Be Seen. Not Found.

Your face is searchable

Face → Name → Home... they're all just links in a chain

Your Face to Your Home

​In the fall of 2024, two Harvard students walked around with a pair of Meta glasses and managed to identify dozens of strangers in real time. Not just their names, but their home addresses, their family members, their phone numbers. The people they were looking at had no idea it was happening... that they were getting doxxed in real time.

The students did all of this with publicly available information. There wasn't any special hacking tool or access to a random government database or anything fancy. The glasses streamed the video, some software grabbed a face from the feed, ran it through a facial recognition data broker (PimEyes), and then an AI read through the pages that got returned, connected it to another data broker service and served up their personal details.

They did all of this through regular consumer accounts - the same ones that you or I (or a weirdo on the internet) has access to. This happened a few years ago, and the students never released the tool - they just built it to prove a point.

So, you might be wondering... uh, Susan... why do I care now?

Because you could do the same thing with any phone camera (the glasses just make it possible while you're walking around). Or... because anyone could do this to you, just sitting at their computer at home right now.

The pattern we keep seeing Even if you manage to get your info off the data broker sites, there are other individual pieces of information that are out there can be chained together to get to you.

Your info isn't as private as you think it is

If you strip away the glasses from the story, what's actually happening is just a few pieces of data that are out there, that when you combine them, lead to you. Think of it as creating links in a chain - each piece of info they get can connect to the next one and the next, until they can land at your front door.
​
Here's how the links worked here:

1. Face → Page. The facial recognition software they used is called PimEyes. It's a tool that allows you to upload any photo, and it will tell you all the places that photo/person lives on the internet (like, your webpage, a running event website, a tagged event photo, etc.)
2. Page → Name. Then, a human (or an AI) reads those pages and pulls out a name. For a creator, this is pretty damn easy because your face is pretty much everywhere. So the face to page search leads them right to your home page, which has your name and likely some kind of reference to your city or state (check your privacy policies... there's probably at least a state there)
3. Name + general location → Home Address. Once someone has your name and your general area, data brokers and/or public records can do the rest. We walked this exact link in the PO box issue... that state + name search for your voter registration or property records probably leads them right to you.

For a random stranger on the street, that second link might be relatively difficult because they probably don't have a ton of presence or public photos. But not for you. You've built that second link everywhere (because that's the job... if they can't find you, they can't buy from you).

For you, the pages that PimEyes finds aren't some random race photo from a 5k you ran a few years ago, they're YOUR pages, with your name on them. And it's not because you messed anything up, it's because your face is the brand. Because that's the job.

But, for you, your digital footprint is sitting on top of stuff you can't change. A search that takes an investigator a few steps for a normie takes one step for you.

So the real version of the threat here isn't that "robot glasses" are here... but that, for a creator, the distance between "someone sees your face" and "someone knows your address" is as long as the link from your name to your address.

Break the Link You control

For reals though, you can't unpublish your face (and, given that it's probably tied to your livelihood, that'd be a pretty bad idea). Your face is how your audience finds you, so that link needs to stick around. The move here is to focus on the links you can control:

• Break Link 1: Get out of the facial recognition indexes. PimEyes has an opt-out process (so does FaceCheck ID, which is another similar site). Opting out means that someone can't upload a photo of you and use these tools to make that first connection. Fair warning though, opting out removes you from this one index, not from the internet. Other engines exist. Still playing whack-a-broker here...
• Break Link 3: Separate your name from your address. Most of the advice I give you here is designed to do this. Data broker removal, voter file opt-out, property record masking... that's what all of that is designed to do because this is the most dangerous link.
• Shrink Link 2 where you can. You can't hide your name, but you can stop handing over your location for free. Do your social media bios need your city (or even your state?) Does your email footer?

If you can do all three, here's what happens. Someone can still find your face and they can still find your name, but when they try to connect that to your address or your physical location, they hit a wall of dead ends instead of your driveway.

Your move · This week Run Your Own Face See what's actually out there. Go to PimEyes and search your own face (a clear selfie works). Look at the pages that come back and ask if any of these leaks your city or state. That's that second link exposure there... now you know where it lives. Then, go ahead and opt out.

On the Radar

What we're watching

01	Meta settled with the states over child safety. We'll see if this actually changes anything.
02	New X Account Takeover Attack. If you're on X... heads up.
03	New Apple Support / Lost iPhone tactic A phishing service is targeting lost iPhones and posing as Apple Support.

Stay safe, Susan @ Unpublic

You're getting this because you signed up at unpublic.co. Update preferences  ·  Unsubscribe  ·  Forward to a friend Unpublic, PBC.  ·  600 1st Ave Ste 330 PMB 92768  ·  Seattle, WA 98104-2246