Safety and Security for Streamers
You don't have to be a big-time streamer to end up the victim of online harassment, stalking, or identity theft. Just one person with too much time on their hands can uncover your real-life identity and pose a significant safety risk. The hard truth? Your information is never 100% secure. It's not a matter of whether someone can find your information, but when. However, understanding the basics of Internet security minimizes your risks and makes it harder for someone to exploit your personal information.
There are two main privacy concerns:
“If you happen to tell me where you were born, your date of birth and that kind of information, then I'm 98 percent of the way to stealing your identity,” said Frank Abagnale, better known as the real-life inspiration behind the con man movie Catch Me If You Can. While most people know better than to reveal their full name, birthplace, and birthday to complete strangers, streamers often let their guards down when it comes to the same pieces of information. That may be because Twitch gives you an illusion of control: you can time out users or even ban them, but you can't actually stop anyone from watching your stream. Here are some ways to keep yourself safe when you don't know who's watching. Strap yourself in; this article is a bit of a ride.
There are two main privacy concerns:
- Doxxing, or maliciously using online information to find out a real-life identity. Doxxers may want to cause you actual harm, or they might just really, really want to be your friend.
- Identity theft. This involves stealing (or being given!) pieces of personal information, then using them to open new bank accounts, credit cards, and more. Resolving identity theft can be a messy, expensive, years-long disaster.
“If you happen to tell me where you were born, your date of birth and that kind of information, then I'm 98 percent of the way to stealing your identity,” said Frank Abagnale, better known as the real-life inspiration behind the con man movie Catch Me If You Can. While most people know better than to reveal their full name, birthplace, and birthday to complete strangers, streamers often let their guards down when it comes to the same pieces of information. That may be because Twitch gives you an illusion of control: you can time out users or even ban them, but you can't actually stop anyone from watching your stream. Here are some ways to keep yourself safe when you don't know who's watching. Strap yourself in; this article is a bit of a ride.
Maintain basic account security
Never give anyone else your Twitch password. Set up two-factor authentication to help prevent others from accessing your account. Make your password complex, and change it regularly. You don't need a fancy program to manage your passwords. Just buy a small notebook at the dollar store, write your passwords down in it, then keep the hard copy in a safe place.
Avoid using your real name in
primary OR secondary accounts
If you've already created a brand with your full name, it may be too late to change. However, if you're just getting started or you haven't made your channel yet, consider a Twitch username (and overall brand) that has no relation to your real name. But it doesn't stop there. Make sure that your social media accounts are similarly branded. It defeats the purpose of avoiding identifying names if your Twitch panel links to an Instagram account that has your full first and last name.
Create a new email address
...and put your gaming name in the name field. When you send an email to someone, they typically see both the actual email address and the name associated with it. So if you're creating a new account with, say, Gmail, your first and last name should be your gaming name (like Super Phrenic or Superphrenic Streams), rather than your actual name.
Don't put your real name on anything, actually
Some other sites and apps also ask you for your real name as part of your profile. Be aware that filling in this information can make you vulnerable. For example, if you put your real name on Snapchat, you can't change it; you can only delete the account. In the meantime, everyone who adds you will see your real name every time you snap. On Slack, there's a similar issue. If you put your real name in your profile, then whenever anyone @s you, your real name will pop up. If you intend to use the account for streaming purposes (or you think there's a chance), then err on the side of caution.
Create a PayPal business account
Most streamer-related donation sites let donators see the full name on your account. On StreamLabs, users don't even have to donate; the final step before payment shows your full name. Fix this by upgrading your personal PayPal account to a business one. The process costs nothing and takes only a few minutes. Changing to a business PayPal account is largely a cosmetic change with no legal implications. If you are interested in registering as a small business, contact the relevant government office in your area.
Keep your name out of the WHOIS database
Buying a custom URL for your website requires your personal information. This information is archived in the WHOIS database. In many (but not all) countries, you can buy privacy protection to keep your info from actually showing up in the database. Depending on your domain name registrar, privacy protection may be included or cost only a few dollars per year.
Pick a different birthday
Sound strange? Stick with me. Your birthdate is one of the most basic pieces of information used to verify your identity. Sharing the day and your age also gives away your birth year. Even sharing only the day can pinpoint the year if you give away other age clues, such as the year you graduated high school. The easiest fix? Just pick a different birthday.
In Twitch terms, a birthday is a really a free day for self-promotion or an excuse to host a big event. However, many people don't want to do 12-hour streams on their actual birthdays, and you don't have to. Just pick a day that's easy to remember and works with the other stories you might share. If you're a Boston-based streamer who claims your last birthday was ruined by a blizzard, it doesn't make sense to follow that up with a claim about a July birthday.
In Twitch terms, a birthday is a really a free day for self-promotion or an excuse to host a big event. However, many people don't want to do 12-hour streams on their actual birthdays, and you don't have to. Just pick a day that's easy to remember and works with the other stories you might share. If you're a Boston-based streamer who claims your last birthday was ruined by a blizzard, it doesn't make sense to follow that up with a claim about a July birthday.
Be aware of cross-referencing
Malicious viewers don't need you to share explicitly identifying personal information. They only need you to share enough general pieces of information to track you down. It's easier to see this in practice.
Let's say that you've mentioned that you go to a university in Austin, Texas. That, in itself, is not enough to identify you. But if you mention that you're on the volleyball team and you just won a game last night? The pool shrinks to the handful of teams that played yesterday. And if you mentioned that you're a business major? Well, how many business majors on Austin university volleyball teams won a game last night?
Now, this isn't meant to scare you into never releasing any of your personal information. Rather, it's a reminder that safety is not an afterthought and information security doesn't just happen. You need to be aware of how your information could be used, and choose what information you really want to give away.
Let's say that you've mentioned that you go to a university in Austin, Texas. That, in itself, is not enough to identify you. But if you mention that you're on the volleyball team and you just won a game last night? The pool shrinks to the handful of teams that played yesterday. And if you mentioned that you're a business major? Well, how many business majors on Austin university volleyball teams won a game last night?
Now, this isn't meant to scare you into never releasing any of your personal information. Rather, it's a reminder that safety is not an afterthought and information security doesn't just happen. You need to be aware of how your information could be used, and choose what information you really want to give away.
Remove personal data from images
Photos taken with a smartphone usually contain EXIF data. Depending on the phone and settings, EXIF data may reveal the exact date, time, and location of the photo, as well as the personal identification number of the phone. To be safe, run your images through a program like Imgur before posting photos to your gaming brand accounts. Imgur strips the metadata from the image and leaves you with just the picture. The best part? The site is free and the process takes only seconds. Plus, there's an app version so you can safely share your pictures on the go.
Avoid photo redundancy
Services like Tineye allow anyone to upload an image, then search the Internet for other uses of the same image. This can put your information at risk if you use the same photos for both your personal and gaming accounts. Solve this problem by taking a few extra photos when you go out. At an amusement park? Take a selfie by the entrance for your personal account, then get another shot by the log flume for your brand.
Same goes for your IRL friends
Integrating real-life friends with your online ones can be hard enough without bringing security into the mix. You can undo all your hard work with a single retweet of a friend's photo that leads to geographic information. If you plan on playing or talking with IRL friends, give them a brief rundown on avoiding real names, identifying details, and geo-tagged photos (or better yet: show them this article!). While discussing internet safety might be awkward, online security is important for everyone, not just streamers.
Consider a P.O. box...but not one in your town
For medium or big streamers who want to receive packages from viewers, a P.O. box is a great alternative to sharing your personal address. However, the town listed on your P.O. box can be cross-referenced with other things you talk about on stream and help pinpoint your location.
Hmm, if you're complaining about people parking on your dead-end street to get to a soccer game, how many dead ends next to soccer fields exist in that town? The ideal P.O. box is in a larger city a few zip codes over from your own, but close to family, school, work, a doctor, or other location you visit frequently. Balance convenience with your safety.
Hmm, if you're complaining about people parking on your dead-end street to get to a soccer game, how many dead ends next to soccer fields exist in that town? The ideal P.O. box is in a larger city a few zip codes over from your own, but close to family, school, work, a doctor, or other location you visit frequently. Balance convenience with your safety.
Remove your info from free online databases
This is a great privacy tip in general, but it takes far more effort than the other tips on this list. Sites like Spokeo, Pipl, and White Pages make their money by collecting huge amounts of names, addresses, social media accounts, and other information, then selling access to this information.
While removing your information from these databases is usually free, it can be incredibly time-consuming. Removal procedures range from a simple online form to signed, faxed paperwork with a copy of a government-issued ID. One tip? Check a major list like this one and remove yourself from a site each day. Alternatively, save it for a rainy day (or month).
While removing your information from these databases is usually free, it can be incredibly time-consuming. Removal procedures range from a simple online form to signed, faxed paperwork with a copy of a government-issued ID. One tip? Check a major list like this one and remove yourself from a site each day. Alternatively, save it for a rainy day (or month).
Start now...and don't stop!
The best time to consider security is before you start streaming. The second-best time is right now. Even if you've already launched your brand, it's not too late. These tips can help improve your security at any point in your streaming career, as long as you commit to them. While taking shortcuts might save you some time today, inconsistency will make you vulnerable in the long run.
This is far from an exhaustive list of ways to protect yourself online, but it's a good primer for any new streamer. Have more security tips? Let me know on Twitter or at admin [at] superphrenic [dot] com.