Safer Internet: What Do You Have to Hide?

Quotes | Summary | Who's at Risk | Types of Info | Identify Theft, Credit Freeze | Farfetched Example? |
References: General | Attacks,Leaks | Equifax, Credit Bureaus & Freezes |
Face | Financial | Health | Home | Identity Theft | Location | Vehicles | Voting

Quotes

Summary

Who's at Risk?

  • Everyone's information, even a fragment, can valuable to someone for
    profiling, money (e.g., advertisers, hackers) and/or control (e.g., governments, abusers).
  • [1] Anyone who has ever had a loan or credit card -- very likely affected by 9/2017 Equifax breach
  • [1] Anyone whose SSN, email or other sensitive details have been
    or will be leaked by a careless company or incompetent government agency
  • [1] Anyone who's posted to Facebook or other social media
  • [1] Anyone unaware of current recommended privacy and security practices.
  • [2] Anyone who's read privacy policies and changed some settings -- there's always more to review / do
  • [3] Any high-profile target: celebrity, politician, business, political dissident,
    investigative journalist, whistleblower

Types of Info

  • Contact information: home address, phone, email -- yours and family
  • Vital Statistics: your birthday, birthplace, family members
  • Financial information: SSN, credit cards, purchases, tax returns, bank statements
  • Your current and past locations -- via smartphone or car
  • Photos
  • Medical information: health records, DNA
  • Biometrics: fingerprints, face scans, movement (motion sensors)
  • Password(s): if a password is stolen, login to that site and change it, before a hacker does
    -- hopefully, you have devious security question answers
    and/or 2-factor authentication for any sensitive accounts.
  • However, if you re-used that password for other sites -- a big no-no -- you'll have to scramble...
  • Email, chat, and other communication history
  • Browsing behavior -- current and historical {List. TCYOP-4: 87-98; TCYOP-3: 73-74}; browser 'footprint'
  • Personally-identifiable vs. anonymously-aggregated information; content vs. metadata
  • Data across different sites via cookies or IP address (or 'browser fingerprint')
    can be mined/aggregated to reveal patterns, and lead to individuals
  • How anonymous/unique are you: zip code + birthdate + gender?
  • Other devices: voting systems, (smart)TV, set-top/streaming box, game console,
    smart watch, health/fitness trackers, home automation, car; section: "Internet of Things" (IoT)
  • Others' devices: cameras, wearable technology
  • NYT quiz: How Many Times Has Your Personal Information Been Exposed to Hackers?
  • NIST Quiz: Are you Safe Online?
  • Pew: Cybersecurity Knowledge Quiz
  • haveibeenpwned.com check if you have an account that has been compromised in a data breach;
    pwned (gaming term) = totally dominated, conclusively defeated
  • HPI Identity Leak Checker check whether your email address, along with other personal data
    (e.g. telephone number, date of birth or address), has been made public on the Internet
    where it can be misused for malicious purposes

Identity Theft

  • A good place to start: FTC: identitytheft.gov
  • 2023 cyber-attacks targeted a vulnerability in the MOVEit filesharing technology used by
    many federal & state agencies and corporations around the world. This exposed personal information
    of millions of people, including social security numbers in many cases.
  • e.g., MOVEit hack spawned over 600 breaches but is not done yet -- cyber analysts Reut; 8/8/2023
  • Your bank or financial institution may offer a free credit monitoring service; set up credit freezes (below).
  • If you have ever had a loan, mortgage or credit card,
    you are very likely affected by the Equifax breach (9/2017)
    -- with at least your birthdate, name, address, SSN available to hackers worldwide
  • Equifax grand leak total (5/2018): 146.6 million names, 146.6 million dates of birth,
    145.5 million social security numbers, 99 million addresses
    and 209,000 payment cards (number and expiry date) exposed;
    also 38,000 American drivers' licenses and 3,200 passport details
  • You may be vulnerable due to other past or future leaks
    from other companies or government agencies with sloppy security.
  • However, there are still some things you can do to minimize the damage
    -- many of them free (with some redundancy)
  • Closely monitor credit card activity for unrecognized charges
    with your credit card companies -- at least monthly, but preferably more often.
  • Set up SMS and/or email notifications and fraud alerts with your credit card company
    for charges over certain amounts or from certain sources, esp. online, international.
  • Check your credit report & score, e.g., annualcreditreport.com free; creditkarma.com
  • If your credit card is missing or stolen, in addition to checking your report,
    you can set up notifications/alerts with some credit agencies.
  • optoutprescreen.com: to reduce mailed credit and insurance offers
    which might be stoken from your mailbox; opt-out for 5 years (electronically), for life (via mail)
  • File your income taxes as early as possible -- and setup an online account with IRS
    to review past tax returns -- so that a hacker doesn't file early (with your SSN) and claim a refund,
    or steal your info/identity: Get Transcript; View Your Tax Account

Check/Freeze Credit Reports

  • Freeze credit reports with all 3 major credit reporting agencies
    -- to prevent future applications for mortgages, auto loans, credit cards with your SSN
  • Federal law now requires credit bureaus to offer security freezes free of charge,
    and they're much simpler to set up than in the past;
    some states used to charge $10; unfreezes should also be free?
  • A freeze accomplishes the same thing as a lock, but with a freeze, your rights are defined by law.
  • With credit locks, the credit bureaus set the rules;
    the lock option is more prominent on their websites -- but I've provided direct links for setting up freezes below
  • If you set up only a lock earlier with EquiFax (or the other agencies),
    re-enroll with a freeze; note: any pre-existing lock will be removed, e.g., TrustedID Premier
  • Save the generated PIN, e.g., in your password manager, in order to unfreeze
    when applying later for a new loan or credit card.
  • Equifax: Freeze
  • TransUnion: Freeze
  • Experian: Freeze
  • Innovis: Freeze; lesser known than the 'big 3' credit agencies, but since it's free, why not?
  • National Consumer Telecom and Utilities Exchange for telecommunication, pay TV and utility accounts
  • Some credit/identity monitoring services may be free (with ads):
    e.g., CreditKarma.com; or included in membership, e.g., ProtectID (AAA)
  • Credit agencies and others may offer some free credit/identity monitoring services,
    but beware of paid upgrades for these and other services -- they're often unnecessary,
    duplicative, overpriced, e.g., Equifax: Complete Premier, Family Plan, ID Patrol
    do you really want to trust and reward the company (Equifax) that leaked your info in 2017?    ;
    or Lifelock which paid FTC fines for deceptive advertising?

Farfetched Example?

CALLER: Is this Gordon's Pizza?

GOOGLE: No sir, it's Google Pizza.


CALLER: I must have dialed a wrong number. Sorry.

GOOGLE: No sir, Google bought Gordon’s Pizza last month.


CALLER: OK. I would like to order a pizza.

GOOGLE: Do you want your usual, sir?


CALLER: My usual? You know me?

GOOGLE: According to our caller ID data sheet, the last 12 times
you called you ordered an extra-large pizza with three cheeses,
sausage, pepperoni, mushrooms and meatballs on a thick crust.


CALLER: OK! That’s what I want.

GOOGLE: May I suggest that this time you order a pizza
with ricotta, arugula, sun-dried tomatoes and olives
on whole wheat gluten free thin crust?


CALLER: What? I detest vegetables.

GOOGLE: Your cholesterol is not good, sir.


CALLER: How the hell do you know?

GOOGLE: Well, we cross-referenced your home phone number with your
medical records. We have your blood test results for the last 7 years.


CALLER: But I do not want your rotten vegetable pizza!
I already take medication for my cholesterol.

GOOGLE: Excuse me sir, but you have not taken your medication regularly.
According to our database, you purchased a box of 30 cholesterol tablets
only once, at Drug RX Network, 4 months ago.


CALLER: I bought more from another drugstore.

GOOGLE: That doesn’t show on your credit card statement.


CALLER: I paid in cash.

GOOGLE: But you did not withdraw enough cash
according to your bank statement.


CALLER: I have other sources of cash.

GOOGLE: That doesn’t show on your last tax return unless you bought
them using an undeclared income source, which is against the law.


CALLER: WHAT THE HELL?

GOOGLE: I'm sorry, sir, we use such information only
with the sole intention of helping you.


CALLER: Enough already! I'm sick to death of Google, Facebook, Twitter, WhatsApp
and all the others. I'm going to an island without internet,
cable TV, where there is no cell phone service
and no one to watch me or spy on me.

GOOGLE: I understand sir, but you need to renew your passport first.
It expired 6 weeks ago.

References

Attacks, Leaks

Equifax, Credit Bureaus & Freezes

Face

Financial

Health

Home

Identity Theft

Location

Vehicles

Voting