Social Networks and Your Digital Footprint

Everything you share online, a holiday photo, a birthday, the name of your employer, becomes a puzzle piece. Attackers, scammers, data brokers and sometimes future employers assemble these pieces into a picture of you. In this lesson you will learn what your digital footprint is, how to measure yours, and how to share without oversharing.

Throughout this chapter we have looked at how to avoid being tricked. Here we take the opposite view: how much easy material do you hand to the people who want to trick you? Remember the "information I share" column of your attack surface map in lesson 1.4.

What is a digital footprint?

Your digital footprint is the trail of data that you leave online. It has two parts:

• The active footprint: what you deliberately publish, such as posts, photos, comments, reviews, profiles and professional networks.
• The passive footprint: what is collected about you without you doing anything: browsing history, location, device details, purchases, and data that other people post about you (a friend tagging you in a photo).

Information can also come from public registers, old forum accounts, data leaks and websites that compile profiles of individuals. Once something is online, it can be copied and archived, so you should consider it difficult to remove completely.

How scammers and attackers use what you share

• Targeted phishing (spear phishing): knowing your employer, your boss's name, your bank or your recent trip, a scammer writes a message that feels personal.
• Password guessing and account recovery: names of pets, schools, birthdays and your mother's maiden name are the classic answers to security questions, and they are on many public profiles.
• Identity theft: a full name, date of birth, address and a few documents are sometimes enough to open accounts or make fraudulent applications.
• Impersonation: someone copies your photos to create a fake profile and scam your contacts, a common social network fraud.
• Burglary and stalking: posting holidays in real time, or photos that reveal your address, tell people when your home is empty or where you are.
• Voice and image cloning: public videos and recordings can be used to imitate your voice or face, which supports the "relative in trouble" scams we saw in lesson 1.3.
• Reputation: employers, schools and others may look you up. Old posts, jokes and photos can be taken out of context.

Measure your footprint

You cannot fix what you cannot see. A simple self-audit takes about 30 minutes:

1. Search your name in a search engine, in quotation marks, with and without your city. Also search your usual username, email address and phone number. Note what comes up, and look at the image results too.
2. List your accounts: social networks, forums, shops, apps, and old accounts. Your password manager and email inbox are good sources.
3. Look at your profiles while logged out or from a private window, to see what a stranger sees.
4. Check data leaks for your email addresses using a reputable breach-notification service.

Reduce and control what is visible

1. Review the privacy settings of each network

• Set your profile to private or "friends only" if the network allows it, and limit who can find you by email or phone number.
• Control who can see your posts, your friends list and your tagged photos. Turn on review of tags before they appear on your profile.
• Disable location tagging on posts and photos, and remove old location data.
• Review third-party apps that have access to your account and revoke those you do not use.
• Check what the platform can do with your data for advertising and training of automated systems, where settings are offered.

2. Clean up

• Delete accounts you no longer use, and remove old posts that reveal personal information.
• Remove or correct personal details that are not needed: full birth date, home address, phone number.
• For results in search engines that you cannot remove yourself, many search engines and websites provide a request process for outdated or sensitive content, and European law gives you a right to request erasure, which we will examine in the next chapter.

3. Think before you post

Before posting, use a quick filter:

• Would I be comfortable if a stranger, my employer or a scammer saw this?
• Does it reveal where I am, where I live, or when my home is empty? Post holiday photos after you return.
• Does it show other people (children, friends) who have not agreed? Ask first.
• Does it show anything in the background: a house number, a license plate, a boarding pass, a badge, a screen with information?
• Could it be used to answer a security question or guess a password?

Dealing with fake profiles and harassment

• Be selective about friend or contact requests. Accepting strangers gives them access to your information and your friends. A request from someone you already know can be a cloned profile: check with the real person.
• If someone impersonates you, warn your contacts, report the fake profile to the platform and keep screenshots.
• If you face harassment or threats, do not engage. Save evidence, block and report, and seek help; the authorities and the platform cybermalveillance.gouv.fr offer guidance on the steps to take, and similar services exist elsewhere.

Separating identities

You do not need to use the same identity everywhere. Many security-aware people separate:

• a professional presence, deliberately public and polished;
• a personal presence, restricted to friends and family;
• and sometimes pseudonymous accounts for hobbies and forums, with different usernames, emails and photos, so they cannot easily be linked.

This is not about hiding anything illegal. It is the digital equivalent of not wearing your work badge to the swimming pool.

Your turn

Exercise. Perform a 30-minute footprint audit on yourself: search your name, list your accounts, look at your profile as a stranger, and then take three concrete actions (change a privacy setting, delete an old account, remove a personal detail).

See a solution

An example of reasonable actions:

1. Set the main social profile to private, and restrict "who can find me by phone number" to nobody or contacts only.
2. Delete an old forum or shop account that you do not use, after downloading what you want to keep.
3. Remove your full birth date and your city of residence from your profile, and replace the profile photo that shows your house number.

Also note any search result that you cannot control, and decide whether to request its removal. You do not have to fix everything at once: the goal is to reduce the easiest material for an attacker.

Add to your Security Notebook

Under "4. Browsing and communication", add your "before I post" filter in two or three questions and the three actions from the exercise. Note the date of your next footprint audit, perhaps in six months.

With Chapter 4 completed, you are able to browse, read mail and communicate with far more confidence. Next, we look at the legal side of privacy: your rights over your data.