Threat modeling, digital footprints, modern authentication, and ethical computing in an interconnected world.
Analyze how personal data is harvested via active/passive footprints, metadata, and data brokers.
Identify sophisticated phishing, spear-phishing, smishing, and generative AI voice cloning tactics.
Understand entropy, MFA/FIDO2 hardware keys, TLS/HTTPS, and end-to-end encryption fundamentals.
Examine digital rights, Creative Commons, algorithmic echo chambers, and incident response.
In 2023, a cybersecurity researcher demonstrated how 4 casual social media posts from a high school student allowed him to reconstruct their home address, bus route, gym lock combination, and mother's maiden name in under 15 minutes.
Attackers rarely hack firewall systems directly—they gather publicly available puzzle pieces across TikTok, Instagram, Strava fitness maps, and school sports rosters to construct targeted exploits.
Every digital action leaves an immutable trace. Computer scientists categorize footprints into two distinct vectors:
Data you intentionally submit: social media posts, comments, uploaded photos, blog posts, and public profile bios.
Data collected without direct user intent: IP addresses, browser fingerprinting, geolocation pings, session cookies, and typing cadence.
Data doesn't stay on the website where you generate it. It flows through an automated profiling pipeline:
Apps record app opens, battery levels, Wi-Fi SSIDs, and scroll velocity.
Data brokers purchase telemetry from thousands of apps and merge datasets.
Cross-device profiles link your laptop, phone, console, and home IP address.
Predictive AI algorithms serve tailored ads, adjust insurance risk scores, or feed scams.
In cybersecurity, threat modeling evaluates what you are protecting, who you are protecting it from, and how likely an attack is.
What has value? Passwords, email access, bank accounts, academic credentials, identity numbers, biometric scans.
Who wants it? Automated credential stuffers, phishing bots, cyberbullies, malicious Wi-Fi snoops, rogue advertisers.
How could they get it? Reused passwords, unencrypted Wi-Fi, malicious USB drives, phishing links, social engineering.
Password strength is measured in entropy (bits), representing how many guesses a brute-force algorithm must make.
MFA requires proof across at least two independent authentication factors:
Something you know: Password, PIN, passphrase, security questions (weakest factor).
Something you have: Time-based OTP app (TOTP), SMS code, FIDO2 USB Security Key (YubiKey).
Something you are: Fingerprint scan, facial geometry (FaceID), iris scan, voice print.
Attackers exploit human psychology rather than software bugs. Common social engineering vectors:
Phishing: Mass, automated generic emails pretending to be banks, Netflix, or Apple.
Spear-Phishing: Highly customized attacks targeting you specifically using your name, school, and friends.
Smishing (SMS Phishing): "Delivery failed, click to reschedule".
Vishing (Voice Phishing): Urgent phone calls from "Tech Support" or "Law Enforcement" demanding gift cards or wire transfers.
Artificial intelligence has lowered the cost of executing indistinguishable social engineering attacks.
AI models can clone a family member's voice using audio extracted from a TikTok or Instagram clip, calling parents in simulated distress.
Automated scrapers feed your public profiles into LLMs to generate grammatically flawless, highly contextual deceptive emails at zero marginal cost.
From: admin@portal-district8-verify.com
Subject: "URGENT: Your student account will be terminated in 2 hours unless you confirm your password."
Body: "Dear Student, click here to log into the identity verification portal immediately."
.edu or district domain)When connecting to open cafe or airport Wi-Fi, you share a local broadcast network with potential adversaries.
Attacker sets up "Starbucks_Free_WiFi" (Evil Twin hotspot).
Device auto-connects; attacker inspects unencrypted packets.
Attacker redirects requests for bank.com to a cloned malicious server.
Transport Layer Security (TLS) ensures that data in transit cannot be read or altered by intermediaries.
Not all "encrypted" services protect your privacy from the service provider itself.
Data encrypted between your device and the cloud server. The company holds the decryption key and can read your data, train AI on it, or hand it to law enforcement.
Data encrypted on sender's device and decrypted only on recipient's physical device. The server acts as a blind courier and cannot read contents even if subpoenaed.
Every photo taken on a smartphone embeds hidden Exchangeable Image File (EXIF) metadata into the file header.
Modern operating systems (iOS / Android) isolate apps in sandbox containers. Apps must explicitly request capabilities.
Background Precise Location, Full Photo Library, Microphone, Local Network Scanning, Contacts.
Only grant the minimum permissions necessary for an app's primary function. (Does a flashlight app need contacts?)
Use "Ask Every Time" or "While Using App" to prevent background telemetry logging.
"Only criminals or people doing illegal things need privacy. I'm just a student, no one cares about my data."
Privacy is about asymmetric power, financial security, and consent. Your data is used to calculate your loan rates, manipulate your voting decisions, price-discriminate against you, and clone your identity for financial fraud.
Snapchat stories expire in 24 hours, and Instagram allows un-sending DMs. But does content ever truly disappear from the web?
Imagine a university admissions officer or employer runs an OSINT check on your online handles 5 years from now. What assumptions would they form?
Understanding the legal frameworks governing software, media, and code sharing.
All Rights Reserved. You cannot reproduce, distribute, or adapt work without explicit permission.
Allows limited use for critique, parody, news reporting, teaching, and scholarship without permission.
Open licenses specifying allowed uses (e.g. CC-BY attribution, MIT open-source software license).
Social media feeds use reinforcement learning algorithms optimized for a single metric: Time on App.
Notification badge or curiosity creates craving.
Infinite vertical scroll with zero friction.
Dopamine hit from unpredictable novel content (slot-machine effect).
Likes and comments feed more data back into the recommender model.
Evaluate your personal setup against industry baseline defense standards:
You receive an email alert: "New login from Moscow, Russia on your primary Google account." What do you do?
Log out all active web and mobile sessions via account security dashboard.
Change master password to a 20+ char random passphrase immediately.
Revoke third-party OAuth app authorizations linked to the account.
Verify recovery email and phone number were not altered by the attacker.
"I use the same awesome 14-character password (P@ssword2024!) for all my school and gaming accounts so I never forget it. When I'm at the coffee shop, I connect to their open Wi-Fi to do my online banking without a VPN. To save time, I keep my 2FA codes set to SMS on my phone."
If a single low-security gaming forum gets breached, automated bots will test those credentials on Google, Steam, and banking (Credential Stuffing).
Using open networks exposes local DNS requests and session metadata to packet sniffing or evil-twin rogue access points.
SMS is vulnerable to SIM Swapping (social engineering telecom carriers) and SS7 cellular protocol interception.
Verify identities out-of-band; never click urgency-driven links in messages.
Use long, unique passphrases stored in a password manager backed by hardware/app 2FA.
Audit permissions, disable telemetry, strip EXIF metadata, and use E2EE services.
Respect intellectual property, recognize algorithmic manipulation, and protect peers' privacy.
Write down 3 technical concepts learned today (e.g. Entropy, E2EE, Passive footprint).
List 2 immediate changes you will make to your accounts or devices before tomorrow.
One question you have about computer hardware, architecture, or binary logic for Chapter 2!