Protecting personal information

The answer to "What was the name of your first pet?" is often a public photo caption away, which is why NIST now forbids services from prompting for security questions when you set a password.

Four posts that each look harmless

Here is a made-up story. Minji, a secondary-school student, posts four things in one month: a selfie in her school uniform, a birthday cake with the date piped on it, a photo of her dog with his name in the caption, and a short clip from the same bus stop every morning. None of them looks risky. Together, though, they add up. Put side by side, they tell a stranger her school, her daily route, her birthday and the answer to "What was the name of your first pet?"

How Korean law defines personal information

Personal information is any information about a living person that identifies them. Korea's Personal Information Protection Act defines it to include information that does not identify someone on its own but does when easily combined with other information, which is Minji's situation exactly. Name, phone number and resident registration number are the obvious examples. The less obvious ones add up: a school name, a daily route, a photo of your front door, a birthday. Each looks harmless alone. Together they can be enough to guess security answers, impersonate someone to a phone company or find where they live.

Giving out less in forms, posts and photos

The simplest protection is to give out less. Before filling in a form, ask whether the service really needs each field; many fields are optional even when they do not say so. On social media, check who can see your posts and your friend list, and think twice before posting travel plans while you are away, children's school uniforms or anything showing your address. Phone cameras can store the place a photo was taken inside the image file, so check your camera's location setting and whether the app you share through removes it.

Apps ask for permissions such as location, contacts, microphone and photos. Grant only what an app needs for what you use it for: a torch app has no reason to read your contacts. Most phones let you allow location only while the app is open, or give an approximate location instead of an exact one. Review permissions now and then and remove apps you no longer use, because an abandoned app still holds whatever you allowed.

Why the pet question is a weak lock

Security questions ask for facts that are often public or guessable, as Minji's dog shows. NIST SP 800-63B-4 says services must not prompt you to use them when choosing a password. If a site still insists, treat the answer like a password: make up a random answer and store it in your password manager. On public Wi-Fi, look for https:// in the address bar. HTTPS encrypts what you send to that site, so other people on the network cannot read it, but it does not make a dishonest site honest. Avoid signing in to sensitive accounts on a shared computer, and sign out when you are done.

When a company tells you your data leaked

If a service tells you it has been breached, change your password there and anywhere you reused it, and turn on two-step sign-in. Expect phishing that mentions the breach, because criminals know you are waiting for news; contact the company only through its own app or site. In Korea, KISA's personal information infringement report centre (privacy.kisa.or.kr) takes reports and questions, and the 118 line gives general personal information advice on weekdays from 9 am to 6 pm, while hacking and virus emergencies are answered around the clock.