Lesson 9.2

Reducing Personal Exposure

Learning Objectives

After this, students can lock down privacy settings on major social platforms and fitness apps.
After this, students can prevent photos and posts from leaking location and other sensitive details.
After this, students can separate their identities using different usernames and email aliases.
After this, students can make leaked data less useful through password managers, MFA, passkeys, and fake security question answers.
After this, students can remove old accounts and request removal of personal information from Google Search.

Three Principles

Reducing exposure comes down to three ideas. Every recommendation in this file fits under one of them.

Minimize: share less, and make less of what you share public.
Compartmentalize: keep different parts of your life (school, work, gaming, personal) from being easily linked together.
Harden: assume some data will leak anyway, and make it useless to an attacker.

You can’t reach zero exposure. The goal is to make yourself a harder, less rewarding target than the next person.

Menu names and locations change often. The paths below were checked in 2026, but verify them before class, and encourage students to use each platform’s built-in privacy checkup tool when one exists.

Facebook

Privacy Checkup (Settings & Privacy → Privacy Checkup): a guided walkthrough of who can see your posts and profile, how people can find you, and which apps have access to your data.
“Who can see your future posts?”: set to Friends (or a narrower custom list). This only affects new posts.
“Limit past posts”: changes all your old public posts to Friends only in one step. This is a one-way change that can’t be undone in bulk, so save anything you want to keep public first.
Review who can see your friends list, who can look you up by email address or phone number, and whether you review tags before they appear on your profile.

Instagram

Switch to a private account so only approved followers see your posts and stories.
Control tags and mentions: require manual approval before tagged photos appear on your profile.
Use “Hide story from” or Close Friends for stories you don’t want everyone to see.
Don’t add location tags to posts made at or near home.

Settings → Visibility → Edit your public profile: choose which sections (photo, headline, current position, experience, education) are visible to people who aren’t signed in and to search engines. You can also turn public visibility off entirely.
Decide who can see your connections list. Connection lists are a gift to anyone mapping an organization.
LinkedIn is where attackers build employee lists and guess email formats. Keep it professional, but think twice before listing every internal tool and system you manage.

X (Twitter)

Protect your posts so only approved followers can see them.
Limit photo tagging and turn off discoverability by email address and phone number.

Fitness and activity apps (e.g., Strava)

Strava’s privacy controls (You → Settings → Privacy Controls) include Map Visibility options:
- Hide at a specific address: hides your movement within a radius of an address you choose, such as your home.
- Hide start and end points everywhere: hides the beginning and end of every activity, wherever it happens.
- Hide all maps: hides activity maps from others completely.

These settings are not retroactive, so older activities may still show your start and end points. Also set the default activity visibility to Followers or Only You. Remember the Strava Global Heatmap case from the intro lesson: fitness data exposed the layouts of military bases.

Payment apps (e.g., Venmo)

Payment apps have historically shown transactions and friend lists publicly by default. Set transactions and your friends list to private, and review past transactions (verify current setting names before class).

Applies to every platform

Remove your birth year (or full birthdate) from profiles.
Review third-party apps connected to your accounts and remove ones you don’t use.
Turn off “find me by phone number/email” where possible.
Scroll back through old posts. What you shared at 15 may not be what you want public at 20.

Location Data and Photo Hygiene

Turn off location tagging at the source

iPhone: Settings → Privacy & Security → Location Services → Camera → Never. When sharing a single photo, the share sheet’s Options menu can also remove location from that photo (verify before class).
Android: the camera app’s settings usually include a “location tags” or “save location” toggle. The exact name varies by manufacturer.

Know when metadata survives

Most large social platforms strip EXIF metadata (including GPS) when you upload. But metadata often survives when you:
- Email a photo as an attachment
- Share through cloud storage links
- Upload to personal websites, blogs, or some forums
- Send the original file through some messaging apps

Check a file before sharing it:

exiftool -gps:all photo.jpg

And strip everything if needed:

exiftool -all= photo.jpg

(ExifTool keeps a backup copy named photo.jpg_original by default.)

Post after you leave

Real-time posts tell people where you are now and, by extension, that you’re not home. Post vacation photos after you get back, and post from events after you’ve left.

Check the background before posting

Investigators zoom in. So do attackers. Look for:
- ID badges and lanyards: “First day at my new job!” badge photos can reveal the badge design, your name, and your employer, which is enough to make a convincing fake.
- Boarding passes and tickets: the barcode can contain booking details.
- Keys: a clear photo of a key can be enough to copy it.
- Screens and whiteboards: internal systems, passwords on sticky notes, meeting notes.
- Mail and packages: your name and address.
- House numbers, street signs, license plates, and the view from your window: all used for geolocation.
- School uniforms, team jerseys, and logos: especially important for photos of kids.

Compartmentalize: Usernames, Emails, and Phone Numbers

Username pivoting (from the intro lesson) works because people reuse the same handle everywhere. Breaking that link is one of the most effective things you can do.

Usernames

Use different usernames for different parts of your life: one for professional accounts, another for gaming, another for anything you want to keep separate.
Avoid usernames that contain your real name, birth year, or hometown.

Email aliases

An email alias is a forwarding address that delivers mail to your real inbox without revealing it. If an alias starts getting spam or shows up in a breach, you turn it off.

Service	Notes (free tiers change often; verify before class)
DuckDuckGo Email Protection	Free; unlimited `@duck.com` aliases; strips email trackers
Firefox Relay	Free tier with a small number of aliases; paid tier adds more
SimpleLogin	Free tier with a limited number of aliases; paid tier adds custom domains
addy.io	Free tier; low-cost paid tiers
Apple Hide My Email	Available with iCloud+ and through Sign in with Apple

Good practice:
- Use a different alias for each service you sign up for.
- Keep your account-recovery email private. Don’t use it as your public contact address.
- Use an alias when you have to give an email to a data broker to opt out (see 9.3-data-broker-opt-outs.md).

Phone numbers

Avoid giving your real phone number to sites that don’t need it. Consider a secondary number (for example, a VoIP number) for sign-ups (verify which services support this before class).
Limit what messaging apps show to people who have your number (profile photo, name, last seen).

Harden: Make Leaked Data Useless

Security questions

Security questions (“What is your mother’s maiden name?”, “What was your first pet’s name?”) are often answerable from genealogy sites, obituaries, and old social media posts. Treat them like passwords:
- Make up the answers. “What city were you born in?” → violet-harbor-2291
- Store the fake answers in your password manager alongside the account.

Password managers

Breaches are inevitable. What turns a breach into an account takeover is password reuse: attackers take leaked email/password pairs and try them on other sites (credential stuffing).
- Use a password manager to generate a unique, random password for every account.
- Many password managers also alert you when a saved password shows up in a known breach.

MFA and passkeys

Multi-factor authentication (MFA) means a leaked password alone isn’t enough. Not all MFA is equal:

Method	Strength	Notes
Passkeys / hardware security keys	Strongest	Phishing-resistant: they only work on the real website
Authenticator app (TOTP codes)	Good	Can still be phished if you type the code into a fake site
SMS codes	Weakest	Vulnerable to SIM swapping and phishing, but still better than nothing

Prefer passkeys wherever a site supports them.
Ask your mobile carrier about account PINs or port-out protection to reduce SIM-swap risk (verify options with your carrier).
Protect the email account first. It’s the “master key” for resetting everything else.

Watch out for infostealers

Infostealer malware grabs saved passwords and session cookies. A stolen session cookie can let an attacker skip MFA entirely because the site thinks they’re already logged in.
- Don’t install cracked software, game cheats, or “free” versions of paid tools. These are common infostealer delivery methods.
- If a device is infected: reinstall or reset it, then change passwords and sign out of all sessions from a clean device.

Credit freezes (US)

Freezing your credit at the three major bureaus (Equifax, Experian, TransUnion) prevents new accounts from being opened in your name. It’s free and you can temporarily lift it when you need to apply for credit.

Removing Old Accounts

Forgotten accounts are exposure you get nothing in return for.
1. Find them using the steps in 9.1-auditing-your-personal-footprint.md (inbox searches, password manager lists, username tools).
2. Download your data first if you want to keep anything.
3. Delete, don’t just deactivate. Deactivation often leaves your profile recoverable and your data on the service.
4. Use directories of deletion links (for example, JustDeleteMe) to find each site’s deletion page and how difficult it is.
5. If you can’t delete: remove your real name and photo, change the email to an alias, delete posts, and set a strong unique password.
6. Clean up search results: once a page is gone or changed, Google may still show the old version for a while. Google offers a way to request a refresh of outdated content (verify the current tool name before class).

Google “Results about you”

Google’s Results about you tool helps you find and request removal of Google Search results that contain your personal contact information.

What it covers: results showing your phone number, home address, or email address. In February 2026, Google expanded it to government-issued ID numbers (driver’s license, passport, Social Security number) and made it easier to request removal of non-consensual explicit images.
Monitoring: once you set it up, it can alert you when new results with your information appear.
How to access it: in the Google app, tap your profile photo → Results about you, or go to goo.gle/resultsaboutyou. On a result, the three-dot menu shows whether it’s eligible for removal and lets you submit a request.
Limits: it removes results from Google Search only. The information stays on the original website. You still need to contact the site (or opt out of the data broker) to remove the source.
Google has a separate policy for removing other private information and doxxing content (see the Google Search Help link in References).

Also note: Google’s separate Dark Web Report was discontinued in February 2026. Use Have I Been Pwned or your password manager’s breach alerts instead.

Special Situations

If a student is dealing with stalking, domestic abuse, or targeted harassment, general privacy tips aren’t enough:
- Home address and real-time location are the top priority.
- Many US states run address confidentiality programs that provide a substitute address for public records (verify availability by state).
- Point them to campus resources, local advocacy organizations, and law enforcement as appropriate.

Key Terms

Compartmentalization: keeping different identities or parts of your life separate so they can’t be easily linked.
Email alias: a forwarding address that hides your real email address.
Credential stuffing: trying leaked username/password pairs on other websites.
MFA (multi-factor authentication): requiring more than a password to log in.
Passkey: a phishing-resistant login credential stored on your device that replaces a password.
SIM swapping: tricking a mobile carrier into moving your phone number to an attacker’s SIM card.
Session cookie: a token that keeps you logged in; stealing it can bypass MFA.
Credit freeze: a block that prevents new credit accounts from being opened in your name.

Key Takeaways

Minimize, compartmentalize, harden.
Run each platform’s privacy checkup; “Limit past posts” and private accounts go a long way.
Turn off camera location tags and post after you leave.
Check photo backgrounds: badges, keys, screens, mail, house numbers.
Different usernames and email aliases break the pivot chain.
Fake security question answers + password manager + passkeys make leaks far less useful.
Delete old accounts; use Google “Results about you” to remove contact info from Search (but the source site still has it).

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.