What you share online can say more than you intend. This module helps you spot the risks, understand why they matter, and make small changes that go a long way.
🎯
What you will learn
How everyday posts can expose you, and practical steps to reduce that risk.
⏱️
About 15 minutes
Work at your own pace. No technical background needed.
💡
Straight to the point
No jargon, no scare tactics. Just what you need to know and what to do about it.
01 | Spot the Risk
Learning to See Risk
Before we talk about online habits, here is a quick exercise in risk awareness. Look at the image and think about what you notice.
A shared cycling path. Look carefully at each rider before selecting below.
Who do you think is more vulnerable? Select one and see what you notice.
Cyclist A | Risk Trade-offs
SaferGlasses offer some eye protection from debris
RiskNo helmet significantly increases head injury risk
RiskSkirt offers no protection from scrapes in a fall
RiskSneaker laces can catch in bike spokes
RiskPhone on handlebars is a cognitive distraction
Cyclist B | Risk Trade-offs
SaferHelmet is the single most effective protection against serious injury
SaferLong trousers reduce scrape injuries in a fall
SaferBag on back keeps weight centered and balanced
RiskSneaker laces can still catch in bike spokes
RiskNo glasses means eyes are exposed to road debris
Neither cyclist is fully protected. Security is always about trade-offs: reducing risk where you can, not eliminating it entirely. The same is true online.
02 | Your Information
Your Information Has Value
Everything you post publicly can be collected, combined, and used. Not just by people with bad intentions, but by automated tools that scrape public data without anyone manually looking.
Pay attention to the background. It may reveal more information than you intend.
The circles in this image highlight what a visitor could read without permission: what is on screen, notes on the wall, documents left in plain sight. The same instinct applies to what you post publicly online.
A single post may seem harmless. Combined with other public information, it can form a surprisingly complete picture of who you are, where you are, and how to approach you convincingly.
03 | Small Details Add Up
How a Picture Gets Built
Here is an example. This post was made on a public account. Click each item on the left to see how it could be used.
This post is public. To a stranger, it tells them exactly where she will be and when. To someone who knows her, it signals something else entirely: the house is unattended.
What gets collected
Current location posted publicly
Tells anyone watching exactly where the person is right now, and that they are not at home.
Travel dates and duration visible
Defines an exact window during which the home will be empty. Two weeks is a long window.
Full name on boarding pass visible
Combined with the employer or other posts, enough to craft a convincing targeted message.
Account is set to Public
Anyone can see this. Not just connections or followers, anyone searching or browsing.
Click or press Enter on each item.
How it gets used
Targeted messages that reference your name, employer, or recent posts to appear legitimate
Knowing the home is empty for a specific window of time
Fake delivery notices, security alerts, or offers timed around your travel
04 | Be Mindful
What to Watch For
Small adjustments to what you share can make a real difference. Explore each area below.
The background of a photo can reveal your home address, daily route, vehicle, or workplace without you realizing it. Street signs, license plates, house numbers, and office windows all carry information.
Risky
A photo outside your home with the house number, street sign, or parked vehicle visible.
Safer
Crop or blur identifying details before posting. Post after you leave a location, not while you are there.
People in your photos can become targets. A message referencing your child by name, or your partner's face, can be used to lower your guard in ways a generic message never could.
Via Bright Side | 12 Things You Should Be Careful With When Posting on Social Media
Risky
Full names, faces, and relationships publicly visible to anyone, not just your connections.
Safer
Share the moment without the identifying details. Keep profiles private where possible.
The specific words you use matter more than you might think. Names, nicknames, and personal details in your posts can be used in two ways: to make targeted messages more convincing, and as clues to passwords.
Via Bright Side | 12 Things You Should Be Careful With When Posting on Social Media
Risky
"In the plaza with Bobby" reveals a name, a location, and who you trust. Pet names and partner names are also common password ingredients.
Safer
"Out with a friend" shares the same moment without the details that could be used against you.
05 | How Are You Doing?
A Quick Check-In
No scores, no judgement. Answer honestly and we will show you only the tips that are relevant to you.
Do you use the same password for more than one account?
Is your main social media profile set to public?
Do you have two-step verification turned on for your important accounts?
Do you post your location while you are still there?
When did you last check your privacy settings?
On reusing passwords
Remembering one password is hard enough. Remembering twenty different ones is unrealistic, so reusing them is understandable. The problem: when one site gets breached, attackers automatically try that same email and password on every other site. It's called credential stuffing, and it's how one leak becomes five.
The easiest fix: a password manager. Apps like Bitwarden (free) or 1Password create and remember a different strong password for every account. You only remember one.
Not ready for one yet? Use a random passphrase. Four or more unrelated words are long, easy to remember, and hard to guess:
velvet-canoe-orbit-pickle
Use a different one for each important account, starting with your email.
Why not one base password with the site name added, like Summer2024_Instagram? Because if one version leaks, the pattern gives away all the others.
On public profiles
A public profile means anyone, not just people you know, can see your posts, your photos, your connections, and your location history. Most platforms make it straightforward to switch to a more private setting without losing your content.
Check your settings today. Look for "Privacy" or "Audience" in your account settings and set your default audience to Friends or Connections only.
On two-step verification
Two-step verification means that even if someone gets your password, they still cannot get into your account without a second confirmation, usually a code sent to your phone.
It takes about two minutes to set up and is one of the most effective things you can do. Look for "Two-step verification" or "Two-factor authentication" in the security settings of your email and any accounts that matter to you.
On posting your location in real time
Posting while you are somewhere tells anyone watching exactly where you are right now, and by extension, where you are not. Your home, your office, your usual route.
A simple habit: post the photo after you have left. You still share the moment, and nobody knows your current whereabouts.
On checking privacy settings
Platforms update their privacy settings regularly, sometimes in ways that reset your preferences or introduce new options. A quick check every few months takes less than five minutes and keeps you in control of who sees what.
Set a reminder once a quarter. Five minutes now can prevent a lot of unwanted exposure later.
You are in good shape! Keep doing what you are doing, and share these tips with the people around you.
Module Complete
You now see what others miss.
Awareness is the first line of defense. Not software, not firewalls. People who notice, think, and act. You are now one of them.
Three things to do today
🔒
Check your privacy settings on one platform
📱
Turn on two-step verification for your email
🤝
Share one thing you learned with someone you know
Designed and built by Ramano Stoute
Adapted from a cyber-habits session I designed and delivered to employees. Rebuilt here as a self-paced module in plain HTML, CSS and JavaScript.
