I've always been pretty good at "Internet Research", and i'll be the first to admit, there is a fine line between just being creepy and stalking someone, and using the tools given to you to find information on someone, for whatever reason.
Firstly, lets cover the legal aspects, most of the searching and info you can pull from the 'net isn't really covered by privacy laws, if it's been published so anyone can see, without guessing passwords (or hacking - technically, guessing a password isn't hacking, but there are people out there who know what they are doing, and can get past security without needing passwords) it is fair game.
You'd be very unlucky to attract the attention of a true hacker, most don't really have the time to spend trying to get to you stash of "favorite" pictures, but people running websites may express a view that will focus attention on them.
Those firewall warnings that pop up occasionally aren't cyber-criminals trying to steal your photoshop serial number, but usually automated computers looking for open ports. I guess you could imagine an open port as a door or window on your house. Most traffic comes through the front but some needs to come through a window...
OK, so that simile doesn't work...
Back to the topic of personal privacy, one of the first things EVERYONE needs to decide is how much info they are happy with giving out. If you run a business, you'll often have to accept that you'll always be known, and contactable by anyone.
The next part of this long, fascinating, and un-proof read 'blog will explain what people can find out about you, and also what you would need to do to keep yourself under the radar.
First off, you'll need to get yourself into detective mode. Internet leads are far easier than the stuff Police need to follow up, it's like tracing the branches on a tree, but you can do it from the comfort of your own home, and there will be less leads, so it'll have a finite end when you have found everything.
Start off with search engines, and do a search on the username/forum name of the person you are looking for. People will often try to find something unique, and you'll often find they have the same name on many different forums. This is usually known as the ego-search, as i bet everyone has tried to see how e-famous they are.
From the different forums/websites they contribute to, you might often find more details in the profiles. Many forums have locked profiles, only visible to members, but some are open, and will hand out your e-mail address like a cheap nightclub flyer. It's not a big deal to register on a forum either to get a better look inside too.
In the posts made on forums, image hosting sites like photobucket may give away more details. Be wary of automatic geotagging. One particular brand of fruit named mobile phones can add the GPS co-ordinates into the EXIF data of a pic. The EXIF data is usually techie stuff, like camera type, exposure settings etc, but if could also direct anyone to whatever object you have just snapped.
Any post with an image will have the album's address in it. That album may give away another username used by the person when they set up their image account, or searching for that username will find other images posted from that account that might be under other aliases.
One links to the other, so if you have multiple personality disorder, make sure you also have multiple image accounts.
Remember to have your main album locked, as otherwise, someone can backtrack through the image of last night's dinner to find that pic of that rash you had.
The above actually happened too...
Even if your main album is locked, the pictures are usually free to view by anyone with the correct URL. If me4.jpg is posted, expect the curious to look and see what me3.jpg might be, or worse still, me7.jpg and all of a sudden, people can see if you recovered from the rash you had...
Digital cameras can name pictures in a way that makes any others obvious. I saw a site that actually listed the default picture names for cameras. DSC_3384.JPG will give people an idea what to look for by changing the numbers and other similarly named pics can be found. This is what would be described as phishing.
You'll often find a randomiser on your image hoster for naming pictures if you can't think of a name which is a solution to that problem.
So by now, you can assume that quite a few of your pics have fallen into the wrong hands, and your email address has been found, along with a list of other interests you may have.
Google and Yahoo will often be able to find ancient info from whenever those e-mail addresses have been used, so check yours out, and see where it leads.
The google cache can store info for months even after it has been deleted, so you may often need to sit that one out and wait until it drops off the list. That still isn't perfect, as http://www.archive.org/ - The Wayback Machine, will store vast sections of websites for years, and they never time-out.
If you have a name, there are a few people-based search engines that are specifically for finding people. They'll trawl Facebook, Twitter, LinkedIn etc and often even grab a thumbnail userpic to help make identifying the right person quicker. School reunion sites will allow you to search via names, rough ages and areas.
At one stage, the UK electoral roll was easily accessible with just an name and area, and it would go as far as listing the names and addresses of your neighbours too.
Now, they have a list of your classmates from school, your home address, and even know who lives next door too.
If you are the owner of a website or business, registration details will often give out home addresses too. http://www.domaintools.com/ can tell you who has registered a website, and where they live. Companies House will also have an easily accessible address for the director of a company.
You can protect yourself from website registration, by choosing not to display registrant details for personal users, or using a management company for business registrations.
The main game-plan is keep putting every bit of info you find through a search engine, and keep going until you hit a dead end.
Last but not least, is the threat of social engineering. This is the very stuff that most con-tricks work on. It is the art of dragging more information out of someone by just asking questions, in the right way.
For example, you might often have seen people complain that their Facebook or MSN has been hacked. This is very unlikely, as places like these have massive security.
There are plenty of password brute forcers out there to download and set up automatically. These programs can try different passwords at rates of 100's a second, and they try every possible combination of letters and numbers until they find the right one.
That's the reason why many login pages allow only 5 attempts before locking someone out, or they introduce a pause before confirming whether a password is correct or not.
So how did they get into your MSN then? The flaw in systems like that, is that people often forget passwords, and the security questions are often very easy to guess. Even if you can't guess, you can use social engineering to just ask them.
A simple way would be a short conversation, a basic question like where someone grew up wouldn't attract attention, and the engineer could then claim that their parents were from that area. Next, they suggest that their parents were from there, and both your parents might even know each other, and with that, they can ask for your mother's maiden name, which is a basic security question used by everything from Instant messaging to Credit cards.
If someone gets into your hotmail/msn account, they can then read any emails you have, or even ask places to resend a password under the guise of forgetfulness and deeper they go.
Always remember, anything you say on the net can usually been seen by anyone, and it can lead to a massive papertrail right upto gaining control of credit cards, getting into ebay, adding more postal addresses, internet shopping etc.
Protect yourself by trying it out for yourself. If you can find out the information, so can others. Be wary of what details you pass on in harmless chat as it can be used against you.
It's simply a question of knowing the right places to look, and it does have it's good side. I've found lost friends for people, and once even tracked down a girl whose number i got in a bar, but lost my phone in a taxi on the way home.
I felt horrible for a while saying i'd give her a ring, and then never call, and it was maybe a month later i thought back, remembered she'd mentioned where she worked, found an email address that fitted, and sent an email saying "You might think i'm crazy, but did you ever meet a guy in XXX on YYY who said he'd call but never did?"
It was the right one in the end.
We went out a few times, nothing much came of it, but it would have been bugging me for ages if i didn't stick to my word.
There are good uses, and bad uses. It's always handy to know how to use the Internet to your advantage, but always make sure people can't use it against you. If you get a free hour or so, see what you can dig up on yourself, you may well be surprised.
The End