How easy is it to dig up your personal information online? Here's a true story for you: last month
a friend of mine asked me for a special favor. She had met a guy through an online dating site,
we'll call him Dreamy Drew, and wanted to learn more about this guy before she got too
emotionally involved. He was being a bit coy, so that's where I came in.
All my friend could give me about this guy was a blurry profile picture,
a first name and some random "about me" stuff he had probably made up on his dating profile page.
Within 20 minutes, I knew everything about Drew down to his home address, phone number
and some juicy details that would end up telling my friend all she needed to know to move forward.
So how did I do it? What would you have done? My hope is that
as you watch me unmask this guy who thought he was completely anonymous,
you'll learn a bit about the most common mistakes people make when they try to hide online.
Welcome to All Things Secured, my name is Josh and you need to know that the photos, names
and identities of the people involved in this story have been completely changed for their
own privacy and protection. My goal is to educate us, I'm not trying to embarrass or harm anyone.
That kind of malicious search and publication of private, identifiable information is what
is known as doxxing, and not only is it illegal in many countries,
it's also not cool. It's a form of cyberbullying that
is at least helpful to understand so that you can take steps to protect yourself. And if you
stick to the end of this video, I'll share with you a few of those important steps you can take.
So back to Dreamy Drew. I decided to start with his profile photo, which was a very pixilated side
profile picture. I mean, I could make a guess based on the photo that he was a middle-aged
white guy, assuming, of course, that he had used a real photo of himself, which wasn't a guarantee.
I decided to try two things. First, I looked at the source code of the webpage to inspect
the profile photo. It was a long shot, but I was checking to see if the photo
had accidentally been labeled or if the title of the image was his actual name. It wasn't.
Ok, so next, I downloaded a copy of the photo and did a reverse image search on Google. I did this
because some of us tend to use the same profile picture on all of our social media accounts. I
wanted to see if I could match this photo to a public Facebook, Instagram or LinkedIn account.
All I had to do was go to Google Image search, upload the image and see what results came up.
I had to sift through a lot of results, but ultimately I never found a match. Evidently Dreamy
Drew had never used this photo anywhere else, or at least nowhere that had been indexed by Google.
Ok, so the profile picture was looking to be a dead end. I tried doing LinkedIn and
Facebook searches based on a few scant pieces of information he provided when describing himself,
but the search was too broad and ultimately yielded nothing.
Then it happened.
While searching through the source code on his profile page, I found a tiny piece of
information that may seem insignificant, but proved to be Dreamy Drew's achilles heel.
It was his username.
While his public profile had been given a random number as an identifier,
the dating website had failed to remove his username from the website code. Keep in mind,
I am not hacking or doing anything illegal here. I'm simply reading the publicly available code
that you can see by clicking developer tools in your internet browser and finding Source Code.
And just like profile pictures, people also tend to reuse the same username on multiple
online accounts. Sure enough, when I added the username to the end of Instagram and Facebook,
there he was. Dreamy Drew in all his glory.
I learned a lot about Drew from his public Instagram account. It was a treasure trove of
information including his evening drinking habits, his previous girlfriends and what looked to be
cute little Drew Jr. I'm reserving any kind of judgement here, I promise, but
little junior wasn't listed on the dating profile, that's for sure.
Now, out of sheer curiosity and because sometime I simply don't know when to stop, I decided to learn
whatever else I could about Drew and Drew Jr. Now that I knew his full name and general
location, I was able to do a reverse lookup on an online white pages. Remember that old
printed book that used to be delivered many decades ago with the names, addresses and
phone numbers of everybody in the city? Well those exist online, they cover more than just one city,
and there are tons of them: Whitepages.com, Spokeo.com, PublicRecords.com and many others.
And you know what's scary? With a simple search,
I was able to get Drew's age, phone number, and home address.
But come on, I mean, how did I know that was his actual address?
Well, again, because I simply don't know when to stop, I did a public records search for
the address, searching through tax records and publicly available property documents,
and what I found was the cherry on top of this whole search.
The house that Drew and Drew Jr. lived in was listed under a woman's name who just happened
to be the same woman Drew had posted a picture of on his Instagram account for Mother's Day.
Yup. Although I can't say with 100% certainty,
I can make an educated guess that Drew still lived with his mom.
Phew! We just went from anonymous profile to Google Street view of the front door of his
mother's house in less than 20 minutes, found legally using publicly available information.
If that doesn't scare you, I don't know what will! Again, I'm not trying to discriminate against
single parents or people who live with their parents. But part of that information,
particularly having a kid, seems like something that needs to be shared on a
dating profile and I was glad to be able to share that information with my friend before she become
too emotionally invested in the relationship.
So what can we learn from Dreamy Drew's story?
First of all, and this is the easiest thing you can do honestly, is to make your social
media accounts private. Unless you're trying to build a public personal brand,
there's no good reason you should have a public account. Making Instagram private
is a simple switch in the privacy settings. Facebook is slightly more complicated,
but I've walked through the process in this video if you want to do that when you're done here.
The second thing you need to understand is that regardless of your own privacy habits, you have
a ton of your old information that is circulating around the internet. It doesn't even matter if you
don't have a Facebook account or if you rarely get online. At some point there was some court record,
property record or other document that was sold to a data aggregator and is now available online.
Now you can manually go through and find all these data dumps from places like Whitepages
that I mentioned earlier and you can submit a request to remove your profile information.
I'll link to a DIY guide for how to do this for free in the description of this video, just know
that it's a time-consuming process that based on my experience is very frustrating.
Another option here, at least one that I'm currently testing,
is using a service like DeleteMe to find and scrub all my private information off the internet.
I'll do an in-depth review of how this works in my next video, but it's saved me hours and hours of
time trying to find and remove this information online. So far, I'm happy with the results.
Finally, the last lesson I want you to take away from the story here is this:
online anonymity is a myth. That doesn't mean you should just throw up your hands and give
up. The pursuit of privacy is a worthy goal, but a false sense of anonymity has a tendency to make us
relax, to let down our guard and perhaps say or do something that might come back to bite us.
We want to be prepared, not paranoid, so to that end, the next thing you need to do is watch
this video here where I walk you step by step through the process of how I erased my address,
phone number and other private information from the internet. Click here to watch it now.