site banner

Small-Scale Question Sunday for August 11, 2024

Do you have a dumb question that you're kind of embarrassed to ask in the main thread? Is there something you're just not sure about?

This is your opportunity to ask questions. No question too simple or too silly.

Culture war topics are accepted, and proposals for a better intro post are appreciated.

3
Jump in the discussion.

No email address required.

How much should I care about being-opaque-to-casual-inspection level "opsec", given that I don't really care about actually being unidentifiable?

So I have this username on TheMotte. I have another that I use elsewhere. The other one is extremely easy to connect to my real life identity, to the point that I treat it like posting under my real name. I don't have the sort of spicy opinions that would make me a serious target for cancellation, but there's some stuff I've posted here that would probably have some social repercussions if people IRL knew that I'd written it. This is largely why I picked a fresh username here in the first place.

I'm under no illusions that it's impossible to get [dovetailing] -> [real identity] with some sleuthing. (I'm curious how hard it is, but there's no way it's even close to impossible.) What I'm a bit more concerned about is getting from a casual search of [real identity] to [dovetailing]. This has led me to divide up my posts across various places, and not cross-post links here to things I've written elsewhere, or share the same writing in multiple places. However, it strikes me that this may be an incorrect amount of paranoia -- not nearly enough to hinder the [dovetailing] -> [real identity] pathway for a serious inquirer, but more than makes sense if all I care about is someone I know personally, or a (potential) employer, casually searching my real name or my other username and getting my posts here.

So... what do you all think?

I have decided to assume that anything I say could be connected to my real identity if someone was sufficiently motivated. The result of this is not that I hide spicy opinions, but that I try to only say things that I'm willing to stand by. My life is structured in a way that I think I'm not really cancellable, or at least not for just one malicious actor.

Part of this is just that I kind of doubt I'm competent enough to do opsec that's worth a damn anyway.

Yeah, I don't say anything online that I wouldn't be willing to own. But I've been (slightly) concerned with two possible scenarios:

  1. I'm applying for a job in the future, employer searches [my other username], turns up that I've been willing to state non-current-year-PC opinions about homosexuality/trans/abortion/etc., and that acts as a marginal push away from them actually hiring me. (Argument that this shouldn't matter: I'm not likely to be desperate and if an employer can't tolerate that, then I probably don't want to work for them anyway.)
  2. I share something I wrote under [my other username] with some people I know in real life (mostly social conservatives), they decide to google [my other username] and find some personal or 'icky' stuff I've written about here, like about my past personal experiences with autogynephilia and related things, or my book review of Men Trapped in Men's Bodies, or something like that, and then there is social weirdness because they now think I'm a pervert or something. (Argument that this shouldn't matter: how likely are people to search like that anyway? As long as I don't literally link to my writing at TheMotte from something I post under [my other username], how likely are they to turn up the stuff here even if they do google me? And for that matter how likely is someone seeing what I've written likely to make things weird? I have no idea about any of these.)

I'm applying for a job in the future, employer searches [my other username]

How would employers know any of your usernames in the first place?

How much should I care about being-opaque-to-casual-inspection level "opsec", given that I don't really care about actually being unidentifiable?

In 2024, you should always care about opsec.

Why in particular do you think so? What are the risks that caring about personal opsec mitigates, how big are they, and how significant is the mitigation?

The risk I'm most concerned with is a phishing campaign against me, personally, specifically. Their end goal would be identity theft and causing financial damage.

Those tailor-made campaigns are much, much easier if you have a large online presence. And if done well, they are extremely difficult to defend against.

A related topic that I often think about:

By a quirk of fate, I share the name, both first and last, of a famous professional athlete. I wonder how much opsec that gives me, if any. Imagine someone called "Thomas Brady" - I'm sure there are hundreds of them. But if you Googled "Thomas Brady, Atlanta, Georgia," would you just get all the times Tom Brady did something in Atlanta?

So I've benefited from this. I have a relatively common name, and also a significant amount of discoverability on search engines using the correct search terms, but the ways most people search they instead catch one of the several people with wikipedia entries who have the same name.

I've had dates report this to me (women doing the usual stalking to figure out if someone is a creep), so I suspect you may be protected in the same way.

I have basically no opsec. I'm using this username pretty much everywhere, and it's connected to my real name on e.g. GitHub and Twitter. If one searches for that on YouTube you'll get my real face/voice etc. from talks I've made.

Since I'm Swedish – which has many government databases viewable by the public – a whole lot of stuff about me is also easily googleable, like where I live, what companies I have a position in, all the court cases I've been involved in (none, thankfully), and my tax return and thus how much money I make (though that last one is slightly more complicated as you need to send an email to the tax agency and not just google me).

So far nothing bad has happened, though my political opinions are fairly normie liberal (in the Euro sense, so e.g. free markets) so I'm not too worried about cancellation. Knock on wood.

Edit: Okay, one kinda annoying thing about it is that my surname is pretty jewish, so when my programming stuff gets discussed on e.g. 4chan people will google me and comment on it (or use those triple parentheses etc)

I think it's good general opsec to change handles over the medium to long term (6 months to 2+years depending on your risk tolerance). It's not just about posting spicy opinions, but the fact that the internet is forever and you don't know what advances in technology (AI scraping), the social landscape (authoritarians getting into power), and even your personal views and desire for privacy changing in the future. Swapping handles and being reasonably careful about dropping too much identifying information is just a good practice to get into and well worth the 5% of the time you'd like to share something but can't because it might let people/AI connect the dots.

My handle here is too similar to one I used on another forum, but I've since used a tool to overwrite past comments to cover my tracks. Even so I also wonder if I'm not being paranoid enough.