How to Dox Yourself

中文 | বাংলা | العربية | Français | Русский

Photo: Pixabay

Editor’s Note: If you’re like most people, there are bits of information about you scattered around the internet. These breadcrumbs can be used to “dox” journalists — that’s when malicious actors track down and share private information, including phone numbers and home addresses. At the recent NICAR 2019 conference, New York Times security experts Kristen Kozinski and Neena Kapur shared the following tip sheet outlining how to dox yourself and safeguard your information before someone else can make trouble for you.

Search Engines

Google and Bing Search Operators

Bing Search Operators

Google Alerts

Once you’re signed in to your Google account, you can set up Google Alerts here.

Tip: We recommend you use Google alerts with your personal Gmail account. This way, if you leave your company you still have the alerts.

Tip: Please note that any alerts you set up are saved in your Google account — while we recommend setting up alerts for information such as your phone number or physical address, we do not recommend setting up alerts for particularly sensitive information, such as your Social Security number.

Public Record/People Aggregator

There are hundreds of people aggregator sites out there — many large sites “feed” smaller sites, making them a good starting point for significantly decreasing your online footprint. Below is a short list of sites that we recommend starting with. (Note that these sites tend to apply to people who are currently US-based or have previously lived in the United States.) Once you’ve tackled those sites, within a few weeks, the amount of your personal data across people aggregator sites will significantly decrease.

See if you can find profiles of yourself on these sites and consider taking steps to opt out. Please note that some of these sites will request you provide some personal data to opt out, such as an email address, phone number and address. Here are some tips for this:

●  Create a separate, “burner” email address to use for opting out. If you already have one, just use that.

●  Set up a virtual phone number, like Google Voice or Sudo.

●  Only provide sites with data they already have about you. If you see that they have an old home address, do not provide them with a current address, just provide them with the address they already have listed for verification.

●  Don’t EVER provide a copy of any documents, such as driver’s license or passport.

If you’d like to go further, take a look at IntelTechniques’ complete list of people aggregator sites with associated opt-out steps — but please note that The New York Times has not fully vetted all of these sites.

Social Media

Identify your social media accounts.

●  Enter your commonly used handles into NameCheckr to see where that handle is being used. This can help you discover old accounts you may have set up, as well as keep an eye for impersonation accounts.

●  Set up two-factor authentication on your social media sites. Check out Two Factor Auth for instructions on how to set up two-factor authentication for popular websites. We recommend using an authenticator application (aka a mobile security app or software token) rather than SMS text messages as your second form of authentication. This is a more secure method and prevents from attacks such as SIM hijacking.