I thought I was careful. I use a password manager. I have 2FA on everything. I do not post my address. I do not do those Facebook quizzes that tell you which kind of bread you are and then steal your identity.
I am not careful. None of us are. We are just confident.
So I set a timer for 20 minutes. No special tools. No dark web logins. No shady people search sites that want $19.99 to tell you what you already know. Just Google, a fresh browser profile, and the rule that I could only use information that started from my name and what that information led me to.
I found my current home address in minute three. My mom's maiden name in minute nine. My dog's name, vet, and a photo of him at the park in minute fourteen. By minute twenty I had a map that would let a stranger answer my bank security questions, reset a password, and show up with a Milk-Bone and know exactly what to call him.
This is not because I am famous. It is because identity is not a single secret anymore. It is a graph. And yours is public.
Minute zero to three: you already leaked your address
I started with my name. Lusynth Oritrant. Uncommon enough that Google does not get confused. First page: my GitHub, my old portfolio from 2019 that I thought I deleted, and a county assessor site.
The county assessor site is my favorite kind of horror. You type a name into a boring government website with a design from 2004 and it gives you parcel number, purchase date, sale price, square footage, and mailing address. All public record. All indexed by Google because counties love SEO for some reason.
I did not need to log in. I did not need to pay. I clicked images and there was the front of my house from the last tax assessment. The same house I was sitting in while I was Googling myself.
If you rent, you think you are safe. You are not. I searched my name plus my city and got a data broker page that listed my current address, two previous addresses, and three people associated with those addresses. One of them was my roommate from two apartments ago. The data broker scraped it from a utility record and a voter registration roll. It was wrong about my middle initial but right about where I live.
Most people stop here and think, okay, address is out there. Whatever. But address is a key. Address unlocks everything else. Your address connects to your property records, your voter file, your Amazon wish list if you ever shipped to your own name, your home Wi-Fi name in Wigle if you ever left your router on default.
I wrote down address on a sticky note. That was node one.
Minute three to nine: your family is a public API
How did I get my mom's maiden name. I did not know it off the top of my head for a second. Then I remembered I posted it.
In 2017 I posted a graduation photo on Facebook. Caption: "Thanks to my amazing mom [First Name] [Maiden Name] [Married Name] for everything." I tagged her. Her profile lists her maiden name because her generation actually fills out Facebook profiles. Her friends list is public. Her brother's obituary is public and lists all the family members by name including my mom with both names, plus my name.
Obituaries are OSINT gold and nobody thinks about them. They list mother, father, siblings, children, grandchildren, where they lived, what church they went to. They are meant to be public and respectful and they are incredibly efficient at linking family graphs.
I also found it via Ancestry. Someone in my extended family made a public family tree. It had my mom, her parents, her maiden name, my grandmother's maiden name, birth years, death years. It had a photo of my great-grandparents that I had never seen. It is sweet. It is also exactly what a bank asks for when you click "forgot password."
I did not need to hack Ancestry. Google indexed the tree because the creator left it public. I clicked view, and there it was.
You think security questions are private. They are not. They are trivia about a family that loves to overshare at reunions. What was your first pet. What street did you grow up on. What is your mother's maiden name. All of that is answerable from public posts, especially if your mom is on Facebook.
Minute nine to fourteen: the dog
This is my favorite part because it is so stupid and so human.
I found my dog because I love my dog. I post my dog. Everyone posts their dog. My Instagram, even though it is mostly code and boards, has three photos of him. One of them tags the dog park. One of them tags the vet because I was grateful they stayed late.
The vet's Instagram reposted my story and tagged me. Their post says "Thanks to Lusynth and [Dog's Name] for being such good patients!" Now a stranger knows my dog's name.
Why does that matter. Because your dog's name is a password. It is a security answer. It is how someone pretends to know you. Imagine a DM: "Hey, is this Lusynth, [Dog's Name]'s mom from [Dog Park Name]? I think I found his collar." You would answer. I would answer. We would answer because we love our dogs more than we love opsec.
From the dog park tag, I found a geotagged photo from another person at the same park on the same day. Their photo has my dog in the background. Their caption lists the time. Now you have my routine. Saturday mornings, around 9am, at that park.
I did not need a Ring camera. I needed a hashtag.
Minute fourteen to twenty: the rest of the graph
Once you have address, family, and pet, the rest is just connecting edges.
My old breached email from 2019 showed up on HaveIBeenPwned. That breach had my old password that I reused on a forum in 2016. That forum profile listed my birthday. My birthday plus my name got me a voter record with full DOB, party affiliation, and precinct.
My GitHub commits from 2020 had my personal email in the git config. That email was used on a Strava account. Strava had a public run that started and ended at my house. The map literally drew a line from my front door around the block and back. I had set it to private last year, but the old one was still public because I forgot.
My Amazon wish list was public until last year. It had a baby shower gift for a friend shipped to my address with my full name. My Venmo was public until I changed it. You could see who I paid for pizza and who paid me for rent.
None of this required skill. It required clicking. This is what 20 minutes looks like when you are not even trying. If I gave myself two hours and $5 for a data broker report, I could build a full identity package: full name, DOB, address history, phone numbers, relatives, emails, usernames, employer, salary range estimate, and enough security answers to get through most call centers.
And I am a developer who thinks about this stuff. Imagine what is out there for someone who has had Facebook since 2008 and has never touched a privacy setting.
The problem is not that you posted. The problem is you never mapped it.
We treat privacy like hiding. Do not post your address. Do not post your birthday. Do not post your dog. That advice is useless because privacy is not about one secret post. It is about the graph you create over ten years without realizing it.
Your identity is not a password you can change. It is a set of nodes: names, addresses, emails, phones, family members, pets, jobs, places you go, things you buy. And edges: your mom is connected to you, your dog is connected to your vet, your address is connected to your voter file, your GitHub email is connected to your Strava.
Companies map this graph every day to sell you things. Attackers map it to scam you. You have never mapped it for yourself.
That is what I finally did after my 20 minutes of mild existential dread. I stopped trying to delete myself, which is impossible, and started trying to map myself.
I made a simple canvas. In the middle, me. Around me, categories: Legal Identity, Homes, Family, Work, Accounts, Purchases, Locations, Pets and Personal. Every time I found something connected to me, I added it as a node and drew a line showing how I found it. County site to address. Address to Amazon. Obituary to mom's maiden name. Vet tag to dog.
After an hour, it was a mess. After two hours, it was a map. And a map is actionable. You can see which nodes are bridges. My old portfolio site was a bridge that connected my name to my personal email to my GitHub to my Strava to my house. One old site. Take that down, or at least remove the email, and four edges disappear.
You can see which security questions are burned. My mom's maiden name is burned. My first pet is burned. My dog's name is burned. So I stopped using them anywhere. I changed my security questions to random strings in my password manager.
You can see which data brokers have you and which ones actually respect opt-outs. You can see that your voter record is public and you cannot delete it, but you can change your threat model around it.
This is the entire idea behind my second guide, PERSONAL ATTACK SURFACE: Map Everything Connected to Your Identity.
It is not a guide about how to disappear. If you live in the US, you cannot disappear without moving to the woods and even then the woods have property records. It is a field manual for how to build your own identity graph, just like I did in that 20 minutes, but properly.
It gives you the categories to check, the public records that actually matter, the breach sources to search for yourself, the social media traps that leak routine, the way to document it so you can see the bridges, and the prioritized list of what to fix first that actually reduces risk instead of just making you feel paranoid.
It includes templates for the map, checklists for opt-outs that work, and scripts for what to say when a call center asks for your mother's maiden name and you know that answer is public.
I found my home address, my mom's maiden name, and my dog in 20 minutes with Google. A scammer with motivation and a full afternoon would find more.
Map it before someone else does.
Top comments (0)