it starts. Next, the last piece of Foundations: metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. — how you keep giving yourself away even when the words are encrypted.