The Gray Man: Becoming Unremarkable Online

The watching is ambient. It is not a person hunched over a screen somewhere deciding to look at you, it is a thousand systems built to look at everyone, by default, all the time, because the cost of looking has fallen to roughly zero. Data brokers buy your courthouse records and your loyalty-card history. Ad networks fingerprint your browser before the page finishes loading. Breach corpora, the downstream remains of the last twenty years of compromised databases, sit in plain text on forums, indexed and searchable.

You are not paranoid for noticing this. You are simply paying the bill that comes with being a default user of the modern internet. The bill is paid in two currencies: leverage that other people quietly accumulate about you, and optionality you lose when an opportunistic attacker finally decides you are worth thirty seconds of effort.

This guide is about reducing that bill. Not to zero, that's a fantasy sold by people with hoodies on their book covers, but to a level where the systems that watch by default lose interest, and the operators who prey on credential reuse move on to easier names.

By the end of an hour with this guide you will have a working mental model of your exposure, a short prioritized list of doors to close, and three concrete actions completed this week. That is the entire promise. It is also enough.

The goal is not to disappear. The goal is to become uninteresting to the systems that watch by default.

Treat your exposure as three concentric surfaces. Work outside-in. The outer ring is the cheapest to close and the one most operators ignore for years, they jump straight to the inner ring (VPNs, hardened OSes) and leave the front door wide open.

# concentric exposure model

[ outer ]  public records · data brokers · breach corpora
[ mid   ]  platform identity · social graph · device IDs
[ inner ]  hardware · network egress · operational habits

priority:  outer → mid → inner     # cheapest wins first
cost:      $       → $$  → $$$
impact:    high    → high → marginal (without the others)

Outer is everything someone can find about you without ever touching your devices: your name in a broker's database, your old username on a forum from 2011, your email in a breach corpus from a defunct social network. Mid is your standing identity on platforms: the same handle across services, the photo that ties accounts together, the social graph that confirms it's you. Inner is your runtime, what your devices leak when they talk to the network and what your habits leak when you use them.

Threat-modeling without naming the threat is theatre. There are four broad categories of watcher most readers should care about, in descending order of how much they affect daily life:

Notice what's not on this list: targeted state-level adversaries with legal process. If that is your threat model, this is the wrong guide, you need compartmentalization, anonymity networks, and a lawyer. For everyone else, the four above are what's actually eating you.

You cannot close doors you cannot see. The first move is to run the same lightweight reconnaissance an opportunistic adversary would run. Forty minutes, a private browser window, a sheet of paper. No tools you don't already have.

1. STEP 01

   Search yourself the obvious way.

   In a fresh private window, search your full legal name, your most common nicknames, and your three most-used usernames. Do it on Google, then on Bing or DuckDuckGo, the rankings differ in informative ways. Look at images. Look at the first three pages.

2. STEP 02

   Search your email addresses.

   For each address you've used in the last decade, search the address itself in quotes. Then run each through haveibeenpwned.com. Every breach is a door someone has already walked through.

3. STEP 03

   Search your phone number.

   In quotes, with and without country code, with and without formatting. Phone numbers are the single highest-fidelity link in a broker's database, if it appears anywhere public, write down where.

4. STEP 04

   Pull breach data programmatically (optional).

   If you want a structured list, the HIBP API returns it. You'll need a low-cost API key.

   ▌ recon

   copy

   # Get a key at haveibeenpwned.com/API/Key
   EMAIL="you@example.com"
   KEY="hibp_..."
   
   curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/$EMAIL?truncateResponse=false" \
     -H "hibp-api-key: $KEY" \
     -H "user-agent: self-recon" | jq -r '.[] | "\(.BreachDate)  \(.Name)  \(.DataClasses | join(", "))"'

5. STEP 05

   Audit the data brokers serving your country.

   In the US: search yourself on Spokeo, Whitepages, BeenVerified, Radaris, Intelius, and TruePeopleSearch. In the EU and UK the equivalents are 192.com, Yasni, and the local commercial-register mirrors. Note every entry that contains your real address, phone, or relatives.

With a map in hand, close doors in the order they actually matter. The sequence below is deliberate, each step makes the next one cheaper.

4.1, Strip the brokers.

Every major broker is legally required to honor an opt-out request, though they make it tedious on purpose. You have two real options: do it yourself using a removal tracker, or pay a service to do it continuously.

For EU/UK residents, a GDPR Article 17 erasure request sent by email is legally binding and most brokers comply within thirty days. A template is below.

Subject: GDPR Article 17, Right to Erasure Request

To Data Protection Officer,

Under Article 17 of the General Data Protection Regulation (EU 2016/679),
I request the erasure of all personal data your organization holds on me.

Identifiers:
  Full name:      [YOUR NAME]
  Email:          [YOUR EMAIL]
  Postal address: [YOUR ADDRESS or "see prior records"]

Please confirm completion in writing within 30 days as required under
Article 12(3). Where data has been disclosed to third parties, please
inform those recipients per Article 19.

Regards,
[YOUR NAME]

4.2, Triage the five accounts that would actually hurt.

Most people maintain unique passwords for nothing and the same password for everything. The fix is not to fix all of them, that is the advice that has made nobody fix any of them. The fix is to identify the five whose compromise would cause real harm, and harden those first.

For each: a unique, long, random password from a password manager (Bitwarden, 1Password, or KeePassXC if you prefer local-only), and a hardware second factor, a YubiKey is the canonical choice. SMS 2FA is better than nothing, but it is not a hardware factor; it is a soft target for SIM-swap. (See YubiKeys & Hardware 2FA for the setup that sticks.)

4.3, Email aliasing: stop reusing your address.

Your email address is a primary key in every broker's database. If you sign up for everything with the same address, you have personally funded the join. The fix is per-service aliasing: every service gets a unique, revocable address that forwards to your real inbox.

# pattern: one alias per service
newegg.7f3a@yourdomain.alias  ──►  forwards to you@real.tld
reddit.91kx@yourdomain.alias  ──►  forwards to you@real.tld
that.weird.forum@yourdomain.alias  ──►  disabled

# When an alias starts receiving spam, you know exactly who leaked.
# Disable the alias. The breach can no longer reach you.

SimpleLogin (open-source, self-hostable, owned by Proton) and addy.io (formerly AnonAddy) are the two credible providers. Both offer free tiers sufficient to start. If you own a domain, use it, providers come and go.

4.4, Browser hardening: the cheapest mid-ring win.

4.5, Phone-number discipline.

Your real phone number should reach exactly three categories of recipient: people you know, your bank, and your government. Everyone else gets a secondary number. This is the single biggest reduction in broker-graph quality you can make.

• MySudo

  ref ↗

  Disposable numbers · iOS/Android · paid

  Up to nine numbers per account; clean UI; US/CA/UK numbers.

• JMP.chat

  ref ↗

  XMPP-routed real number · cross-platform

  Pays out to a Jabber account you control; cheap; Canadian.

• Google Voice

  ref ↗

  Free US-only secondary number

  Acceptable for low-stakes signups; do not use for 2FA.

• Travel/secondary eSIM

  A second SIM on your existing phone

  Carry one number for life, one for everything else.

4.6, Social-graph minimization.

Closure without verification is hope, not engineering. Two weeks after you start, repeat the self-recon from § 03 and diff the results. You are looking for three things:

# Visit in the browser you've hardened:
$ open https://coveryourtracks.eff.org

# What to look for in the report:
#   Tracker domains blocked:   ✓
#   Fingerprint uniqueness:    "randomized" or "partially protected"
#   Canvas fingerprint:        "spoofed" or blocked

The most important section. The credibility of any security guide is the honesty of its limits. If a guide does not have a section like this, distrust it.

The Gray Man discipline is the outer ring. Once you have a clean baseline, three guides build on it in the order most operators take:

• NEXT IN TRACK

  Self-OSINT: Find Yourself Before They Do →

  The same recon, deeper and structured.

• IDENTITY HARDENING

  YubiKeys & Hardware 2FA →

  Kill the phishable login.

• SELF-HOSTING

  Your First Private Server →

  Stop being a tenant.