Ask HN: How can I prevent myself from being doxxed?

What I do for things like Reddit and HN, is that I create a new account every few months to make it harder for them... and of course I try not to post information that could personally identify me. As a bonus, you almost stop caring about karma points ;) But of course the provider could still doxx you unless you take some additional steps to stay anonymous (like Tor, maybe).

Start new accounts with no reference to your old ones, your name or your location. Be careful about what you put online publicly. I think most people would be horrified at what the likes of Facebook, amazon or google knows about them.

Create many accounts similar to your current ones or buy existing accounts with activity and change their information to be similar to yours. Muddy the water enough that anyone googling your real name can never guess you and misdirect people into clicking unsafe content.

You will leave traces of information no matter how hard you try if you spend enough time on any site.

Btw, did you know that even if you ask dang to rename your account - people can easily find you by searching on hn.algolia.com because they don't auto update indexes on renames?

Same for many other sites. There are many indexes and archives that never update old data and won't care about GDPR requests.

One approach is to simply not care if you are doxxed. What would really happen if someone figured out who you are? If the answer is not much, maybe don’t worry about it. This approach makes less sense if you are saying things that will get you in hot water.

Easy, just dox yourself first.

It depends on what you mean by being 'doxxed'. It is trivially easy to find out what city I live in and a few other non-identifying details. It's harder to pinpoint my real name or address without the active cooperation of website owners (and maybe not even then).

Miniscule levels of risk are not worth worrying about, unless you are a figure in the public spotlight or likely to be a person of interest to police or intelligence orgs, in which case you should probably seek advice specific to your situation.

If you are just worried about someone trying to steal your identity to abuse your credit or so, you probably already practice good basic security (like 2-factor authentication, not recycling your passwords etc. etc.) and have no particular need to worry about. You are more likely to have your security compromised in a corporate data breach than someone taking the time to dox you.

If you get in fights online or are a member of some group that frequently experiences abuse (from inside or outside your community) then you should consider rebuilding your social media identities, giving up some of them, compartmentalizing your digital life so that your work or business don't overlap with your friendships or public persona etc.

If things have gone sideways and you think people are already motivated to go after you, a determined person can pull your details together very quickly with a mixture of software tools, access to commercial databases, and some detective work. It's not difficult for someone with experience. In such a situation you should probably work with a commercial service like https://privacyduck.com which will do the work of erasing your digital footprints.

It's not cheap, last time I looked they charged $600/year or so and depending on your circumstances and vulnerability that might need to be budgeted as an ongoing expense. I'm sure there are other competitors int he same field but am not sufficiently informed to make comparisons.

This is an interesting question. Given your admission that your identity is loosely linked to your online accounts, I don't think it's possible to prevent someone from doxxing you-- someone just needs to tie it all together.

I agree with sibling comments here that the only way to really prevent someone from identifying you from your online personas would be to start over. If you want to truly be anonymous, you need to build these new personas with OPSEC in mind. The process includes 5 general steps:

1. Identify information you feel is critical. In your case, this could be anything that ties your online activity to your real life identity.

2. Identify your threat. This can be simple or complex depending on your needs. Are you concerned about hiding from pissed off gamers, hacktivists, or a nation state? Knowing the enemy you face will help you better understand their potential capabilities to find out information about you and how they could use this information.

3. Assess your vulnerabilities. Look at yourself from the viewpoint of the attacker. What information would you use to dox yourself?

4. Assess your risk. This can also be pretty involved depending on your vulnerabilities and threats. What could someone do with this information? How bad could you be hurt?

5. Apply countermeasures. Figure out how you can mitigate the risk you found above. This may include closing old accounts, creating new accounts, creating alternate personas, disinformation, heading off potential impact from a dox, etc.

Hope my ramblings helped.

What is your threat model? Whom you are hiding from and what will happen when the info leaks?

If you are the generally paranoid though, never publish photos from around your home, never make online purchases with home delivery, but choose midpoints like post stations to collect them.

Assume that if you type your info somewhere, it would be sold and will pop up somewhere. Currently my name, home address, and phone are published in a american data broker website. If I want them removed, I need to send them an id with even more personal data and even then they insist that it will be hidden from public view, not deleted. I need a lawyer if I want the situation delt with properly.

If it can happen, it most likely will happen if someone really wanted to (ie by doing phising attacks, looking up public records, hiring private investigators, etc), so the best thing to do is to think about what can be done to minimize any collateral damage after the fact (ie protecting your image, securing online accounts, keeping your home safe, etc), since any sensitive information (ie confidential or embarrassing) they can acquire can be used to blackmail. It's pretty hard to remain anonymous online for a long time given how everything is connected and archived on the internet these days.

The easiest way is to be insignificant. But it's still no guarantee.

1) Promptly stop saying anything interesting under your real name. Opt out of all social media except to post messages like "Congratulations on the baby!". This will prevent you from making any enemies who know your real name, and reduce the chances anyone will want to doxx you.

2) Start adopting new pseudonyms. Use a different one on every site, and a password keeper to help you stay logged in. If you happen to forget, don't worry. Treat every account as disposable. These are not "you". This is not "your brand". These are merely tools that allow to into a walled garden party wearing the mask of anonymity.

3) Do not mix your two online personas. Keep your politics, jokes, and personality in your pseudononymous accounts. Keep your boring safe opinions and pictures of dogs in your primary account. Don't talk about anything in your real life in your pseudonymous accounts, even the weather. Reserve that kind of discussion for in-person friends only. If you make a mistake, just delete the account and make a new one.

"You can google me and find my social media account"

Why can i do this? Sounds like you know the problem already and want a push ;)

A lot of people I know have, no photo of their face, and not their real full name, and goes without saying totally private. Use Facebooks feature to check you have no accidental public ones.

Using photos people have taken from their house, I've found the location and unit numbers before. So all these need to be private if you are really worried.

Wives/husbands/family are good attack vectors. Not much you can do here to begin with. But you want things locked down to at least friends of friends.

I shouldn't be able to easily escalate from necessary public profiles to private ones.

But it's all about working towards the goal. Just make a start. Every little bit reduces the chance you'll get doxxed. You might just have to be the stronger gazelle.

Maybe privacy is dead, maybe it's about having a job you can't be fired from or a gun in the house? Some peoples incomes depend on the public profiles.

If you’re trying to prevent an online persona from being tied to your real identity, then you just have to be incredibly paranoid about anonymity. It’s not enough to hide your name, you have to consider hiding anything that makes you identifiable. If I knew somebody was a software engineer, well I wouldn’t know how to find out who they were. If I knew they were a software engineer from Arkansas who contributed to Rust projects, all of a sudden my search would have been narrowed down significantly.

If you want to prevent somebody who knows your identity from finding your phone number, address, etc... good luck. Whether somebody can find that would pretty much boil down to how much effort they’re willing to invest.

Source: I used to do some of these sorts of OSINT investigations as part of a fraud investigations team.

Its almost worth changing your name if you have an unusual one. It must be great to be have a name like John Smith because no one can google you to find anything interesting.

Google your full name (and any variations, Edward -> Ed, etc) and remove yourself from these whitepage direcetory type websites that people can look up your past/current residences

do your family a favor and remove them too

Read everything ever written by thegrugq and apply it.

Effectively you've already doxxed yourself. The ability to associate a real name with an address without excessive effort predates the internet and these days it is even easier, so with the internet the only winning move is not to play. Stop using your real name, period. Creating fame and an online persona that can pay your bills is directly at odds with maintaining privacy.

I’d say, vote.

Extreme Privacy: What It Takes to Disappear by Michael Bazzell

https://www.amazon.com/dp/B0898YGR58

This guy sells books on both sides, OSINT and privacy.

Brian Krebs (krebsonsecurity.com) has a lot of fascinating stories on his blog on doxxing and revealing identities of people for whom remaining anonymous was vital (spoiler alert: they couldn't).

Keeping totally separate identities across different services is key (using unrelated usernames, avatars, emails for every service). It’s also extremely difficult and unpractical to pull off.

In most doxxing cases perpetrators manage to get access to a single service and use it as a foothold to penetrate to other services. For example, someone learns your email from a forum, somehow hacks your email, gains access to Dropbox and finds the scan of your passport, driver's licence and social security card. Email in general is the key one's digital kingdom so the surest way to minimize the blast radius is to keep everything separate and unrelated.

Edit: typos

At the most basic level, don't say anything online you wouldn't want seen again. Not in discord, not on twitter, nowhere. Always treat anything you disclose online as if it's public knowledge from that point on. Even if you delete it, there's a tonne of third parties that archive data you post, even on more "ephemeral" services.

It seems to me that the whole threat of being doxxed relies on two things: (1) that you’ve done something in one sphere of life that would be reprehensible (and maybe actionable) to another sphere of life, and (2) that the unholy Russian Twitter not mob can influence that other sphere of life.

It may not be possible to have different spheres of life cohabitate peacefully, especially if the doxxing involves shining light on old character flaws you’ve since remedied, but thanks to the digital world we live in, can be easily surfaced. I’d say “get off social media forever” to at least prevent your self 20 years in the future having this same worry about whatever it is you are innocently sharing this month, but that always seems to draw a gasp from people who apparently can’t imagine life without the internet.

Seems to me that everyone who has ever been doxxed is doing “something” that draws attention to them. That doesn’t make it right, but I haven’t heard of doxxing of any quiet Amish families, or guys building cabins in the woods minding their own business.

It’s usually some loudmouth on some open source software forum, or some politician’s operative, or someone being a potential whistleblower.

What you are asking is, in essence, how can I keep from getting punched in the mouth? It’s not too difficult, if you think about it. Someone randomly punching you in the mouth “for no reason” is about as statistically probable as being struck my lightning twice in the same week.

Some people attack punches more than others. I’m not saying it’s right, or even deserved. Just that there are life choices that can increase the odds.

Maybe what you’re really asking is how can I avoid the risks of some life choices I am making or want to make?

All the advice here will only partially mitigate the risk. The only real way to eliminate it would be to make different choices to stop unwanted attraction.

I somewhat laughed at all the “privacy” tips here. My friend, if you tick off the wrong person, they will find you or hire someone good to do it for them. And if doxxing is their chosen revenge, you can’t choose to then decide to be a quiet mild-mannered ordinary citizen when you already opened your mouth and drew attention to yourself.

I’m sure everyone who flips someone off across the street wishes the same when they see the scrawny guy reach into his jacket and pull out a gun.

Find the courage to post under your real identity. Society can’t cancel everyone. In my experience whatever political activism you’re engaging in (you mentioned as much in a sibling comment) will benefit far more from association with a real humans than with “internet commenters”. Politics happen in the real world, the internet is not representative in that respect. There are very few things that require true anonymity, and in a liberalist society political speech is not and should not be one of them, despite trends of late. The only effective response is to fight back and speak up for what you believe is right. Don’t be a coward. I mean this in the most sincere way possible.

Don't use your real name online. I don't have any complicated privacy best practices, I'm just not on social media and don't use my real name online if I can at all help it.

Edit: Sounds like it's too late for you, but don't be an activist online using your real name unless you have some real, physical security.