Latest / Logosofia no Dia a Dia / Flood the Zone: Obfuscation as Privacy Strategy
Transcript
- [Prompt] custom: In previous episodes, we've talked about privacy protection and social engineering. We did one episo | Hosts: corn, herman [Response] Corn: Daniel sent us this one, and it's a fun question. What if the best way to protect your real address isn't locking it down — but publishing a fake one, loudly and convincingly? He's asking about obfuscation as a privacy strategy. Not passive defense, not red-teaming your own leaks — but offensive noise. Seeding false information into the digital ecosystem so anyone trying to trace you hits a wall of plausible decoys. Herman: And this is genuinely the next logical step. You can opt out of every data broker, scrub your records, use encrypted everything — and still have breadcrumbs out there you can't delete. Public records, old forum posts, that one newsletter you signed up for in two thousand fourteen. Obfuscation says: fine, leave the breadcrumbs. Just flood the forest with so many fake trails that nobody knows which one leads to the gingerbread house. Corn: Which is a deeply satisfying mental image. The witch from Hansel and Gretel, except she's an OSINT investigator, weeping into a spreadsheet. Herman: And the thing Daniel's getting at — the fake nonprofit with the fake address that ranks high in search — that's not hypothetical. People are doing this. Privacy researchers, journalists in hostile environments, domestic abuse survivors. The core idea is simple: if someone searches your name plus "address," the first result they hit is the decoy, not the real thing. And most people stop at page one. Corn: Where do we even start with this? Herman: Let's define the thing first, because obfuscation in a privacy context is specific. It's not hiding data. It's flooding the zone with plausible-looking noise until the signal-to-noise ratio collapses for whoever's investigating. Think of it like... if someone's trying to follow your footprints in the snow, you don't erase your tracks. You put on fifty pairs of boots and walk in every direction. Corn: The key word there is "plausible." You can't just type gibberish into a form and hope Google indexes it. The decoy has to look real enough that an automated scraper or a lazy investigator treats it as a valid data point. Herman: A VPN protects data in transit — it's a tunnel. Encrypted messaging protects the content of your communications. Obfuscation protects data at rest in public registries, search indexes, data broker databases. It's a completely different layer of the stack. Corn: It's worth saying upfront — because Daniel specifically raised this — we're talking about creating fictional entities and personas. Not impersonating real people. Not committing fraud. The line is clear: you can invent a nonprofit that doesn't exist. You cannot pretend to be your neighbor. Herman: That distinction matters legally and ethically. We'll dig into the risks later, but for now, assume everything we describe sits on the right side of that line. No identity theft, no soliciting donations under false pretenses, no filing fake tax returns. Corn: Let's get into the mechanics. How do you actually build a fake persona that survives scrutiny? Walk me through the domain registration piece, because I think that's where most people would start. Herman: Okay, step one: you pick a name for your fake entity. It needs to be boring. That's the first rule. "The Elm Street Community Garden Initiative." "The Maple Avenue Neighborhood Association." Something that sounds like it was founded by three retired librarians and a part-time accountant. Nothing flashy, nothing that invites curiosity. Corn: The "Community Garden Initiative" is the beige Corolla of fake nonprofits. Nobody looks twice. Herman: You register a dot-org domain — dot-org still carries that nonprofit connotation, even though anyone can register one. You enable WHOIS privacy protection, which most registrars include for free now. That hides your real name and address from the public WHOIS database. Then you build a minimal website. And "minimal" doesn't mean one page with lorem ipsum. Google's E-E-A-T algorithm — Experience, Expertise, Authoritativeness, Trustworthiness — that update dropped in December twenty twenty-two, and it specifically penalizes thin or low-authority content. Corn: The fake nonprofit needs to look like it actually does something. Herman: It needs at least three to five substantive pages. An About page with a mission statement. A "Meet the Team" page with stock photos and fake names. An Events page with past dates — "Spring Planting Day, April twelfth, twenty twenty-five." A blog post about community gardening trends. You don't need to write a dissertation. But the site has to pass a basic sniff test. Google's crawlers are looking for depth, and so are the data broker scrapers that pull from public web sources. Corn: Daniel mentioned using a number that doesn't exist on a real street. Herman: That's the safest approach. Pick a real street in your city — Elm Street, Maple Avenue, whatever — and then choose a street number that doesn't correspond to any actual building. Check it against Google Maps and your county's property tax database to make sure it's vacant or non-existent. The last thing you want is to accidentally send mail or visitors to someone's actual house. Corn: That's a non-trivial failure mode. You invent a fake address, some data broker scrapes it, and suddenly a real family at that address starts getting collection letters or process servers showing up. Herman: Which is why you verify. Spend ten minutes on the county assessor's website. It's tedious but essential. Once you've confirmed the address is phantom, you put it everywhere on the site — the footer, the contact page, the event listings. Consistency is everything. If the address on your About page says "one two three Main Street, Apartment four" and the contact page says "123 Main St, #4," that inconsistency can trigger spam filters and kill your search ranking. Every instance has to match exactly. Corn: The website is the anchor. What comes next? Herman: You seed the fake address into the broader ecosystem. Submit the nonprofit to Google Business Profile, Bing Places, Yelp, your local chamber of commerce directory. These are all free or low-cost. Each one creates another indexed page that reinforces the address. You set up a burner phone number — Google Voice works, or a prepaid SIM — that forwards to a voicemail with a generic greeting. "You've reached the Elm Street Community Garden Initiative. Leave a message and we'll get back to you." Nobody ever will, but the voicemail exists, and that's enough to pass a basic verification check. Corn: Then the link-building piece, which I assume is where the real SEO work happens. Herman: You create social media profiles for the nonprofit — a Facebook Page, a Twitter account, maybe a LinkedIn company page. You post occasional content. "Reminder: community cleanup this Saturday!" with a stock photo of people holding trash bags. The goal isn't to build a following. It's to generate backlinks and social signals that tell Google this entity is real and active. You can also submit the site to free directory listings — local business directories, nonprofit registries, community bulletin boards. Each one is another data point. Corn: How long does this take before the fake result starts outranking the real one? Herman: There's a case study from a privacy researcher who did exactly this. Registered a fake neighborhood watch — "The Maple Street Neighborhood Watch" — built the website, seeded it across twelve directories, posted sporadically on social media. Within six weeks, a Google search for their real name plus "address" showed the fake nonprofit on page one. The actual data broker result — the one with their real home address — got pushed to page two. Corn: Six weeks is faster than I'd expect. Page two might as well be the moon for most people. Herman: That's the whole point. Most investigators — whether it's a stalker, a journalist, a private investigator — they're not going past page one. They're certainly not cross-referencing property tax records unless they have a reason to be suspicious. A plausible-looking nonprofit with a real website and directory listings doesn't trigger suspicion. It triggers "okay, found it, moving on. Corn: The fake nonprofit is the address decoy. But Daniel also asked about other techniques — phone numbers, emails, the broader persona web. What else is in the playbook? Herman: The same principle applies to any piece of personally identifiable information. For phone numbers, you create a fake freelance business — "Corn's Leaf Medicine Consulting," whatever — and register it with a Google Voice number. You build a minimal website, list the number on freelance directories, create a LinkedIn profile. Now when someone searches your real name plus "phone number," they hit the consulting business instead of your personal cell. Corn: I appreciate that you used my leaf medicine as the example, but I should point out that leaf medicine consulting is a real and ancient profession that — Herman: That you invented and no medical board recognizes, yes, I know. The point stands. For email obfuscation, you create a fake professional association membership. Register a domain for something like "The American Society of Independent Researchers," set up email addresses for the officers, list your fake persona as a member. Data brokers scrape membership directories constantly. Your real email gets buried under a pile of decoy addresses. Corn: Each of these personas needs its own ecosystem? Separate phone, separate email, separate social accounts? Herman: If all your fake personas share the same phone number, a simple cross-reference collapses the whole web. The sophistication of the decoy network has to match the sophistication of the investigator you're worried about. A casual stalker might be fooled by one fake address. A determined OSINT investigator with automated tools will spot the seams unless the personas are siloed. Corn: Which raises the effort question. Building and maintaining even one fake persona with a website, social media, and directory listings — that's not a weekend project. Three personas starts to look like a part-time job. Herman: And that's the tradeoff. Privacy through obfuscation scales with effort. One decoy is better than zero. Three interconnected decoys with cross-referencing backlinks create what researchers call a "credibility cascade" — each fake persona reinforces the others, and even automated OSINT tools struggle to unravel it. But you're talking about maintaining multiple websites, multiple phone numbers, multiple social profiles. There's a point of diminishing returns for most people. Corn: Let's talk about the data broker side of this, because I think that's where the knock-on effect get interesting. What actually happens inside Spokeo or Whitepages when they scrape conflicting data? Herman: This is where obfuscation gets clever. Data brokers scrape over twelve billion public records annually — that's from their own marketing materials — and their whole business model depends on deduplication. They pull in records from hundreds of sources, and they have to figure out which records refer to the same person. When they hit conflicting address data — your real address from a utility bill, your fake nonprofit address from a web scrape, a second fake address from another persona — their algorithms have to make a call. Corn: The call is often "we don't know. Herman: A twenty twenty-five study from the University of Washington found that seventy-three percent of data broker records already contain at least one inaccuracy. The system is noisy by default. Obfuscation exploits that existing noise. The deduplication algorithm might merge the conflicting records into one garbled profile. It might flag the record as "unverified" and suppress it from search results. It might drop the record entirely. Any of those outcomes reduces the value of that data to an investigator. Corn: You're not just hiding your real address behind a fake one. You're poisoning the data broker's confidence in their own dataset. Herman: That's the strategic layer. You're not playing defense — you're making the entire dataset less reliable for anyone trying to use it against you. And the more decoys you seed, the worse the signal-to-noise ratio gets. An investigator now has to call the phone number, cross-check property tax records, verify the nonprofit's IRS status if you registered it as a five-oh-one-c-three. Each additional decoy multiplies the investigation time. At some point, they either give up or move on to an easier target. Corn: The IRS piece is worth highlighting, because that's where the legal line gets real. You can file Form ten-twenty-three-EZ, the streamlined five-oh-one-c-three application, for two hundred seventy-five dollars. It can be done entirely online. But it requires a real Employer Identification Number, and there are fraud penalties if you're using the tax-exempt status for something illegal. Herman: And this is where I want to be very clear. Filing for five-oh-one-c-three status for a fake nonprofit that does no charitable work — that's entering a gray zone at best. The IRS doesn't care that your community garden initiative is fictional. They care that you're not soliciting donations, not claiming tax deductions, and not using the status to defraud anyone. If you're just letting the registration sit there as a credibility signal for search algorithms, you're probably fine. Corn: The safer play is to skip the IRS registration entirely. A dot-org domain and directory listings don't require tax-exempt status. Herman: The IRS filing is the nuclear option for credibility, and it comes with nuclear-level risks. Most people don't need it. The website, the directories, the social media — that's enough to fool a search algorithm and a casual investigator. Corn: What about the payment trail? Domain registrations and web hosting leave a paper trail. If someone really wants to trace the fake nonprofit back to you, can't they just follow the money? Herman: They can try. Most registrars accept prepaid Visa gift cards or virtual card services like Privacy dot com, which let you generate single-use or merchant-locked card numbers. It's not foolproof — determined investigators with legal tools can still trace things — but it raises the cost and complexity significantly. For most threat models, a prepaid card is sufficient. Corn: The playbook, summarized: pick a boring name, register a dot-org with WHOIS privacy and a prepaid card, build a three-to-five-page website with a verified non-existent address, seed it across directories and social media, post occasionally, wait six weeks. And you've got a page-one decoy. Herman: That's the basic recipe. And it works because it exploits a fundamental asymmetry. You know which address is real and which is fake. The investigator doesn't. They have to treat every data point as potentially valid until proven otherwise. You've turned their investigation into a verification problem, and verification is expensive. Corn: Which brings us to the scaling question. If one decoy is good, is a web of interconnected decoys better? And what are the actual failure pattern when this goes wrong? Herman: A single decoy might get flagged as an outlier and filtered out. But a web of three or four mutually reinforcing personas creates something that even sophisticated scrapers struggle to dismiss. The tool sees consistency across domains, phone numbers, addresses, social profiles. It doesn't know the whole cluster is fabricated. It just sees a coherent entity cluster and moves on. Corn: The decoy network isn't just hiding the real data. It's creating an alternative reality that looks more complete and more consistent than the messy, incomplete real one. Herman: Real personal data is actually pretty noisy. You've moved apartments, changed phone numbers, used different email addresses over the years. Data brokers already struggle to assemble a clean profile. That University of Washington study finding seventy-three percent of records contain inaccuracies — that's the baseline. Obfuscation doesn't create noise in a clean system. It amplifies noise that's already there. Corn: You're not poisoning a pristine dataset. You're dumping more garbage into an already messy landfill and hoping your specific garbage buries the thing you care about. Herman: That's a less elegant metaphor than I'd use, but yes. And it works because of how deduplication algorithms function. When a broker scrapes conflicting data, the algorithm faces a choice. Merge them into one garbled profile. Flag the record as unverified and suppress it. Drop it entirely. Any of those outcomes reduces the data's value to an investigator. And "unverified" is the magic word, because unverified records don't surface in paid reports. If their confidence score drops below a threshold, the record becomes inventory they can't sell. Corn: Let's talk about where this breaks, because the failure pattern are as interesting as the strategy. You mentioned verifying the fake address against property records. What happens if you skip that step? Herman: Best case, nothing. Worst case, you've invented an address that belongs to a real person, and now they're getting your blowback. Process servers, collection agencies, angry ex-partners showing up at their door. You've protected yourself by redirecting harm to an innocent stranger. That's not a privacy strategy — that's just outsourcing your problems to someone with no say in the matter. Corn: Legally, that's probably negligence at minimum. Herman: The county assessor check is ten minutes. There's no excuse for skipping it. Second failure pattern: the payment trail. If you used your real credit card, a subpoena to Namecheap or Cloudflare pulls your name instantly. Privacy dot com virtual cards or prepaid Visa gift cards break that link. It's not bulletproof, but it raises the bar from "type a command" to "get a court order. Corn: The third one is the IRS trap. You file Form ten-twenty-three-EZ, pay two hundred seventy-five dollars, get your EIN, and now you've created a paper trail with the federal government for a nonprofit that does nothing. What's the actual exposure there? Herman: The IRS doesn't proactively audit tiny nonprofits that file no returns and solicit no donations. The risk isn't an audit. The risk is that if you ever end up in litigation — a custody battle, a defamation suit, whatever — and the other side's lawyer discovers you created a fake tax-exempt entity, it looks terrible. It reads as fraudulent, even if your intent was purely privacy-related. A jury doesn't understand the nuance of obfuscation strategy. They understand "you lied to the IRS. Corn: The juice isn't worth the squeeze on the IRS piece for almost anyone. Herman: For almost anyone. The dot-org domain, the website, the directories, the social media — that's already enough. The IRS filing is overkill with disproportionate downside. Corn: One more failure pattern: jurisdictions. Some states have laws about creating fictitious business names without registering them. Some countries have stricter rules. If you're outside the US, the legal landscape might be completely different. Herman: That's the "consult local law" asterisk that applies to this entire conversation. What's defensible in California might be fraud in Germany. The principle is universal, but the implementation has to be local. Corn: Given all that complexity — the domain registration, the directory seeding, the link-building, the legal tripwires — what does someone actually do on Monday morning? If a listener hears this and thinks "I want to try this," where do they start without drowning? Herman: Start comically small. Pick one piece of personally identifiable information you want to protect — your home address is the obvious one, because it's the hardest to scrub from public records. Don't try to build a three-persona credibility cascade on day one. Build one fake nonprofit. That's it. One boring name, one dot-org domain, one verified non-existent address, three to five pages of content, and a handful of directory listings. Corn: Then measure whether it's working. Search your real name plus "address" once a month and track which result ranks higher. If the decoy isn't moving up, you need more backlinks or more content. If it's on page one after six weeks, congratulations — you've successfully buried your real address for anyone who isn't willing to dig to page two. Herman: The second thing, and I cannot stress this enough, is consistency. If your fake nonprofit's address is "one two three Main Street, Apartment four," then every single directory listing, every social profile, every backlink, every footer on every page of the website uses exactly that string. No abbreviations, no variations. Inconsistency is the fastest way to tank your ranking. Google's local search algorithm treats address format mismatches as a trust signal — and not the good kind. Corn: It's the digital equivalent of showing up to a job interview with two different shoes. Nobody trusts you after that. Herman: And the third piece is the one people skip because it's less exciting: pair obfuscation with traditional privacy hygiene. Obfuscation is a complement, not a replacement. You should still be opting out of data broker databases — Whitepages, Spokeo, BeenVerified, the whole list. You should still be using privacy-focused browsers, minimizing what you share on social media, keeping your real address off public-facing forms. Obfuscation catches what the opt-outs miss. It's the safety net, not the whole circus. Corn: Because if you're sloppy everywhere else — posting your real address on Facebook, signing up for newsletters with your actual home address — you're just shoveling data into the system faster than your decoys can bury it. Herman: The decoy strategy works when the real data is a trickle and the fake data is a flood. If the real data is also a flood, you're just adding noise to noise, and the investigator can still find the signal by cross-referencing enough sources. Obfuscation amplifies the effectiveness of good hygiene. It doesn't compensate for bad hygiene. Corn: Where does this leave us? The playbook works today — a fake nonprofit, directory seeding, six weeks to page one. But the thing I keep coming back to is the arms race. AI-powered OSINT tools are getting better at cross-referencing property tax records with utility bills, with satellite imagery, with the kind of data that a fake website can't spoof. How long before the decoy strategy stops working? Herman: That's the uncomfortable question. Right now, most automated OSINT tools — Maltego, SpiderFoot, the commercial platforms — they're pattern matchers. They look for consistency across sources. A well-constructed decoy web looks consistent, so it passes. But the next generation of tools is starting to incorporate what researchers call "ground truth verification." Cross-referencing against government databases that you can't seed fake data into. Property tax assessor records. Voter registration rolls. Utility hookup records. Those are hard to spoof without committing actual fraud. Corn: The window might be closing, or at least narrowing. What replaces it? Herman: I think the next frontier is what some privacy researchers are calling "data poisoning at the broker level." Instead of seeding individual decoys, you automate the submission of conflicting data directly into broker databases at scale. There are tools emerging that let you submit hundreds of slightly conflicting records to Spokeo, Whitepages, BeenVerified — different addresses, different phone numbers, different relatives — until their deduplication algorithms just give up on your profile entirely. The record doesn't get suppressed. It gets so garbled that it's functionally useless. Corn: You're not building a decoy. You're turning your own data broker profile into digital static. Herman: And that's where I think this is heading. Not one convincing fake, but a thousand unconvincing ones that collectively destroy the profile's coherence. It's messier, but it scales in a way that building fake nonprofits doesn't. Corn: The other direction that keeps me up — and this gets ethically blurry fast — is extending the noise strategy beyond addresses. Imagine seeding fake medical symptoms into health data brokers. Fake browsing history into ad profiles. Fake political donations into public records. The same principle applies anywhere there's a database that profiles you. But the line between "protecting my privacy" and "creating a false public record" gets harder to see. Herman: And I don't think we have good answers yet. Address obfuscation is relatively clean because you're protecting a physical safety interest — someone showing up at your door. Medical data, browsing history, political activity — those are identity-layer concerns. Seeding false data there doesn't just frustrate investigators. It pollutes datasets that researchers, journalists, and policymakers rely on. The externalities are real. Corn: Maybe the question Daniel's prompt really opens up is: how much noise are we willing to live with? Not just as individuals protecting ourselves, but as a society that depends on some baseline of accurate information. Herman: That's the tension that makes this whole topic more than a how-to guide. It's legal in most cases. It's effective against the current generation of OSINT tools. But it's also an admission that the system is broken — that opting out doesn't work, that regulation hasn't caught up, that the only way to protect your data is to make everyone's data less reliable. That's not a solution. It's a symptom. Corn: A symptom that we're all going to be managing for a long time. Herman: And on that cheerful note — Hilbert, I believe you have something for us? And now: Hilbert's daily fun fact. Hilbert: In the nineteen twenties, a Soviet geologist on the Kamchatka Peninsula discovered that fulgurite — glass formed when lightning strikes sand — produces a distinct ringing tone when struck, similar to a tuning fork, due to the rapid cooling locking internal stress into the silica structure. Corn:...a tuning fork made by lightning. Alright. Herman: I have no follow-up. Corn: This has been My Weird Prompts. Thanks to our producer Hilbert Flumingtop. If you want to send us your own weird prompt — and clearly Daniel has set the bar — email the show at show at my weird prompts dot com. Herman: Until next time.