Social Media and Social Engineering

Recently, I have been thinking about memes and social media. Memes, which Merriam-Webster defines as "an idea, behavior, style, or usage that spreads from person to person within a culture" or "an amusing or interesting item (such as a captioned picture or video) or genre of items that is spread widely online especially through social media" (Merriam-Webster), commonly take a few forms on social media. They can be items that are spread as they are (sometimes called image macros) or slightly modified to add relatable nuance to the joke, such as changing a caption to reference a character from a popular television show or celebrity. Memes can also take a different form, however. Some memes rely on answering questions or providing personal information through quizzes, questionnaires, or supplying photos or videos in response to prompts. On the surface, these can seem like a fun way to connect with your friends and remember the past (or brag about your accomplishments). You might be asked to rank the ten best concerts you have been to, mark off which unusual foods you have eaten, or share photos and answer questions about your life ten years ago. Depending on where you share your answers and who you are connected do on that particular social network, it might be a trip down memory lane for long time friends or finding out something new about a newer acquaintance.

However, what many people do not consider is that sharing pieces of information about yourself on social media, however seemingly innocuous, can make yourself vulnerable to a cybersecurity incident. Many websites that require a password also have a system of security questions on place to allow you to access your account should you forget the password. These questions are theoretically things that only you and perhaps those closest to you would know -- your father's middle name, your first grade teacher, your first pet, your favorite candy bar as a child. Some of these questionnaire-type memes, however, ask questions that either are information that might be used in security questions such as these, or questions that when taken together, particularly in conjunction with other public information about you on your social network profile for that site, allow a savvy person to put together a profile about you. This can include your full name, where you grew up, how old you are, your interests, et cetera, which can then make answers to those questions easier to crack. (For example, if the question is who was your first concert, there is a good chance that the answers will be very different for someone who is 25 versus someone who is 45.)

In a Wired article about this phenonmenon, Kate O'Neill reflects on a popular 2019 meme like this: the ten year then-and-now profile picture challenge. She semi-jokingly tweeted that providing carefully labeled photos of yourself ten years apart en masse like this was a great way to "train facial recognition algorithms on age progression and age recognition". By Facebook's account and her own conclusions, she did not think that this was ultimately the goal of this particular meme -- Facebook maintains that it was user generated and spread. However, it did provide an interesting platform on which to muse about how much information we share about ourselves with the internet, and the ways that this could come back to bite us. That's not to say that sharing a cute photo of you when you were younger or getting into a deep discussion on the best pizza toppings will necessarily result in our online banking passwords being hacked. (It's pepperoni, sausage, mushrooms and pineapple, in case you were wondering.) It is a good exercise, however, to regularly think critically about what we share and evaluate just how much of those seemingly inconsequential details about us are out there in the digital space, and being mindful about what we do share.