XFTFSecurity For the Folks

Lesson 5.2

Social Media & Online Communities

Learning Objectives

  • Identify what information each major platform exposes publicly, and to whom (logged-in vs. logged-out viewers)
  • Recognize platform features that notify the person you’re looking at (a major OPSEC risk)
  • Explain how API shutdowns and policy changes since 2019 have changed social media OSINT
  • Describe how “non-social” apps (fitness, payments, reviews) leak location and relationship data
  • Apply the ethical limits on researching real people through social media

Why Social Media Matters (and Why It’s Sensitive)

Social media is where people voluntarily publish the details of their lives: where they work, who they know, where they go, what they look like, and what they care about. For OSINT this is often called SOCMINT (social media intelligence).

For attackers, it’s the raw material of social engineering: a phishing email that mentions your new manager, your recent conference trip, or your dog’s name is far more convincing. For defenders, it shows what employees are exposing about the organization.

Two cautions shape everything in this file:
1. Platforms change constantly. Features, privacy defaults, and API access change every year. Any technique here should be tested right before class.
2. These are real people. Researching individuals on social media is where OSINT most easily becomes stalking. In this class, only research yourself, consenting classmates, or instructor-provided personas (see Module 2).

Cross-Platform Patterns

Before going platform by platform, a few things apply almost everywhere:
- Login walls: most major platforms now show little to logged-out visitors. Researchers who need to log in use separate research accounts, which raises Terms of Service and OPSEC issues (see Module 2 and Module 8).
- Search engines index some content. site:linkedin.com/in "Company X" or site:instagram.com "keyword" can find public profiles without logging in.
- Usernames get reused. People use the same handle across platforms, which enables pivoting. Tools like WhatsMyName and Sherlock check hundreds of sites for a username (see Module 4).
- Photos leak more than captions: backgrounds show badges, screens, street signs, house numbers, and landmarks. Most big platforms strip EXIF metadata on upload, but the visual content remains.
- Friends and followers expose people who never posted anything. A private person’s family and workplace can often be mapped from their connections’ public posts.

Platform-by-Platform

LinkedIn

  • What’s public: name, photo, headline, current and past employers, job titles, education, skills, certifications, posts, and connections (depending on settings). Company pages include a “People” tab listing employees who list that company.
  • Why it matters:
  • Builds org charts and employee lists for phishing campaigns (or authorized phishing simulations)
  • Reveals email address formats when combined with known addresses
  • Skills and job histories reveal the tech stack (“5 years administering Palo Alto firewalls and CrowdStrike”)
  • Visibility gotcha: “Who’s viewed your profile.” LinkedIn has three viewing modes:
  • Your name and headline: the person sees exactly who you are
  • Private profile characteristics: they see something like “someone at Company X”
  • Private mode: they see only “LinkedIn Member”
  • On a free account, browsing in private mode also hides your list of profile viewers
  • Tips: most profile browsing requires login. LinkedIn’s User Agreement prohibits scraping and fake accounts, and LinkedIn enforces it (the hiQ v. LinkedIn case is covered in Module 2).

Facebook

  • What’s public (varies by settings): profile and cover photos, friends list, workplace, education, hometown and current city, check-ins, public posts, group memberships, events, and Marketplace listings (which show an approximate location).
  • Big change: Graph Search shutdown (June 2019). Facebook’s Graph Search let investigators build precise URL-based searches (“photos liked by X”, “people who work at Y and live in Z”). Facebook disabled it on June 7, 2019, and many OSINT tools broke overnight. Many older tutorials still describe these techniques; they no longer work.
  • Researcher access: Meta shut down CrowdTangle (a widely used monitoring tool for public Facebook and Instagram content) on August 14, 2024. Its replacement, the Meta Content Library, requires an application and is limited to qualified academic and nonprofit researchers.
  • Tips: most content requires login. Public groups and pages are often more revealing than individual profiles.

Instagram

  • What’s public (for public accounts): photos and videos, captions, location tags, tagged photos, follower/following lists, highlights, and Reels.
  • Visibility gotchas:
  • Story viewers are visible to the account owner. Viewing a target’s story from an identifiable account tells them you looked.
  • Accidentally liking or following is an easy mistake on mobile.
  • Tips: location tags and tagged photos (photos other people posted of the user) are frequently more revealing than the user’s own posts.

X (formerly Twitter)

  • What’s public: posts, replies, likes (hidden from others since 2024), follower/following networks, profile bio and location field, join date.
  • Advanced search (x.com/search-advanced or operators):
  • from:username, to:username, @username
  • since:2025-01-01, until:2025-02-01
  • "exact phrase", -exclude, filter:media, min_faves:100
  • Big change: API went paid (2023). In February 2023 Twitter ended its free API tiers with about a week’s notice and introduced paid tiers; the academic research track was also removed. Many free OSINT and research tools that relied on the API stopped working. X’s API pricing has continued to change since, so check current terms before relying on any tool.
  • Tips: viewing and searching generally requires an account now (verify before class).

TikTok

  • What’s public: videos, captions, sounds, comments, follower counts, and some likes.
  • Why it matters: videos often show homes, schools, workplaces, vehicles, and neighborhoods. Audio can reveal language, accent, and background events. Comments reveal relationships.
  • Tips: TikTok has web search. Download or archive videos you need as evidence (if authorized), since they’re frequently deleted.

YouTube

  • What’s public: videos with exact upload dates, titles, descriptions, comments, channel “About” information, playlists, and channel creation dates.
  • Why it matters: conference talks, product demos, and employee vlogs reveal internal details. Old videos can show offices, badges, and screens. For verification (Module 7), the upload date is a key piece of evidence.
  • Tips: thumbnails can be reverse-image searched to find where footage first appeared (see Module 4).

Reddit

  • What’s public: posts and comments tied to a pseudonymous username, subreddit participation, account age, and karma.
  • Why it matters: people who feel anonymous overshare. Participation in local subreddits (a city, a university, an employer) can narrow down location and workplace; details spread across years of comments can add up to an identity (the mosaic effect from Module 2).
  • Big change: API pricing (2023). Reddit began charging for its API in 2023 (free access continues for moderation tools and some academic research). Pushshift, the archive many researchers used to search deleted and historical Reddit content, lost public access in May 2023 and is now restricted to verified moderators.
  • Tips: Reddit’s own search is weak; use site:reddit.com queries on search engines. Reddit has also added options for users to hide content from their profile (verify current behavior before class).

Discord

  • What’s public: very little from outside. Content lives inside servers, and you must join a server to see it.
  • How servers are found: invite links posted on websites, social media, and forums; Discord’s built-in Server Discovery for large community servers; and third-party server directories.
  • Tips: joining a server is an interaction, not passive research. Your account becomes visible in the member list. Treat it as an OPSEC and authorization question.

Telegram (public channels only)

  • What’s public: public channels and public groups (their names, posts, and for groups, members and messages). Private chats and private groups are not OSINT sources.
  • Access without an account: t.me/s/<channelname> shows a public channel’s recent posts in a normal browser.
  • Why it matters: Telegram public channels are a major source for news during conflicts, for hacktivist and cybercrime activity, and for leaked data announcements. (Finding and safely researching underground channels is covered in Module 6.)
  • Recent change: in September 2024, a month after its CEO’s arrest in France, Telegram updated its privacy policy to say it may share a user’s IP address and phone number with authorities in response to valid legal orders involving criminal suspects. Some criminal groups have since moved to other platforms.

Mastodon (and the Fediverse)

  • What’s public: public posts, profiles, follower lists, and the server (instance) a user belongs to. The instance itself can hint at interests, profession, or location.
  • Search is limited on purpose: since Mastodon 4.2 (2023), full-text search of posts is opt-in. By default you can search hashtags and accounts, but most people’s posts are not keyword-searchable.
  • Tips: profiles often include verified links to personal websites and other accounts, which are great pivots.

Bluesky

  • What’s public: posts, likes, follows, and profiles are published as public records on the AT Protocol.
  • Why it matters: Bluesky’s API and real-time “firehose” (a stream of all public activity across the network) are free and don’t require authentication to read, which makes large-scale monitoring and archiving easy.
  • Tips: because data is replicated across the network, deleting a post from the app doesn’t guarantee every copy is gone. Handles can be custom domains (name.companyx.com), which reveals the domain owner.

Snapchat (Snap Map)

  • What’s public: snaps submitted publicly appear on Snap Map (map.snapchat.com), viewable in a browser. This has been used to see public footage from specific places during breaking news events.
  • Tips: individual users’ locations are shared only with friends they choose, but public snaps can still reveal events at a location.

Fitness & Activity Apps (Strava and others)

  • What’s public (depending on settings): routes, start/end points (often home or work), times, pace, photos, clubs, and “flybys” (other athletes who crossed your path).
  • Case studies:
  • Strava Global Heatmap (2018): aggregated activity revealed military bases and patrol routes worldwide.
  • #StravaLeaks (Le Monde, 2024): reporters identified public Strava profiles of security staff (including 26 US Secret Service agents) and could track the movements of protected leaders including US, French, and Russian presidents. A simple method was enough: record an activity in a location where only security staff are likely to run, and Strava shows who else ran there.
  • Tips: privacy zones hide the start and end of routes, but patterns over many activities can still reveal locations.

Payment Apps (Venmo)

  • What’s public by default: Venmo transactions default to Public, showing who paid whom, when, and the note (amounts are not shown). Friends lists are also public by default. Users can switch to Friends or Private.
  • Why it matters: payment notes and friend lists map real-world relationships (roommates, family, coworkers, dealers, landlords) and daily habits.

Review & Employer Sites

  • Google Maps reviews:
  • Reviews, photos, and ratings are always public.
  • A reviewer’s profile can list every place they’ve reviewed: a map of their life (home area, gym, doctor, favorite bars). Users can restrict their profile, but individual reviews still appear on each place’s page.
  • Yelp and TripAdvisor: similar exposure of places visited.
  • Glassdoor:
  • Employee reviews reveal internal culture, tools, and organizational problems. Interview reviews reveal the questions and technology used.
  • In 2024, users reported that Glassdoor added their real names to profiles without consent (after its Fishbowl integration required identity verification). “Anonymous” platforms may not stay anonymous.

Quick Reference: What Tips Off the Target?

Action Can the target notice?
Viewing a LinkedIn profile (not in private mode) Yes: “Who’s viewed your profile”
Viewing an Instagram or Facebook story Yes: viewer list
Liking, following, friending, joining a group or server Yes
Viewing a public Strava activity Usually no, but recording activities nearby can create “flybys”
Viewing a public X post, Reddit comment, or YouTube video Generally no
Reading a public Telegram channel via t.me/s/ No

Key Terms

  • SOCMINT: social media intelligence; OSINT focused on social platforms
  • Login wall: a platform’s requirement to sign in before viewing content
  • API (Application Programming Interface): the official way programs access a platform’s data; many OSINT tools depend on APIs
  • Firehose: a real-time stream of all public activity on a platform
  • Privacy zone: a fitness-app setting that hides route start/end points near chosen locations
  • Mosaic effect: individually harmless details that combine to reveal something sensitive

Key Takeaways

  • Social media is the fuel for social engineering, and the most ethically sensitive OSINT source
  • Many features notify the target: LinkedIn profile views, story views, likes, follows
  • The platforms keep closing doors: Graph Search (2019), X API (2023), Reddit API/Pushshift (2023), CrowdTangle (2024)
  • Bluesky is the exception: public data and a free firehose
  • “Non-social” apps leak too: Strava routes, public Venmo payments, Google Maps reviews
  • Photos reveal more than captions: badges, screens, signs, landmarks
  • Test every technique right before class; platforms change constantly

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.