Digital Privacy Protection for the Real World

Yael Grauer talks about digital privacy protection and online safety.

A lot of advice for staying safe online sounds great on paper, but is hard to follow in practice. Between password managers, privacy settings, and data brokers, keeping yourself safe can start to feel like a full-time job. A lot of people get stuck in the gap between good security habits and what’s actually realistic. And unfortunately, most of the responsibility is on us. Real digital privacy protection requires looking at what actually matters, where your biggest risks actually are, what people often overlook, and how to take practical steps without getting overwhelmed.

See Privacy vs Reality with Yael Grauer for a complete transcript of the Easy Prey podcast episode.

Yael Grauer is a program manager for Consumer Reports working on cybersecurity research. Among other things, she works on the Security Planner, which is a free resource to help people figure out their next steps to stay safe online. Her background is in investigative reporting, covering privacy, security, digital freedom, hacking, and mass surveillance.

Getting Into Digital Privacy

Yael started her career as a freelance investigative reporter working on health and fitness topics. She started looking into digital privacy and security when she started getting concerned about her own security. As a freelance reporter, she had to write stories if she wanted to get paid. Because she was already researching security, she decided to try writing about it. She quickly found it more interesting than writing about health and liked being able to help answer specific questions.

Yael was aware of some of the issues. She knew digital privacy protection was complex. But the fact that doing what should be basic things was often so difficult was shocking. And she was also surprised to find how much of the responsibility was on individuals. And it just gets worse every day.

The fact that it’s so difficult to do what should be basic things, and … the onus is on the consumer instead of companies or governments, it’s a little disturbing.
Yael Grauer

Yael sometimes jokes the goal of Security Planner is to put it out of business. It gives you a survey to say what devices you have and what you worry about, and returns a list of things you can do to secure yourself. Sometimes people say the list is too long. And Yael doesn’t disagree. But that’s a failure of society, policy, and companies that aren’t building things that are secure by design. Hopefully someday we’ll live in a world where we don’t have a huge list of steps to keep us safe because regulations and companies are protecting us by default.

That’s a societal failure. It’s a policy failure. It’s a failure on these companies … that there are so many steps you have to take to make sure that you’re protecting yourself.
Yael Grauer

Digital Privacy Protection Paralysis

Security Planner’s most-recommended steps are a lot of the digital security and privacy protection things you’ve heard over and over. Use a password manager. Have a unique password for each account. Turn on two-factor authentication. Delete unused accounts. Keep your software updated. But with so many steps, people often get overwhelmed. This especially happens around password managers. People often have hundreds of accounts, and resetting all of those passwords and putting them into a password manager is overwhelming. Nobody wants to do that – at least not until after they’ve been compromised.

A lot of times, people don’t even want to do anything until after they’re compromised, and then they start panicking.
Yael Grauer

Security Planner tells people to prioritize based on their concerns. It includes a section for which thing to do if you only do one. The goal is to break it down and make it easier for people. But there’s so much tech in our lives that we’re responsible for. Even our routers are our responsibility. Many people get a router from their ISP, but even though the ISP provides the device and makes you pay a monthly fee to rent it, they don’t maintain the security or update the firmware.

One thing Yael likes about working with Consumer Reports is that they approach it from different angles. Yael is also on their advocacy team, telling companies to do better and governments to add regulations. It’s a long game. Consumer Reports has made a lot of great changes, and things are getting better incrementally, but Yael would love to see Security Planner go out of business.

It’s Hard to Think When You’re Panicking

Yael recently had to help someone reset an account that was locked. It should have taken five minutes, but because the woman was panicking, it took half an hour. One challenge with trying to improve your digital security and privacy protection without being a tech expert is that sometimes things look scarier than they really are. And when you’re panicking, it’s hard to think about things clearly – we’ve all been there.

People ask Yael some really wild questions sometimes. But it’s important to remember that something that showed up on a hacker website once is not necessarily happening in the wild. Most of us aren’t being specifically targeted by nation-states or well-resourced cybercriminals. When you’re looking at your risk, you have to look at what’s actually happening to real people, not what might be possible in the future or in very specific circumstances.

You have to look at what is actually happening, not what you think might be possible in a decade.
Yael Grauer

Yael once went to a survival school, and they have the concept of “What’s going to kill you first?” You might get sick from drinking water from a lake, but dehydration would kill you before the illness. Drink the water to avoid dying of dehydration and then worry about the illness later. That’s a good concept for security. What’s going to get you first? The answer is never a zero-day ten years from now.

A concept I think people should use when thinking about security is … what’s going to get you first? And it’s not the zero day in ten years.
Yael Grauer

Handle the Basics First

There are some really cool tools out there for people who are being targeted – things like Apple’s Lockdown Mode, which is very secure but makes it harder to use devices. Some people get really worried about all the stuff that’s out there and wonder if they should do these kinds of things. But it doesn’t do a lot of good to buy a super secure lock for your front door if you don’t actually close the door. Take the foundational steps first. Too many people are out there worried about nation-states targeting them but they use the same password for everything.

People also get so focused on digital privacy and security protection that they forget about the physical. If you’re worried about being stalked, what are you going to do if the stalker shows up at your door? If you have a camera, what’s your plan if you see someone on it? These are high-stress situations. You have to know what you’re going to do in advance or you’re going to panic.

It’s also important to be careful about what you share. Yael once shared information about an AirBNB with an acquaintance because the situation was interesting, and even though she didn’t share much, the acquaintance could still figure out where she was staying. Everyone has access to open-source intelligence (OSINT) tools, and they’re fairly easy to use. It may look like someone is using sophisticated tools against you, but sometimes you’ve just accidentally given out enough information for someone to use these tools.

The best thing you can do for your digital privacy protection is be careful what you share.

The biggest risks depend on the individual. But the one thing everyone should be aware of for digital privacy protection is to be careful what you share. That includes both technology-wise and what you tell other people.

Be aware of the permissions apps are asking for. Some of them make sense. Instagram needs access to your camera, and your GPS app needs access to your location. But your flashlight doesn’t need access to your microphone. If the app doesn’t need it for functionality, don’t let it have permission to access that data. Frustratingly, sometimes when apps update, their settings go back to the default, and you have to go change them again.

If you don’t need it for functionality, then you don’t give [the app] that permission.
Yael Grauer

A lot of security and privacy steps are individual. People have different things they’re concerned about, which impacts what changes they should make. Yael posts a lot of things publicly on social media. But a lot of people don’t want their information out like that. Yael knows people who don’t want their photos posted online, but other people post them because they assumed it was fine. Getting consent is a big one.

Security Planner has a page for people worried about stalkerware or spyware. Often people are concerned about compromised devices because people know things about them. But there are a lot of non-technical ways your data can spread. Yael doesn’t think everyone should have to have an extreme awareness of security and privacy things, but sometimes it seems necessary to understand what’s going on.

I don’t feel like every single person should have James Bond-level awareness of [security] things, and yet here we are.
Yael Grauer

Anyone Can Be a Victim

Yael has been lucky so far, but she’s still fallen for plenty of scam and fraud attempts. Once she got a Skype message asking for her help – she wasn’t very familiar with Skype and happened to have recently reconnected with someone who she hadn’t talked to in a while, so she clicked. Luckily, she was on a Mac, because the link led to a virus that would have owned a Windows device.

Yael uses a security key to protect her digital privacy and security, so she likes to think she’ll be safe even if she screws up. There have definitely been instances where she’s clicked on links knowing that it could potentially be a phishing link. When she gets an email saying someone has followed her work for years and wrote a related paper, she can’t help but click. There’s a phish that will work for anyone.

She hass also failed a phishing test at work. It wasn’t targeted, but it felt like it was because it was about something that happened to be on her mind at the time. Many phishing tests, though, count it as failed if you click. But she doesn’t think that’s accurate. Most phishing is trying to get at your password or other info, and many people get suspicious at that point.

Everyone is susceptible to this, even if you work in cybersecurity. That’s why tools for digital privacy protection are so important. Humans can’t get everything right all of the time. Often people don’t even report scams because they feel ashamed. But anyone can be a victim – nobody can do everything. Even if you’re secure, are your friends or family? Even if you tell everyone to do everything, it’s hard to keep up, and not everybody can.

Tip: Use a Credit Card

There have been multiple times Yael has almost bought something online, but changed her mind at the last minute because it seemed too good to be true. Once, she did actually buy something, and got a receipt from a weird email that didn’t seem to be real. She felt like it was sketchy and immediately cancelled the transaction with her credit card company.

Consumer Reports does a consumer cyber readiness report annually. It’s based on survey data and looking at different demographics to see who’s more likely to lose money. They look at race, income, and all sorts of demographics. But the more they looked into it, the more they realized that it wasn’t demographic-related. The people who were more likely to get their money back were ones who paid with a credit card, because credit cards have consumer protections built in. If you’re paying with a debit card or a different method, you may get your money back, but it’s much less likely.

Mass Surveillance and Digital Privacy Protection

One of the areas Yael writes about, and that matters a lot for digital privacy protection, is mass surveillance. She worries about things like location tracking – there are recent reports that governments can access advertising data to track people. There are limited things we can do about it, and they may not all work. Turning on global privacy control, turning off Ad ID, and tweaking settings can help. But not every state enforces global privacy control. And it’s hard to fight nation-states.

Using Signal for communication is a big thing you can do for digital privacy protection. People often ask if they should use something like ProtonMail, but a government order can still get some info. For stuff you want to keep private, don’t use email. Use Signal, and turn on disappearing messages.

Protecting your data can be challenging because we often don’t find out about problems until it’s too late. Start by being careful who you’re sharing info with. When people were being targeted for traveling to get abortions, people were looking at period tracking app privacy. But really, you should be looking at who you’re texting and messaging. Even when messages are encrypted, companies can still turn that data over to the authorities. That’s the kind of privacy things we need to think about.

Companies and Your Data

Companies have so much data about us. Yael has to wonder why, for example, nobody knows where Nancy Guthrie is yet. It may be Yael’s paranoia, but it feels like these companies collect data so they have ways to target people, but it’s not being used for useful things like solving crimes. That’s something the Electronic Freedom Foundation has done a lot of work around – companies create tools that they say will be used only on the worst criminals, and then they’re used for traffic and targeting teenagers.

It’s challenging for consumers to push back against this. How many form fields can you leave blank before you can’t submit it? If you have a video doorbell or camera, is it stored locally so you can decide if you want to hand it over to police, or with a company that can make that decision without alerting you? Companies don’t have to have privacy policies that are fifty pages of legal jargon – or even if they do, they could also provide easy-to-read summaries. Yael loves it when companies do that, but many don’t.

Better privacy protection requires clarity. And consumers like clarity from businesses. Most people know the cost of doing business is providing some of your info. But it’s beneficial to everyone for companies to say what they’re doing with it. If they’re going to sell it, Yael thinks they should be up front so people can make informed decisions. Even if you’re okay with one app having your data, that’s not consent to sharing it with others.

Even if you are okay with an app having your data, that doesn’t mean that you have consented to them giving it to all of their friends.
Yael Grauer

Privacy Isn’t Dead

Some people feel that the state of digital privacy protection is so bad that privacy is basically dead. But Yael doesn’t think it’s that bad. We still have the option to choose what we share. And even though the situation with companies having our data is a whole different story, we can still claw some of it back. Yael is part of the Lockdown Systems Collective that helps people delete their tweets. It gets more technically difficult if you want to delete everything, though. Someone can screenshot something and keep it forever – but they usually done.

There’s still ways to keep some things private. It’s getting more and more difficult.
Yael Grauer

Some states are fighting back. California is taking some steps. There are limitations to those and they’re not perfect, but there are meaningful restrictions now on how data can be used and shared, and they’ve started a data broker removal service. Publicly available information is often hard to remove. If you own property, that’s public record in a lot of states; if you vote, people can buy that data.

Privacy isn’t completely dead. And the risk of thinking it is dead is that people may slide into security nihilism and not take any steps. We need more regulation, and some of the people Yael is working with are doing great work on getting better privacy protections put into state laws. Nothing is foolproof, but digital privacy isn’t a lost cause. Don’t give up hope. Just take steps.

Connect with Yael Grauer on Bluesky @yaelwrites.com, on her website yaelwrites.com, or via email at [email protected].

All

All
Easy Prey Podcast
General Tech Topics, News & Emerging Trends
Home Computing to Boost Online Performance & Security
IP Addresses
Networking Basics: Learn How Networks Work
Online Privacy Topics to Stay Safe in a Risky World
Online Safety
Uncategorized

Digital Privacy Protection for the Real World

Getting Into Digital Privacy