On Data Hygiene

Michael

@wim said:

I also don't care about this tracking personally because I have nothing to hide and practice good hygiene with my personal data. Part of that hygiene is avoiding such tracking where I know it exists - as long as I'm willing to do without the resource that has it.

Out of curiosity @wim, if you’re willing and can be bothered explaining: what are your data hygiene practices?

I started getting spam emails recently that included my home address, after spending some time years ago googling it and getting it removed from places (too little too late, I’m sure), so it’s been on my mind a bit. I even got a PO Box so I could stop using the home address for deliveries, but I’m clearly not dedicating enough effort to the enterprise.

wim

Sure, I'll be happy to do that but want to put some thought into it and not just dash off a quick reply. I'm kind of a mixed bag on this topic. On one hand I have some pretty in-depth knowledge from 30 plus years of responsibility for corporate information security and also exposure to some of the mechanics of marketing tracking. On the other hand, I'm fairly complacent about such things when it comes down to it. My technical experience is also getting more and more out of date. I'm sure there are others who have much better insights than I do.

I can share some bare basics though when I have more time.

telecharge

Aw, I thought Michael was starting a podcast.

@Michael said:
I started getting spam emails recently that included my home address...

I've gotten those too, but the address was old. What's likely happened (in both our cases) is someone we've done business with has been compromised and the data shared.

Michael

Fair enough @wim!

Yeah, I figured it must be a reason like that, @telecharge - it makes it feel increasingly pointless trying to exercise any kind of data hygiene given that the moment you do business with anybody, you’re already exposed. Unless, I suppose, you use a PO Box like I’ve tried to, and a second burner phone and email addresses, but it’s already too late for me.

Michael

Our old bank went and got itself hacked a year or two back, too, got all our info, drivers license info, you name it.

telecharge

@Michael said:
...but it’s already too late for me.

The price of liberty is eternal vigilance?

@Michael said:
Our old bank went and got itself hacked a year or two back, too, got all our info, drivers license info, you name it.

Sorry to hear it -- such a hassle.

wim

When I think about the questions I get asked to supposedly verify my identity, for instance when calling my doctor or even bank, I'm amazed at how trivial it could be to get the information needed to impersonate me (in the somewhat unlikely event anyone would care to). For instance, the doctor's office asks for date of birth, home address, and telephone number. How hard could it be to piece that together? Not that hard really.

How many web sites ask for at least one of those bits? Hopefully not many ask for all of those together, but the thing is ... the background information to correlate that together is there if any of them are compromised. We talk about "personally identifiable information" in silos. There are involved compliance requirements for protecting such for e-commerce and other such sites, but what isn't fully appreciated is the background network of profiling that can fairly easily tie together the little bits of information that by themselves aren't personally identifiable, but if correlated, can be.

I took a stab at explaining how such profiling works and just got lost in the weeds. I don't think I'll try. I'll just answer the initial question about what I do to somewhat reduce my own risks.

• I never use the same password on more than one site. I don't try to remember passwords because if I can remember them then someone can figure them out. I can't even tell you the password I use for this site because I don't even know it. I use an encrypted password manager. (If that gets compromised, I'm hosed of course. 😂)
• I provide the bare minimum information I can to sites that require it. If they require something such as a birth date, or whatever, and have no concrete need for specifics, I make something up. If they have no legitimate need and are asking anyway, I decline to use that service.
• Whenever possible I use a well known payment service (not-saying which one) that makes the payment without disclosing account numbers and other authorization information to minimize where that information gets stored. There are only a very few places I provide a credit card number.
• I never ask for emailed or texted receipts from point-of-sale terminals in shops. I did that once and started having random other businesses recognize me, my email, and even my cell phone, just by using that credit card. I had to spend many hours on the phone to get that linkage supposedly purged. That was from a very well known point of sale system we've probably all used.
• I make use of iCloud's "Hide My Email" feature whenever signing up for new web sites, with very rare exceptions.
• I shred the cover page of paper notices and invoices that could have account info on them.
• I use Tap to Pay rather than swipe or insert wherever possible. That's many times more secure. I won't ever use a swipe or insert readers in a gas station or any other outside location where it's all too easy to compromise the reader. (Possible RF Reader exposure is something I'll admit I need to learn more about.
• I never follow a link from any email to log on to a site or provide any information.
• I never donate to any charity or make any payment whatsoever in response to a call at home, no matter how worthy the cause or if they claim to be a business I know. I explain to them that this is a absolutely firm policy and ask them to remove me from their call list.

That said, some of our paranoia about online risks is over blown in comparison to the many other worse ways we expose ourselves to fraud all the time. For instance, how many of us have, without a second thought, handed our credit card over to some restaurant employee we don't even know for as long as they feel like taking with it in some back room, and then leave our signature for the same person? Or have entered our PIN number with someone standing not more than a few feet away or possibly behind us?

telecharge

Something in wim's post reminded me of this - https://www.theguardian.com/commentisfree/2024/sep/23/australia-telemarketer-calls-scams-avoid-how

offbrands

Great thread @Michael and many thanks for the considered/through comments @wim

offbrands

@wim said:

• I make use of iCloud's "Hide My Email" feature whenever signing up for new web sites, with very rare exceptions.

Question - I use hide my email for any and all of my trusted accounts now too. Especially any websites I manage for people. That way I potentially limit the phishing / attempts on backend nefariousness.

I don’t feel like that’s taking it too far! But is it? I don’t know if there’s any potential oversights with this system that I’m not aware of. So far no issues, I’m happy to report.

wim

Hide My Email doesn't protect anyone from the most serious problem, phishing. Phishing emails end up in your main inbox no matter if they're sent to a Hide My Email address or your real email address.

It can reduce spam a little by diluting the "verified" data the spammers use. Spammers pay more for higher quality data. The more times people have fell for replying to, or in some cases unsubscribing from bogus email, the more often an email address has been harvested from a web site, forum, etc. the more verified the data is and the more likely spammers are to make use of it.

They can help with disrupting the linkage between who you are and any personally identifiable information that has accumulated on you. They can seriously help prevent the domino effect if an account is compromised. I forget the term for it, but what I call "leap-frogging" accounts is a common way to take over lots of accounts from an individual very quickly by leveraging recovery email addresses and the varying bits of information that sites use for password resets.

They also make it real easy to invisibly shut off spam and to know who sold you out. If you start getting spam from out of nowhere to a Hide My Email address, you know it's either coming from them or that they sold that info to someone. It takes less than a minute to kill that off without affecting your email.

Unfortunately for most of us, Hide My Email came along long, long after our main emails became spam targets. But, every little bit helps.

The only downside I can think of is you need to fully understand what's going on with Hide My Email and remember that its a factor. For instance, if you try to sign on to a website that uses email address for login name and you forget, and try to sign on with your regular email, you might end up trying to reset a password that you don't have to, running into issues with it not recognizing you, etc.

Another good reason to have a secure password vault.

Please don't ask me for best practices there though. I know what I use, and tbh I don't know if it's the best way to go. I'm also so lazy sometimes that I just use iCloud Keychain instead of what I've used regularly for years. Password management is kind of a mess for me right now.

knewspeak

Data integrity also relies heavily upon others who hold sensitive data about you to have a strict security policy too, as stated above, of course this can be a personal inconvenience, but having separate accounts and methodologies of contact can help obfuscate any would be hacker, scammer unless they are really determined that is.

wim

I knew someone that scammers got to through an elderly parent. They tricked his mother into giving her email account details with one of those fake support calls as-if from Microsoft. They then emailed him from her account and he fell for it.

I'd say by far the highest number of successful exploits were carried out by USB drives and SD cards. I didn't even think to mention that avenue earlier since I so rarely use them anymore myself and haven't been constantly having to clean up those messes at work for years.

knewspeak

@wim said:
I knew someone that scammers got to through an elderly parent. They tricked his mother into giving her email account details with one of those fake support calls as-if from Microsoft. They then emailed him from her account and he fell for it.

I'd say by far the highest number of successful exploits were carried out by USB drives and SD cards. I didn't even think to mention that avenue earlier since I so rarely use them anymore myself and haven't been constantly having to clean up those messes at work for years.

Phishing attacks are becoming all the more rife using identity theft or the portrayal of persons or business you know, here in the UK it’s reached epic proportions, people losing their lifetime savings, really sickening to hear of some of the cases.

wim

@knewspeak said:
Phishing attacks are becoming all the more rife using identity theft or the portrayal of persons or business you know, here in the UK it’s reached epic proportions, people losing their lifetime savings, really sickening to hear of some of the cases.

You should see the sophistication of some of the attempts on higher profile executives that I've seen. I used to marvel at the effort and ingenuity that went into them.

Because of the potential payout those used to be worth the time for people to craft individually and well whereas most people only got the more obvious and easier to spot mass mailings.

AI has completely changed that game though. It's now becoming cheap enough to craft thousands or millions of very credible phishing emails and phone calls. Those use information scraped from the web. That is why staying anonymous online is becoming more and more important.

tubespace

@knewspeak said:
Data integrity also relies heavily upon others who hold sensitive data about you to have a strict security policy too, as stated above, of course this can be a personal inconvenience, but having separate accounts and methodologies of contact can help obfuscate any would be hacker, scammer unless they are really determined that is.

Yes, this is so true. I always use separate and specific email accounts for the type of online interaction I do: one email address for buying from big stores, another for buying from smaller music-related businesses, another for cannabis-related stuff, and another for signing up to forums.
But even still - if the company that I buy from needs to ship to my address and they get hacked - my home address is out there. Not much I can do about that.

My cellphone carrier has tools to block spam calls. I just wish they had some tools to block spam text messages, too. My phone number has been handed around like a sad, use, soiled, toy.

wim

I forgot to mention social media in my "data hygiene" practices. They aren't very practical for most people though.

Unfortunately I have a Facebook account, but only because I need it for one or two things. Good luck finding any personal information on me there though. I make it a habit to re-visit the security and privacy options every time I'm unfortunately forced to log on there (which is maybe once or twice a year). It fascinates me how well they sneak in new ways to expose or use your information and how well they make it non-obvious how to defeat them. I take it as a personal challenge though.

I honestly don't recommend anyone have a Facebook (etc) account if they don't have to, and to share as little as possible there. That's probably a thing many people don't want to give up though, and I get why.

But that's my MO in general for social media. Keep the info to a minimum, and revisit the privacy options often.

wim

Last post, I think...

I run a PiHole ad blocker on my home network. Not primarily to block ads, though that's nice. It's mainly to inhibit trackers. If I feel guilty about blocking ads from a site, I disable blocking for 10 minutes, or add an exclusion for that site.

A whopping 22% of DNS queries are blocked ad and tracking lookups. And I'm a very light user of sites other than ones like this that don't pull that kind of sh*t. It's absolutely mind-blowing.

wim

A couple of follow-ups based on some things that came to light with the recently added trackers appearing in some of the apps acquired by the new Audiobus Pty Ltd:

https://forum.loopypro.com/discussion/comment/1370830/#Comment_1370830
and
https://forum.loopypro.com/discussion/comment/1370840/#Comment_1370840

JohnnyGoodyear

Very interesting Mister @Wim. Thank you.