NWA-PCUG Newsletter Article, December 2012
Real-World Warnings Keep You Safe Online
By Authors: Mindi McDowell and Matt Lytle

Tip (ST05-014)
US-CERT
US Computer Emergency Response Team
http://www.us-cert.gov

http://www.articlesbyleo.org
http://www.ask-leo.com

Many of the warning phrases you probably heard from your parents and teachers are also applicable to using computers and the internet.

Why are these warnings important?
Like the real world, technology and the internet present dangers as well as benefits. Equipment fails, attackers may target you, and mistakes and poor judgment happen. Just as you take precautions to protect yourself in the real world, you need to take precautions to protect yourself online. For many users, computers and the internet are unfamiliar and intimidating, so it is appropriate to approach them the same way we urge children to approach the real world.

What are some warnings to remember?
* Don't trust candy from strangers - Finding something on the internet does not guarantee that it is true. Anyone can publish information online, so before accepting a statement as fact or taking action, verify that the source is reliable. It is also easy for attackers to "spoof" email addresses, so verify that an email is legitimate before opening an unexpected email attachment or responding to a request for personal information (see Using Caution with Email Attachments http://www.us-cert.gov/cas/tips/ST04-010.html and Avoiding Social Engineering and Phishing Attacks http://www.us-cert.gov/cas/tips/ST04-014.html) for more information.
* If it sounds too good to be true, it probably is - You have probably seen many emails promising fantastic rewards or monetary gifts. However, regardless of what the email claims, there are not any wealthy strangers desperate to send you money. Beware of grand promises—they are most likely spam, hoaxes, or phishing schemes (see Reducing Spam http://www.us-cert.gov/cas/tips/ST04-007.html, Identifying Hoaxes and Urban Legends http://www.us-cert.gov/cas/tips/ST04-009.html, and Avoiding Social Engineering and Phishing Attacks http://www.us-cert.gov/cas/tips/ST04-014.html for more information). Also be wary of pop-up windows and advertisements for free downloadable software—they may be disguising spyware (see Recognizing and Avoiding Spyware http://www.us-cert.gov/cas/tips/ST04-016.html for more information).
* Don't advertise that you are away from home - Some email accounts, especially within an organization, offer a feature (called an autoresponder) that allows you to create an "away" message if you are going to be away from your email for an extended period of time. The message is automatically sent to anyone who emails you while the autoresponder is enabled. While this is a helpful feature for letting your contacts know that you will not be able to respond right away, be careful how you phrase your message. You do not want to let potential attackers know that you are not home, or, worse, give specific details about your location and itinerary. Safer options include phrases such as "I will not have access to email between [date] and [date]." If possible, also restrict the recipients of the message to people within your organization or in your address book. If your away message replies to spam, it only confirms that your email account is active. This may increase the amount of spam you receive (see Reducing Spam http://www.us-cert.gov/cas/tips/ST04-007.html for more information).
* Lock up your valuables - If an attacker is able to access your personal data, he or she may be able to compromise or steal the information. Take steps to protect this information by following good security practices (see the Tips index page http://www.us-cert.gov/cas/tips/ for a list of relevant documents). Some of the most basic precautions include locking your computer when you step away; using firewalls, anti-virus software, and strong passwords; installing appropriate software updates; and taking precautions when browsing or using email.
* Have a backup plan - Since your information could be lost or compromised (due to an equipment malfunction, an error, or an attack), make regular backups of your information so that you still have clean, complete copies (see Good Security Habits http://www.us-cert.gov/cas/tips/ST04-003.html for more information). Backups also help you identify what has been changed or lost. If your computer has been infected, it is important to remove the infection before resuming your work (see Recovering from Viruses, Worms, and Trojan Horses http://www.us-cert.gov/cas/tips/ST05-006.html for more information). Keep in mind that if you did not realize that your computer was infected, your backups may also be compromised.

Do you wish you could erase yourself from the internet? In other words, do you want to stop your name and information from showing up when people Google or search for you on the internet? Sadly, you’re not alone.

Not only is this disappointingly complex to do, ultimately… you can’t.

What it boils down to is understanding how little control you have, what steps you can try, and how effective they may or may not be.

But first, you should know that prevention is the only real cure.

But even then it’s not at all complete.

You need to assume that everything you place on the internet will remain there forever, and will be viewed in the worst light possible. To clarify, it may not be there forever, and may not be viewed in the worst light possible, but that’s the safest way to look at how what you say, do and post in public might be used. You do have control over some of what goes up on the web before it goes up, so exercise caution.

Still feel like posting those party photos?
How about the example we hear about all the time: someone losing a job or job offer because they spoke their mind in a public post, posted unflattering photos of themselves, or otherwise made public information about themselves that they never should have. Information that their employer or potential employer eventually found.

It happens all the time.

It happens to those who have the freedom of speech mentality: “I should be able to post and say and do whatever I want.”

Absolutely. You should be able to. Go ahead. Post and say what you like. In most countries you have the right to say pretty much whatever you like. Just remember that freedom of speech does not mean freedom from consequences.

Because chances are you’re not going to get it removed from the internet once the day comes that you decide maybe it shouldn’t be there.

Even preventing what you do and post may not be enough. What about other sources of information that relate to you?

You cannot control what others say or post about you. (Within the legal limits of harassment, libel and slander, of course, and even then within the limits of your own legal or justice system and your resources.) Been mentioned in a newspaper? Listed in publicly records? Do you participate in discussion groups that are visible and/or archived publicly?

All of these are ways you can show up online. And there are plenty more.

And more than likely, all are places from which you probably can’t remove yourself.

Still want to try? Here’s what you can do:

Your first thought may be to try to get in touch with the search engine, but here’s the fundamental problem: the search engine has nothing to do with it. Even though people may use the search engine to find the information, that information is not in the search engine itself. It’s on one of the thousands of other sites on the internet, and the search engine is merely in charge of finding it. The only way to truly remove yourself is to find each of those sites and ask them to remove the information that pertains to you.

It’s common to want to have Google remove you from their index. There are two problems: 1. They won’t. Google is a search engine, and their “job” is to report what can be found on other sites on the internet. They’re simply showing you what’s out there, but what’s out there is not in their control. 2. Google is not the only game in town. Google is perhaps the most popular, but there are literally thousands of search engines on the internet. From Bing to Yahoo, to many medium and smaller niche search engines, there are more search engines than you could ever count. Even if you could get Google to remove you from their results, which you cannot, you’d still be faced with all those other search engines that might also be returning the same results that show your information on the internet.

Look out for a growing service area called “reputation management.” These services will promise to remove you from the search results. They can’t. If they tell you that they can, they’re wrong. The information cannot been removed. The best that they can hope to accomplish is to push whatever it is you want to hide further down the results list when people use common search terms for you. At best it’s simply somewhat harder to find… which may, or may not, be valuable to you.

It would be nice to think that you have control over the information that is placed on sites and services that you control on the web. But you don’t. This is another way that this issue gets so complicated.

You might think that if you wanted to remove something about yourself that’s been posted on your own website, all you need to do is exactly that – remove it. Problem solved.

Not so fast.

The “problem” is that there are other sites that take copies of the pages on your site and preserve them as a kind of historical record. Archive.org is a good example, but in fact there could once again be any number of sites archiving or duplicating information- and many of them are doing it illegally. You can certainly remove the information from your site, but you have no control over what these other sites do with the information that they’ve already captured and made publicly accessible.

So what can you do?
* Well, you can use the search engines yourself to see where all the information about you is, and then contact all of those sites (not the search engines) and ask them to remove it.
* You can use a reputation management service to try and “bury” your information, making it harder, but not impossible to find. If that’s enough for you.

And that’s about it. Once something is on the internet, you can pretty much plan on it being there for good.

In fact, it might be easier to change you: move, change your name, change all of your identifying information, and then make sure that as little of that new you as possible gets on the internet.

But even then, you’ll probably show up somewhere.

Click here to return to top



==================================================================