Vanishing is a Lie

Trying to erase yourself from the internet sounds simple until you start counting up old accounts, scattered social media posts, and the hundreds of data brokers quietly collecting and selling your information. The reality is messy, and for most people, the idea of fully disappearing online is more myth than possibility. But there are practical steps you can take to cut down what’s out there and regain some control.

My guest, Max Eddy, is a senior staff writer at Wirecutter who covers privacy, security, and software platforms. For one of his projects, he set out to see how much of his own digital footprint he could realistically reduce. Max shares what he discovered along the way and what worked, what didn’t, and how even small changes can make a meaningful difference.

In our conversation, Max talks about the value of using password managers and email masking, what he learned from testing multiple data removal services, and the emotional side of deleting old social media history. He also explains why perfection isn’t the goal, and how thinking differently about privacy can help you stay one step ahead of scammers, marketers, and anyone else trying to piece together your personal information.

Show Notes:

• [00:50] Max explains why he got into covering privacy and security and what keeps him motivated in the field.
• [03:27] We discuss the Wirecutter project on disappearing online and why it resonated with readers.
• [04:12] Using Have I Been Pwned, Max was able to reduce 350 online accounts down to 27 that needed immediate attention.
• [09:10] Max describes the tactics he used to break the links between his online accounts with fake names, masked emails, and random images.
• [11:55] We talk about data removal services, their limitations, and the challenges of removing certain public records.
• [17:52] We learn how scammers can piece together a person's complete profile from inconsistent, fragmented data from different data brokers.
• [18:54] We discuss how Google's removal tools only make information harder to find, but don't delete it.
• [23:15] We talk about the emotional side of deleting social media history and the automation tools he used to make it possible.
• [29:40] Max discusses the risks of deleting accounts entirely, from impersonation threats to losing important communication channels.
• [32:28] We talk about the value of taking a gradual approach to improving your digital privacy and how small, steady steps are most effective.
• [38:44] Max shares his key takeaways from the project: first, ask why you want to disappear, and second, remember that any effort to reduce data is valuable.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Max Eddy – Wirecutter
• I Tried, and Failed, to Disappear From the Internet
• Max Eddy
• Have I Been Pwned

Transcript:

Max, thank you so much for coming on the podcast today.

Glad to be here.

Can you give myself and the audience a little bit of background about who you are and what you do?

I am a staff writer at Wirecutter. I work on reviews about security and privacy services and software, as well as software platforms, so phone operating systems, computer operating systems, and things like that.

Right in the sweet spot of stuff that I like to do as well.

Excellent.

What draws your attention to that subject matter?

Some of it is, to be perfectly frank, just how a career gets built. You get into a beat and you stay into it. What has kept me doing privacy and security work is, really, it's one of those opportunities where I feel like I can maybe make someone's life a little bit better. This stuff is confusing, and I am the kind of person that doesn't mind trying 77 different VPNs until I find the one that I think is half decent. It meets a lot of my needs, and I like to think it can make the world a little bit better.

Awesome. I know there are some people who they're in journalism and their editor came to me and said, “We need someone to do this story. That story became a hit. Now I'm pigeonholed into that content.”

I'm not saying that didn't happen, but I'm saying it's part of a larger story.

I totally get it. How did that result in writing your article on how to disappear?

This came out of a conversation we were having at Wirecutter about new ways that we could try to reach our audiences and answer some really big questions that they had about privacy and security, but the ones that maybe they hadn't realized that they had. There's actually a package of stories. I really do encourage people to take a look because as proud as I am of my work, the rest of it is amazing as well.

We have work about the privacy implications of using smart devices, like how many times do you think your smart TV is taking screenshots of its content? It's a lot more than you think. What to do with the online presence of someone who has died, how to safely handle that thing. Again, this is the stuff that is really, really important and that we really want to try to help people understand better.

Some of it's stuff that you want to figure it out before something happens as opposed to it's really hard to undo this stuff.

Absolutely, and that was one of the biggest conversations we had around another piece in this package about data breaches like, what do you do after a data breach? The answer’s, like, nothing. The worst has already happened, actually. It becomes a lot more about what do you do preparing for the next one because there will be a next one. It is boring, but a lot of these stories always boil down to like, “Hey, you should probably use a password manager. You should probably do these two to three important security and privacy things that will make your life a little better.

Yup, and then the typical password manager, two-factor authentication. Don't make all your social media accounts a hundred percent public.

Yeah. If I could wave a wand and change one thing about the industry that I cover, it would be everyone use a password manager and 2FA. That would make everyone's lives so much better.

Absolutely. Let's go through what you did to try to disappear and why. I guess we talked about why because, “Hey, this was a conversation our team talked about,” but how did that process go for you? What did you do?

Yeah. I came to this with a little bit of an advantage because I already use a password manager, so I have a record of every site that I have an account at. Starting with that, I figured out that I had about 350-odd accounts that I would have to erase or take care of. I realized I couldn't do that in a reasonable timeframe and certainly not by deadline.

I went to haveibeenpwned.com. I believe you interviewed the proprietor of that useful website. I went on there and I pulled down a list of all the accounts that had been compromised, and I was able to take that list of 350-something to 27, the ones that really needed to be taken care of because the information had been exposed in those accounts. Then I added a few more onto that that I knew would be interesting for readers, valuable to help them understand how to do this themselves, and also I knew would have a lot of information. My Facebook account hadn't been exposed, but I knew I really wanted to get off of Facebook, so that went on the list as well.

I think the one step that had to happen before all this was I'm not the first person to try to do this story. A lot of other really smart people have come before me to do it. One thing that I learned from looking at that and from talking at experts in the industry for many, many years is that it is a fantasy to believe that you can disappear from the internet.

Going into it with that assumption, I wanted to try to do something a little more actionable. What I landed on was instead of trying to delete everything and have this very maximalist approach, I ended up trying to build a framework to take control of information. For example, I've got this 55-odd websites that I'm going to try to remove my information from. I could very easily just delete those accounts, but what I decided to do instead was remove my personal information from them and separate them from each other.

I went through and removed my real name and replaced it with a fake one. I turned all the bio boxes that had personal information into either blank ones or just garbage text if it required that. I generated random images using a bitmap generator, just blotches of color and replaced all of the user photos with that. I used Firefox Relay, an email-masking tool. There are many other email-masking tools. You don't need to take that one necessarily to create separate emails for each one of these services, breaking them apart, and I think making it a lot harder for someone who is observing internet accounts or for the companies themselves who might be exchanging this information to actually find me in all that mess.

Yeah. We think of password managers as like, “As long as I have a unique password, that account is secure.” There's a certain amount of truth to that, but you could still merge data of like, well, if you've used the same email address on every platform, it's super easy to find you, super easy to start merging data across platforms. It's almost, “OK, we need an email manager and a password manager.”

Yes, absolutely. Part of what informed this whole process was having talked to experts about how scammers do this kind of work, where you use a lot of disparate bits of information from data breaches and other sources and try to draw connections, boil that down until you're able to take several different data points and turn them into one person. Doing this process, really, you never got to hand it to them, but it did give me an appreciation for the amount of work that goes into that.

Yeah, that's crazy. I know as part of your process. In addition to trying to change all the email addresses and all the information on each specific site, you also looked at just removing information from data brokers. How did that process go?

One of the other stories in the package is a guide to the best data removal services. I had been looking at these for a long time. I was just personally and professionally curious about them like, how do they work, how well do they work? Those are still questions, to some extent, we're trying to answer. We have a long-term experiment going on with several of the staff at Wirecutter, where we have them signed up with services, and we're tracking their successes and how well they're going to perform over time. We're hoping to really break that open in a new way.

I signed up for, I think it was between nine and 12 data removal services. Normal people do not need to do that. Obviously, I had more deadlines to serve. Using one of these services will go online and find your information at certain data broker sites and then ask to have that data removed. That can be a very tedious process if you try to do it yourself. I should underline, you can do this yourself. If you want to invest that  time and effort into it, you can do it yourself for free. I've seen other people suggest that maybe that's even better and a higher success rate, perhaps. I have no data to back that up, but I do want to acknowledge that you don't always have to pay for this stuff.

It's a question of how valuable is your time because one of these data removal services, you key in the important stuff once, and you say, “OK, go have fun, Mr. AI, or automated process,” as opposed to me finding every one of these sites. I actually read an article recently where a bunch of the data brokers have intentionally flagged their removal forms as not indexed for the search engines. When you google, “how do I remove myself from [name of data broker],” their removal page doesn't even show up in the search results.

Yes. It gets very complex very quickly. There are hundreds, if not thousands, of data brokers. Again, I couldn't give an exact number, but one thing that I was looking at with these data removal services is that a lot of them cover a vastly different tranche of the data removal services of data brokers. It is difficult to pick out ones that are going to work for you.

I think in the end, the important thing is that you just try to do something about it because, maybe I shouldn't have established first, but a data broker is a company that takes your information and then sells it to whoever wants it. Even just looking at those sites was a fascinating experience in itself. Lots of information about myself, but also lots of wrong information about me.

There would be, like, Max Eddy in the town I grew up in, but not at the address I lived with. Frankly, beggars belief that there was another person with the exact same name as me within a few miles of where I was living, or Max Eddy who is not me because the age is wrong, but they have associated with my parents and my siblings, for example. It was really interesting to dig through this because it is scary to think about how this information is being sold about you and then very humbling is the wrong word. It's certainly not hopeful, but it was surprising to see how wrong a lot of it was.

I have played around with a number of those services as well, both on the data removal side and the lookup side. I found it interesting that some of my college roommates are now listed as siblings. It's like, no, clearly they are not a sibling. Other sources have my siblings right, some label my wife as a sibling.

Some of it have it as a spouse, some of my siblings, some have all of my siblings, some have none of my siblings. Like you said, it's really interesting to see both how right and how wrong those services can be at the same time. I hadn't used one of them. It's probably been maybe two years now. How long has it been since you used it, if you don't mind me asking?

I started this up several months ago, around the beginning of the year. I didn't keep all of them running for the whole time because we didn't need to do that. We have this long-term experiment, where we're looking at five of them with five other Wirecutter writers, and I'm very curious to see the results of that long-term look about how successful they were. It was pretty clear to me that something was happening with these services.

Again, we're trying to figure out to what extent any individual service can make a dent in the information that's out there, but I can say that yes, they're doing something. The information started to disappear. I was getting different results from them. The more I used, they found less and less. I was like, “OK, there's something happening here very clearly.”

Again, I think it's important to try to get something of value. Obviously you don't want to spend your very hard-earned money on something that's not going to do what you expect it to do. I was impressed that, I think making any kind of effort with removing your personal information from the internet will make a difference, even if you don't perhaps get the perfect one. Any effort in this will be valuable.

Yeah. One thing I have not been able to, I don't know if I necessarily saw it in anyone's marketing materials and nor do I ever really trust people's marketing materials, is the anecdotal amount of physical junk mail has gone down by about 90%. I get almost no physical junk mail anymore. Is that a byproduct of just a changing market, or was this a result of using a data removal source? I was like, this is something I need to talk to someone at some point to see if they've had the same experience or not.

I'm actually glad you brought this up because it really is an open question as to whether or not data removal services can help with things like spam calls, for example. Some companies claim that they absolutely will help with that. Others say very clearly that no one can help you with that. Something important to remember about spam calls and junk mail, specifically, is that those are two things that actually have an economy of scale involved with them. It costs money to send mail. You have to use special services and systems to do mass texting and calling. It's not something that you can just do from your phone.

I think whether or not you get a lot of spam mail or a lot of junk calls, it has a lot to do with how much it costs to do those things. Email, which is effectively free in a lot of contexts, is a different thing. Scams is a very different thing, where that's being run by someone who has a totally different economy going on. Yeah, it's very hard to say. Again, I think it's important to try to address any of that information that you can.

Were there any things that looked like steps that you took, that looked like they would yield results but didn't really yield you any results or not the results you were expecting?

Yeah, for sure. When I was looking into public records, I found that there was not a lot I could do there. I looked at public records both because it's a source of personal information about everyone, but also anecdotally, I've been told that that is an upstream source for a lot of data brokers. There's a whole economy of data brokers, like trading information back and forth. I wanted to try to see if we could get to the headwaters, as it were.

With public records, there's not really much that I could do. I think this is going to depend on where you live. I wasn't able to make changes to any real estate records relating to myself. I wasn't able to make changes to any voter registration records relating to myself, nor could I do anything about lists for donations to political organizations. That last one was actually the most fruitful of all the ones I looked at.

You could get this information direct from the source, from the federal government. Depending on how you pull down that information, it can have enormous amounts of data about any individual, home addresses, phone numbers, that sort of thing. All of these are very hard to remove. I've heard from some friends of mine that were able to make minor changes to their voter registration, but that wasn't possible for me.

Yeah. And the process of putting property and LLCs and hiding, that's a whole cottage industry to hide that kind of stuff.

I've had people ask me in the course of writing this, “So why didn't you just put your real estate in an LLC and all that?” One, I'm not going to buy a house for the purposes of a news article. Two, no one could tell me whether or not it would work. It's an enormous effort and I was like, “We shouldn't tell people things that we don't know for certain will work.”

I don't know that it would even be helpful for a property that you currently live at because if there is a property record saying that you owned that house at some point, just because it was sold and put into an LLC doesn't mean you actually moved. It's almost like you have to think of this before you go somewhere that you want to go.

Yeah, absolutely. Again, I don't want to say that, “Oh, you can't do anything about this.” Somebody out there has probably got some process that works. I just don't know it.

One of the interesting things about public records, though, is I, again, was put into the shoes of the data broker. Looking at these databases, a lot of them will give you lots of information, but you have to know exactly who you're looking for. If you're very careful with it, you can piece together enough information to be able to start identifying those individuals, addresses, and phone numbers. Once you get your foot in the door there, you can get more and more specific information. You can start finding people in bigger and bigger databases. Again, it is just interesting to go through the steps of a scammer or a data broker on myself in order to understand how it works.

That's interesting because I had noticed that some of the lookup sites, the data brokers, and I don't want to pay them money, but would give the first couple of digits of the phone number. Other ones would give you the last couple of digits of the phone number. There was often enough that if you looked at enough records, you could actually start to say, “Well, OK, they're giving me this piece, they're giving me that piece. Even without paying for the service, I could figure out my complete phone numbers, addresses, former addresses, relatives, all that stuff just because there wasn't a consistency in the way that they didn't disclose data. There wasn't a consistency in the way they masked their public data.”

Absolutely. I think the interesting thing there, though, and I ran into this with myself, is that I know about me. I know what is true, so I can figure out what of this data is more valuable than others. If I was doing this blind with another person, it would be much harder. I wouldn't know which phone numbers were real, I wouldn't know which address is the most recent.

There's another Max Eddy somewhere else in New York State who's often confused with me because we're in the same state, even though we're miles and miles and miles apart. Without that additional context, it is a little harder.

Yeah because you don't know, did the person move or is it the same person?

Exactly.

I know Google made a big deal recently within the last year—I suppose that's my term of recently—of them making available a feature like, what do you know about me, what can you find about me, and what can you remove from me. I know the answer to this question, but I'm going to ask it to you in a leading fashion. Does that service actually work?

I think it depends on who defined work. It will absolutely remove search results, and it does do that. Actually, it worked remarkably well in that regard. The important thing to remember is that it's not actually removing the information, it's just making it harder to find in Google's search, which is it's not the only search engine and that information is still out there.

The other thing is that it has to meet very specific, narrowly defined criteria from Google about what it will and will not remove. I think that they're all valuable. If you were going to undergo something like this, if you really want to try to take control of your personal information online, you're probably going to want to get a data removal service. You're probably also going to want to sign up for this Google service in order to cover all of your bases. There were definitely gaps between where these two things were working.

Yeah. It was funny. Many years ago, I had done a group that was going on a trip to Sequoia National Park. I had put together a website for that group with the itinerary. It was a group of 200 people. It was just a really big group, so there was a lot of stuff about food, schedule, and all that stuff, and I had my phone number on there. The website was up for maybe a year. I took the website down, but I started getting phone calls from people saying, “Oh, you are a park ranger for Sequoia National Park, can you give me some information about this campground?” I'm like, “What?”

I googled my phone number, and there it is. Someone had picked up that page and copied it. I'm like, “Oh, great.” It was just weird that the inadvertent things that you do to try to be helpful in one circumstance led to disclosure of stuff well beyond what you would expect it to.

Yeah, absolutely. Again, this comes back to the quality of that information is not always spectacular. The end result is the same. You have people calling you that you don't want calling you.

What was your experience with social media platforms? They are their own network and loose affiliation. Because some of them are all based on your network of friends, how do you disentangle that network?

One of the things that I found really interesting about social media in this project, and this was true pretty much across the board from services like Foursquare, which used to be, for people that don't remember, an app where you could check in at locations and if you checked in, if you became the mayor. Yes, there were some perks to this, but mostly it was bragging rights. Everything from that to Facebook, to Twitter, X, and everything else, they don't make it easy to remove things. They really, really do not. You're going to have to go individually post by post to try to take it out if that's even an option at all.

Facebook has a lot of tools that actually make this a little bit easier. In that case, it is very difficult to use those tools. I wish that I could give people better advice about how to remove themselves from Facebook, but I have to just be honest about it. I went into some fugue state. I don't know what menus I was on. I don't know what I was looking at. I'm trying to take careful notes of everything that I'm doing, and then I didn't feel like it was matching up. I just had a really hard time using these services, but they are available.

If you really do a deep dive into Facebook's settings, you can find some very useful tools. I can highlight a few. There is an option that will make all of your posts retroactively private, which is a very easy thing that you can do right now. There's a way to view every interaction you've ever had on the site, which is very good for tracking down a comment you left on someone's photo a very, very long time ago and you just want to remove that. Those tools are there. They are difficult to find. Facebook has always been a bit of a Byzantine beast for this.

What really hit me though for social media was the sadness, frankly, of removing this information. It was painful to, in a sense, delete my own history. Obviously, I am not the internet, I'm separate from this, and this is not really a reflection of me, but it was still surprisingly emotional to go through all this stuff and decide what to get rid of and what not to get rid of.

In the case of Foursquare, I actually left that up because, well, first off, it would've been difficult to remove. Secondly, it felt wrong to just delete all that to me. Obviously everyone has to make their own decisions about this.

I was able to find some very useful tools that do make this easier. I use something called Cyd. Cyd will automatically remove your tweets, retweets, and likes from the platform. That's really valuable because I had several hundred thousand of those that I had to go through. This application made short work of that. It did all my tweets in about three hours. It took several days to go through all of the likes and retweets because it uses a much more time-intensive method for removing that. I was inspired by that.

I use the Automator app, which ships on every Macintosh to write a very simple, little program that would delete things from Instagram or try to. It was effective about 70% of the time. It did save me time in the end, but it did not save me the emotional baggage of watching my memories flash by in front of me and then be deleted.

That's an interesting aspect of it there. It's not totally clinical about, “I'm deleting data, but this is my history. This is part of what I have done in my life.”

Yes. It is very, very individualized. I was agonizing about removing tagged photos of myself towards the end of this project. I mentioned this to my spouse and they were like, “I don't know why you're having a problem with this. Tags are stupid. I removed all of them years ago.” I was afraid to ask family members, like, “Would you remove photos of me if I asked you to?”

What was striking there was that a lot of my family members told me that they have a very different relationship with social media now than they used to. They are perfectly happy to remove photos. They absolutely don't trust these platforms anymore. They use them in much different ways, much more guarded ways. I think for anyone out there who is having some angst about this, it is actually easier to do than you might think and in some ways, very freeing. I did end up making copies of most of the stuff that I deleted, even my embarrassing live journal posts, because it did feel like part of my own history that I wasn't quite willing to give up.

When I've been trying to find stuff, do stuff, and refer back to things that happened in my past, it's helpful having that documentation of your history as opposed to going, “Well, I think this is what happened.” Well, there's my live journal of what actually did happen, what I was thinking of in the moment, as opposed to our little murky memories, which changed our history over time.

That's absolutely true. As an aside, one of the things I ran into with this is like, “Wow, in the moment, posting was also very murky, but who is this person? I don't recognize this guy. This is not me.” Having to confront myself over and over and over again was emotionally exhausting.

Was there anybody who gave any negative or, “Why did you untag me, or why did you ask me to untag you?”

One of the benefits of doing this is if you do it fast enough, they can't respond to you. It's something to keep in mind. No one gave me a hard time about any of this. Any fears I had about it were definitely in my own head.

One thing to consider is that social media, for all of its faults, is a default way of communication for many people. My family, for example, communicates almost exclusively over Facebook and Facebook Messenger. If I was to completely delete myself from that platform, I would not only cut myself off from being able to have conversations with them right now, but also cut myself off from being able to have conversations with them in the future.

I had to make a decision about how to handle that. In my case, I removed as much information out of Facebook as I could. I turned off as much of Facebook's features as I could, but my account is still there.

To me, that's always important. Everybody's definition of privacy and what they want to do is different, and it's very personal. If you're a journalist, your trade is your name and the history of what you've written about. Having your name associated with what you've done gets you work. If you are a coder or something, maybe your public persona is not as relevant.

Yeah, absolutely. We had a discussion internally when I was working on this story. I was like, “Well, should I go back and try to get my previous employers to remove my name from these articles?” It was like, “No, I'm not going to do that. This is important to me.” Yeah, absolutely. Everyone needs to make that determination for themself.

One other thing I did want to point out about that maximalist approach of just deleting your account is it is faster and in some ways it might be better. The experts I spoke to said that, generally, companies do remove these accounts when you ask them to. They may not delete the data. That might be used for other things. It may be anonymized in some way, but they will probably remove the account if you ask them to.

One concern I had was impersonation. If you have an account on a platform where you have been there for a long time and the owners or the administrators can see that you have an old timestamp attached to your account, then you're going to be able to prove that you're you a lot easier than if you've deleted that and then you try to come back onto it. As a journalist, I was concerned about this. I don't want someone trying to create confusion about who I am and what I'm saying. I think this actually affects everyone.

I vividly remember, a member of my family was being impersonated on Facebook and going around asking all the other family members to send the money. This is just a regular person with a regular job in middle America, no one really Google-able. I think people need to remember that just because you are not a known individual and you're not easily Google-able, it does not mean that someone will not try to pretend to be you. Take that into account when you are removing your information.

That is a weird perspective of, in order to protect myself and my family members, to have some level of privacy, I almost have to have a profile that exists so that people don't run into the wrong one.

Right.

It's a weird position to be in.

Absolutely. Having that account doesn't necessarily mean you won't ever be impersonated. There are many stories of people with legitimate accounts being flagged as illegitimate by someone who's just a little bit better at impersonating them than you might expect. It's not a guarantee by any means, but in my view, I felt that it would be a lot easier for me to manage this in the future.

Again, I wanted to see how far I could get with this particular framework to how I could remove my information. It is, I think, a pretty actionable framework. As I go forward, I'm going to be continuing to do this and remove more and more data, and hopefully someday go through all 350 of these accounts.

One a day for the next year.

Honestly, it's the best way to do things when people ask how to get started with the password manager. Just do it as you go. Every time you log into a site, just record it. In the same way, every time I log into a site, I'm like, “Oh, there's my old email address. Let's just scrub that out of there.” It will take a while.

Did you do anything about creating synthetic alter egos or anything like that?

I didn't go so far as to creating another persona, but I did use a lot of synthetic data, which is just a fancy term for made-up information. On all these sites, I would put these fake user profiles up. I would use junk information for birth dates, names, and things like that. I had a big chunk of a Latin text that I would just pull random words from in order to make names.

Because I had this pretty regimented system, you can actually, if you look hard enough, figure out which accounts are mine in a particular group. It's much harder to do by searching. It's like, “Well, let's just find some lorem ipsum in Moz mail account and you might find me.”

That's the challenging thing. I don't think in terms of privacy for what we're doing, it's perfectly fine. Anything that we do off of a regimented system creates telltale indicators. If you're always using the same source text and that's available somewhere, recognizable, or it's a pattern, that's a pattern. That can start connecting those accounts again in a much more complicated, sophisticated way.

I think that's more of a problem now, frankly. A lot of the AI and generative AI systems are at the point where they can find those connections a little bit better. We're much better with computer vision. We're much better with determining whether or not these words are the same. I do have that concern.

The point of this was not to be perfect. If it was to be perfect, I would not be on the show, and I wouldn't have the Social Security number. The point was to try to be actionable. I think that this is an actionable way to try to take back some measure of control.

Other than your behaviors now, has anything else changed as a result of writing the article and doing what you've done?

A lot of people ask me about it, which I was surprised by. I felt that this was a story that had been told many times before. I wasn't expecting it to be so resonant, but I've been very honored and grateful that people have come up to me, family members and friends have told me that they've found this useful. That's been one thing.

One other change that I am trying to make is seeing where else I can push this. What other things can I do to make this a little better and a little more effective? I'm having some mixed success there. This was also an opportunity to try some new services and systems to start using  a different email provider than Google to start using a different social media platform to talk to the world. I think that there's a lot of ways that people can make small changes in their life, and this was a fun way to explore a lot of different ones all at once for me.

Yeah, it makes perfect sense. Have you changed your real-world or in-real-life encounters with people and data?

That's a good one. I have. I am now a lot more conscious of when I sign up for things. Whenever I'm entering an email address, I'm like, “That's my real one. I don't like that. I'm at the DMV and I have to hurry.”

In some ways, it has made me more comfortable giving out some forms of information. At this point, I'm perfectly fine giving anyone my phone number. I'm just like, “What am I going to do about this?” It's out there, like someone's going to get it. Also, I rarely pick up my phone if I don't recognize the number. That's one where after looking at everything that's out there about me, this one, to me at least, is not as valuable. For other people, that might not be true. I definitely want to just drive that home that a lot of this is going to be individualized. What do you feel comfortable giving away and what don't you feel comfortable giving away?

In physical person, have you ever asked anyone, “Do I need to provide this in order to have the service, or what are you going to do with that information?” Have you had those conversations?

I definitely do that with online services where I was like, “Do you really need this? How can I fake it so that you can use it?” In real life, not as much, but I have tried to get people to use a different email to contact me. Don't use this old one that I'm trying to wind down because it was used in 2100 places.

For a while, I actually was using a phone-masking service where I had a different phone number that forwarded to my main number. I stopped doing that because when you eventually have to tell someone that you've given them your fake phone number, they don't necessarily like that. That just was causing more problems than it was worth.

Yeah. It makes sense if you're giving it to an auto mechanic that you never expect to hear from again or some contractor who's going to fix the plumbing issue. I don't care. But if it's someone that I'm going to have any ongoing interaction with, “Yeah, I gave you a fake number because I didn't trust you.”

When it's the third or fourth date and they're like, “Why are you calling me from a new number?,” it can lead to awkward conversations. It's true.

That would definitely happen. As we wrap up here, any parting advice or resources that you want to include that we didn't already talk about?

We talked about the story and the package. Not to be too pluggy here, but I do think people will benefit from reading, so I hope that they'll go to Wirecutter and take a look at the work that was done by myself and my colleagues. There's a lot of really great information in here.

I think one thing I do want people to take away from this experience that I have had at least is that it is impossible to try and completely remove yourself from the internet. I hope that people will do two things when they learn that. One, ask why they want that. What are they responding to? What in the world is pushing them to do that? I can have my own hypotheses about why people would want that, but I think it's important for people to ask about what pressure is making them do that. What is happening that's frightening them so much? Why do they need this sense of control?

Two, try to look around to find ways to change that. If you're very, very upset that your data is being sold, look around to see who is doing regulation about this, then you can go lend them your support. Who can you call to try to make this reality? I think that these are individualized solutions that we're talking about right now, but this is a very much a nationwide, worldwide problem that's going to require a lot more efforts at even higher levels.

I think the other thing I want people to take away from this is that any effort that you make is valuable. Using a password manager even just a little bit is going to not only make you safer, it's going to help you to be able to take better control of your data using different services to try and remove your data from the internet. It's not going to get everything. That probably won't happen, but it will absolutely make there be less of it, and that's still valuable.

Absolutely, and we'll make sure to link to the article, link to Cyd, and anything else that we've talked about. We'll make sure to link to that in the show notes. Maybe this is a question I shouldn't ask: If people want to find more about the content that you're writing online, where can they best find you, unless you don't want to be found, which is not true for most journalists?

I am on Mastodon, which is actually the preferred way that people find me online. I'm on the infosec.exchange server. Just look for @maxeddy. You'll find me. Of course you can find me on Wirecutter. If you really want to email me, you can email me there.

Awesome, Max. Thank you so much for coming on the podcast today.

Thank you so much for having me.