You Are the Product- Part 1: Data

This is the first part of a series designed to discuss security topics and the techniques you can use to protect yourself from being exploited.

This has been touched upon before by many in the TRP community; however, the extent of the raw data being collected on you in order to sell you to advertisers and their ilk (including governments) has never been as widespread, invasive, or extensive in our history. It will only continue to get worse as we progress technologically. Taking small, perhaps even necessary, precautions can mean a world of difference down the road.

It's not necessarily a matter of preventing your data from being leaked or compromised, it's how much of it is there when it happens, and how they can identify you.

The Depth of Data

Google, Facebook, Microsoft, Apple, Tinder, Instagram, Snapchat- pick a popular application, chances are they are collecting data about you and from you on a minute-by-minute basis every single day. To the sheep, this means nothing. It is a matter of convenience. So they know where I like to shop, what restaurants I frequent, and who my friends likely are. They say it's all anonymized anyway. . . as if.

They know when I make phone calls, when I go to the doctor, where I sleep, where I drive, how fast I drive, when I pay my bills, who I spend my time with by association, and probably even know what my favorite grocery store is. All of this is tied to an identification code, something they use to "anonymize" you, though the depth and spread of the data makes it anything but. With a week's worth of data, identifying who you are can be quite trivial- and in a world where personal privacy can mean the difference between being able to sleep soundly at night, and being persecuted, imprisoned, or perhaps even murdered for your beliefs, limiting the data collected and segregating it can be essential.

Don't believe it?

Check out: Your Google Dashboard

For you Apple users, check out this article and see how Apple makes you jump through hoops just to see what they have on you.

Facebook? Look Here

Amazon? Well, its mostly just your shopping history... or is it?

Twitter? Just wow.

Instagram? Snapchat? Tinder? Pick your media nightmare.

Think WhatsApp was safe? (This was two days ago, too bad the owner sold out for $22 Billion)

The sheer quantity of data that is collected on you is thorough and exhaustive. If there was anything that would encourage you to go out into the real world and experience it first hand, no digital equipment attached, it's that monstrous amount of data that you generate for companies who make it their very mission to know every last thing about you.

Correlative Inference

The amount of data generated allows companies to make inferences about you that you might not have known were possible. Retailers like Wal-Mart, Target, Amazon (and places like Whole Foods and Woot!), grocery chains like Kroger- they all use this data to know exactly what is going on, and the likelihood that you may fit a particular demographic based upon the things that you buy in their stores.

This is one famous example of correlative inference.

Here's two with Facebook: "The Outed Prostitute" and "Facebook Knows Your Secrets"

In information security, correlative inference allows people to learn things that are confidential or sensitive, by putting together multiple pieces of less sensitive, or even publicly available, information. For example, three separate reports containing sensitive information, useless on their own, but when correlated, could reveal privileged information. One report contains a list of employee salaries the day they started. Another contains a list of employee names and start dates. And yet another contains a detailed list of positions and starting salaries. Think you could identify everyone, what their jobs were, and how much they made? I bet you could.

Companies that collect all of this information can do the exact same thing to you.

Surprising Ways Your Information Can Be Correlated

Anyone here have separate accounts on different platforms for different reasons? How many ways do you think the security of your identities can be compromised? Take Reddit for example; I am certain quite a few of us have multiple Reddit accounts. I know I do. How many of you use the Reddit phone application? Most if not all of you probably do. What if I told you that Reddit can easily correlate the accounts, even if you used a VPN on your phone like a religious fanatic?

Forget post scrapers, just take a look at your phone.

OAuth is a protocol that allows for seemingly-seamless authentication to services like Reddit. It's easy, convenient, and helpful. What you didn't know, is that phone applications (confirmed on Android, I don't use iPhones), can store credential tokens that are only accessible to them for the accounts that are used to log into the application.

If you use an Android phone (or tablet!) check out the accounts linked to your device. Open Settings and select Accounts. Right here is a list of accounts on your phone, and the associated application to which it belongs. If you've ever signed into Reddit with the phone app on different accounts, there's a good chance that you'll see both accounts listed there. What's more, is they aren't isolated. The application itself can immediately see both accounts, which means the application developers can also see it. That means that they have already identified both accounts as belonging to the same person.

Oops.

Now you know one way that they can blanket ban an individual and all of their associated accounts.

Future Topics

Additional parts will cover different ways you can segregate and protect your identity while online. If you wish for me to cover a specific topic, let me know below and I will write about it.

Tip red_philosopher for their post.