Protecting Personal Information in the Digital Age

Two recent incidents got me thinking about personal information.

One: Bilibili's open-source project bilibili-API-collect received a legal demand letter and shut down. Two: a post on Linux.do, How I Treated a Hacker to Prison Food, in which a red-team investigator assembled a hacker's real identity from public information alone and got him sent to prison.

One person was traced by a company, the other by an individual. They point to the same fact: in the digital age, your identity is almost entirely built from public information. Protecting your privacy is about managing the links between your identities.

The two incidents

The bilibili-API-collect demand letter

bilibili-API-collect (BAC) was started in 2020 by a developer known as "Yijie". In six years it accumulated 20.4k stars and 200+ contributors, effectively becoming the standard third-party API documentation for Bilibili. In late January 2026, the author received two letters from a law firm: a demand letter and a follow-up criticizing the "incomplete remediation." The letter alleged the project "systematically collected and organized Bilibili's non-public API interfaces, their calling logic, parameter structures, access controls, and security authentication mechanisms, and distributed them to the public in the form of technical documentation and code examples." The repository was deleted soon after. The full story is in the shutdown announcement and the author's follow-up reflection.

The timing is more telling. In early January 2026, Tencent had just filed a DMCA with GitHub against a batch of WeChat-related open-source projects, on the same grounds of "invading user privacy." When APIs become the chokepoint through which big tech controls data in the AI era, any channel that bypasses the official ecosystem gets shut down.

The author's framing: the internet is a dark forest. The government is the Singer, big companies are advanced civilizations, and individuals and small companies are the weak ones. To survive, the weak must hide themselves and clean up after themselves.

The hacker who got prison food

A company had been harassed by DDoS and phishing attacks for three months. A red-team investigator started from a single Open Redirect payload in the attack logs, found a personal blog hosted next to the attack infrastructure, then used the blog's email to find the same handle on HackerOne, which led to Twitter.

The tweets leaked the attacker's country, age, when he entered the field, that he was job-hunting, and the dates he earned two certifications (eCPPT, OSWA). Those timestamps were the breakthrough: the investigator narrowed LinkedIn candidates from tens of thousands to about twenty, then combined photos, platform verification, domain registration records, and an enumerated email address to close the loop from "anonymous attacker" to "real person." No intrusion, no social engineering — all legally public information.

It shows that doxxing today isn't a business that requires hacking skills. It's a jigsaw puzzle: every piece looks harmless on its own, but together they form a full ID.

Identity is made of links

Put the two stories side by side. A person gets traced by an organization through the email and phone number they voluntarily provided at signup; a person gets traced by an individual through the IDs, timestamps, and photos leaked in their public footprint. The common thread: identity is made of links. As long as a single edge connects two identities — the same email, the same username, the same photo, the same timeline — anonymity is paper-thin.

A few conclusions follow:

Cross-platform reuse is the biggest hole. Usernames, emails, and phone numbers are the "primary keys" of identity, and the three things attackers want most. Using alias emails, unique IDs, and fewer phone-number bindings is, essentially, deleting your primary keys.
Social media is the richest source of clues, and timestamps are the deadliest. Posts like "finally got my cert today" or "one year at the company" put month- or day-precision information on a public wall. Location, routine, certifications, offers — once cross-referenced, they narrow the search faster than intuition suggests.
Resumes and professional networks are confessions. Schools, employers, project dates, photos, platform verification — all of it is designed to identify a person. Publishing a resume means consenting to be identified from it.
Purchase records and registrations are the receipt at the end of the trail. Domain WHOIS, server registration emails, forum accounts — everything you paid for leaves a record. Separating work assets from personal ones is key to stopping someone from finding you through your infrastructure.
For individuals, the real defense isn't any single platform — it's isolation. Split your life into a real-name side and an anonymous side, with no shared primary keys between them. The more thoroughly you do this, the more clues the other side must collect, and the higher the cost of the puzzle. The BAC author was easily identified precisely because his open-source identity and his personal information had no separation at all.

Line in the sand: self-protection is not evading the law

Here I need to draw a line. Talking about self-protection is not teaching people to hide from the law. On the contrary, the Linux.do post is persuasive precisely because the entire trace was legal, and it ended with the offender in prison.

The truly safe posture is not keeping your secrets airtight, but leaving nothing in your legally public footprint that can be used against you.

Criminals should fear that public information can become evidence against them. The rest of us should learn to make ourselves not worth doxxing, and impossible to fully assemble.

What to do, concretely

Accounts and primary keys

Use different usernames on high-value platforms (email, payments, cloud) and low-value ones (forums, communities)
Reserve your primary email for people you know, banks, and official real-name services. Use alias emails for everything else — SimpleLogin, addy.io, Firefox Relay, or Cloudflare Email Routing on your own domain — one per site, disabled whenever you want
Bind your phone number only where necessary; use a virtual number when possible
Use a password manager with random passwords; prefer hardware keys and TOTP over SMS codes for 2FA

Identity isolation

Dimension	Real-name side	Anonymous side
Information	Real name, school, employer, real photos, location	Unique ID, alias email, custom avatar
Used for	WeChat, job hunting, banking, socializing	Tech discussion, open source, forums
Iron rule	Never shows real name, photos, work or school info	Never shows anonymous IDs or content

Business assets should be equally separated from personal ones: a VPS, domain, or blog used for testing should share nothing with your personal email and phone.

Social media

Turn off location services; don't post photos with landmarks, homes, family, or schools
Don't post events with exact dates; scrub real names, photos, and phone numbers from old posts
Re-examine LinkedIn and your resume against the "can I be found by this?" standard — every school, company, and date is a filter

Infrastructure

Enable WHOIS privacy protection on domains; assume registration details (servers, domains) can be subpoenaed
Publish sensitive or gray-area projects via private repos or anonymous emails, not under your portfolio

After a breach

Periodically check Have I Been Pwned for your emails; change passwords, close, or abandon any account that shows up
If you get doxxed: in China, you can demand platforms delete your information under the Personal Information Protection Law and report to the cyberspace regulator
Obtaining, selling, or providing citizens' personal information without authorization can be a crime under Article 253(1) of the Criminal Law — file a police report

Conclusion

Back to the dark forest. Information self-defense isn't about hiding more carefully — it's about managing links:

Hiding a secret is worth less than having no connectable edge between two identities
Don't count on platforms to protect your data; assume registration info can be obtained
Assume anything you publish can never be taken back — so only publish what you'd be fine with the world keeping forever

Most doxxing victims weren't broken by sophisticated techniques. They assembled the puzzle themselves, one fragment at a time.