Doxing. How to protect yourself and your data from public deanonymization on the Internet.

[Carder]

Doxing (or de- anonymization) is a popular term among cybersecurity experts that appears more and more in articles and forums these days. But what exactly does it mean? We can say that doxing is the search and publication of information about you on the Internet in order to obtain some kind of benefit or harassment. This may be information that you intended to keep confidential, such as your personal residential address or real name. However, public data is often doxed and can be easily found on the Internet with just a little digging. For example, this is your phone number or work address.

Doxing is dangerous because certain personal information is published on the Internet and is used by criminals for such fraudulent purposes as mass online harassment, moral violence, or playing off several people. Your political beliefs or high status in society increase the likelihood that you will be doxed.

Confidentiality is always useful to you. First, you need to understand what kind of personal information, possibly obtained by criminals in the future, may pose a threat to you. Then you can take specific steps to improve your online privacy.

We invite you to read the translation of the Electronic Frontier Foundation article on what precautions to take to improve personal safety before you are threatened by potential doxing. In this article there will be no details on how to delete your data from each specific service, we will talk only about the basic rules that you should pay attention to.

First steps to protect yourself and your data​

First, take a look at the information that is already publicly available about you on the Internet. It is very simple to do this: you need to open a search engine and enter your name or nickname in the search bar. Usually the result is shocking, because you begin to realize that there is much more personal information about you on the Internet than you expected, and anyone can access it. In fact, this is quite normal, especially since you are on the path to reducing the amount of this information and taking the necessary steps to better protect your data. Pay attention to any details that seem truly personal to you. Determine what kind of resource it is and how long ago this data appeared there, and delete it.

Second, decide who you can really trust with your secrets. Friends, family, a select group of people? If you are afraid of falling prey to doxing, you will want to talk to these people first. Not only because they might be involved in the doxing incident itself, but because there is real power in your little community of loved ones. These people can help you plan how to prevent a future incident, and also advise you on what to do if it occurs. Please be aware that this list will change over time. This is natural for any relationship. Set yourself a reminder to check this list at least once or several times a year.

Also establish basic rules among your loved ones related to the exchange of personal data, such as obtaining permission from you before posting joint photos, refusing to tag these images or using code words that only people you verified during correspondence will know. These are all examples of steps you can take to improve the safety of your loved ones and yourself.

Third, read the security policy for your online accounts. Most social networks and popular web applications have their own rules regarding this aspect, and they protect users from possible doxing. Resources will be sure to notify you of any security breaches in your account as soon as they become aware of it.

Now it's worth moving on to the so-called "technical steps" that you can take to properly respond to a doxing incident.

Minimizing your shared data​

The most obvious safeguard you can take to avoid doxing is to reduce the amount of personal information about you online.

Data brokers are companies that exist solely by collecting personal data from users and reselling that information to those who bid a high price for it. The data they collect is often sourced from public records and online trackers and supplemented with commercial transaction information. It is a parasitic, rotten industry that survives by invading the privacy of ordinary people on the Internet . Due to public pressure, many of these companies are offering users ways to opt out of collecting their data. We recommend that you get to know the following firms White Pages, Instant Check Mate, Acxiom, Intelius and Spokeo... It's also worth reading this helpful guide on how to protect yourself from online collection of personal data.

There are also several professional (but paid) services like DeleteMe or Privacy Duck that claim to help minimize the amount of data available online about you. Keep in mind that data brokers are on the alert: they keep updating records about you, re-filling the same lines with information about the person. Thus, you will need to subscribe to keep your personal data safe at all times. Services also do not promise complete data minimization across all possible sources .

Users will have to do their own investigation and see if the resources presented above can really help them and increase their privacy.

Safe web browsing​

Sometimes sites and resources don't behave the way they should, and our secrets become public. For example, suggested friend lists can sometimes "give out" you to people, even though you may have multiple accounts to separate your privacy from your public one.

Another common example is online user tracking. If this is a problem that really worries you, here are a few steps to help you solve it.

Check how much information sites collect about you with the Cover Your Tracks tool. This will give you an idea of how trackers on the Internet are able to identify you as the same person when you visit different sites. We also recommend using the tracker blocking tool, Privacy Badger, which is designed to block any tracking on the Internet.

Are you using strong and unique passwords, multi-factor authentication for each of your accounts to keep your data safe? Think about this as you read the next paragraph of the article.

Since we are talking about all the accounts you use on the Internet, we strongly recommend that you take the time to each of them to see what information you share with the public. Are you sharing the least amount of data with them, or publishing more information than you need to?

Instead of giving your mother's maiden name, graduation date, or pet name to your security questions, consider entering a random passphrase and saving it to your password manager.

Instead of listing your phone number, which could lead to your account being compromised, think twice. Use something more detached (be it VK, Instagram or some other popular resource): if you can replace your mobile phone number with something less individual, for example, a virtual number, that will significantly increase your security. By being mindful of what information you share online, and when and where you do it, you can definitely better protect your data.

Potential Incident Response Plan​

In case doxing has already happened, the last thing you want to do is puzzle at the last minute over how to react to the incident. Here you will need a ready-made plan . Below are some tips on how to write it correctly.

Determine which accounts should be blocked or temporarily deactivated if you become doxed. List all resources. This will help you quickly complete the process of deactivating and blocking accounts, because you will understand exactly what to do.

You should also create a spreadsheet to record all incidents as they occur. It is necessary to record the time when the doxing took place, who and how probably did it, and all other details of the incident. Creating such a log will be an incredibly useful step as it can help you identify where the security vulnerability of your personal data is.

Take care of yourself and others​

Knowing that you have friends who will support you if you dox will not only relieve stress, but it can also prevent the incident itself, as your loved ones will be warned of possible danger. We recommend that you take all the steps to improve your online security with a friend or loved one. It will be a real relief for you to know that they can take responsibility for implementing the incident response plan. So, in fact, trusting relationships between people are built.

"Health Information" - is a form of care for your data (when the extra personal information will not be published on the Internet). Setting standards for your "data hygiene" never hurts. In the end, an incident on one resource can lead to doxing of your other accounts. Taking care of your data hygiene will build your confidence that you are truly protected from outside threats.