🔦 Dark Web Explained: Should You Actually Be Worried?

Frank Bravo 0:00
If you turn on the news, scroll through your feed, or just google the words data breach, it will not take you long before someone mentions the dark web. Hackers selling personal information. Your personal information in some underground marketplace. Your password floating around in the shadows of the internet, your identity apparently for sale to the highest bidder. And look, I get why that language works. It's dramatic. It gets clicks, but it also leaves a lot of regular people really scared, and they have no idea what it's about or whether they've even applies to them personally. So today, in this bonus episode of your tech makeover, I'm going to slow down, talk about what the dark web actually is, what those headlines really are saying, and whether you should be worried about it. Welcome to your Tech Makeover, the podcast that gives you tips and tricks to help you simplify and get more out of the technology in your life. I'm your host, Frank Bravo. Today's topic is the dark web. I'm going to explain it. But before I do that, if you like this podcast and gets value from it, I'd love. If you are. Go to wherever you're listening. Give me a great rating, maybe leave a review that will help get this podcast on the various platforms to a place where other people can find it, to make other people easier to find this show, and I would really appreciate it. So look, I want to be upfront with something. I get a little fired up about this one being in the media for so many years. I honestly get tired of seeing websites and news organizations scare people with information about being on the dark web. You know they love those headlines, they get clicks, they get shares. But what it does and do it really doesn't do anything for you. I mean, what does it actually mean? You're just a person trying to live your life. Does being on the dark web really matter? That's what I'm going to try to track down today for you. What we're going to cover is talking about what the dark web actually is. We're going to talk about why you keep hearing about it after data breaches. I'll go through some common myths and what is actually true about the dark web, and then give you a short list of practical things that you can actually do to protect yourself. All right. Well, let's start from the beginning. What is the dark web, anyway? Think of the internet as an iceberg. I know everyone uses the iceberg analogy, but it's something that really would help in this situation. The tip of the iceberg. The part above the water. Let's call that the surface web. That is the stuff where you find typical things that you would search and Google for their your news sites, your YouTube sites, your social media, the your tech make over podcasts. They're all part of the surface web. If a search engine can find it and list it, it lives up there. Now, underneath the surface is a much bigger chunk of ice. We'll call that the deep Web. That part sounds scary, but it's not. The deep Web is simply a part of the internet that's not searched by search engines, meaning that it's not publicly searchable. It's like your bank account online. These are in the deep web. Maybe it's your Netflix profile that's in your deep web two. Your doctor's patient portal where your medical records are, you guessed it, deep web. Anything that requires a login that's not meant to be found by random Google searches live in the deep web. So most of us technically are in the deep web dozens of times a day without even thinking about it. Now then, at the very bottom of that iceberg, that's where you'll find the dark web. The dark web is intentionally hidden in the internet, and it can't be accessed through a regular browser. You need a special software in order to get to it. The most well-known tool for that is called Tor, which stands for the Onion Router. You don't need to remember that. You just need to know that a piece of software exists in order to to access it. And we're not going to talk about how to install or use it, because that's not what this episode is about. What I do want to talk about, and what I want you to take away from this episode, is that the dark web was not built for crime. It was actually developed by people in countries of oppressed governments to communicate privately journalists, whistleblowers, whistleblowers, you know, the activists that need to be able to share information without being monitored. It's like a lot of other tools out there. It just became a bad place for actors to operate. And you can think of it as the back alley of the internet, where most alleys are just fine and you take out the trash, but some of them are good for other things, and the alley itself is just an alley, unless they're doing that. A quick shout out to listeners like you who helped make your tech makeover possible. Your support helps keep this podcast going and I truly appreciate it. Want to contribute? Just click the link in the show notes or visit your Tech Makeover. Plus, as a special thank you, supporters who give $25 or more will get $25 off a one time consultation with me to help you simplify your tech. Thanks for being part of your tech makeover community. Now back to what I was saying. Now here's where the dark web connects to your everyday life. Companies get hacked. It happens all the time. A retailer, a health insurance company, maybe your social media platform. You can't go more than a few days without hearing about a data breach. And their customer data is out there on the internet somewhere. Usernames, email addresses, passwords, and sometimes even more sensitive information like credit cards or Social security numbers are caught up in those breaches. Once the data is stored in hackers, sometimes posted for free, or sell it on the dark web. Now there's actually marketplaces in the dark web where stolen credentials are often bought and sold. And here's where the part that might surprise you is. The stuff actually doesn't sell for a lot of money. A set of stolen logins from a streaming service might go for less than a dollar. A batch of a thousand usernames and passwords combinations from a random website might be sold for a few dollars. It's not a glamorous or organized situation as much as the news organizations make it sound. So when you get that notification of your email was found on the dark web, here's what it actually means. Your email address, probably paired with a password you used somewhere, sometime showed up in data that was stolen from a company that was posted or sold somewhere in the dark web. A tool like Google Password Checkup or Apple's built in Breach alerts. They will let you know about this breach data, and when it finds a match, it will flag you. The notifications are not telling you that someone is actively targeting you. It's not telling you that the information is being used right this minute. But what it is telling you is that the information is in a pile with millions of other people's information, and a lot of time that notification is telling you about something that happened a long time ago. Before we go any further, I want to talk about the common myths between the gaps of what people imagine is happening and what is actually happening, because that gap is pretty wide. So myth number one. Someone on the dark web has all your personal information and is coming for you. In most cases, your information is just part of a giant amount of data that's out there. You are not being targeted. You are one row on a spreadsheet that is dumped somewhere in a file, and that's very different than someone with a dossier coming for you personally. So myth number two, if your information is on the dark web, you are definitely going to get hacked and you have information that's going to get stolen. Well, the reality of that is not necessarily the risk depends entirely on two things what information was exposed and whether you reuse passwords. So if your email address or password is only used on the website that got leaked and you never use that password anywhere else, the practical risk is actually pretty low. But if you use different passwords, you know how I feel about that, then you're going to be safe anyway from this. So myth number three, the dark web is a massive, terrifying criminal empire that is running everything behind the scenes. Well, in reality, researchers and cyber security professionals who study the dark web often they have noted that while illegal activity is certainly there, it's a lot of it is pretty mundane. You know, the stolen credentials, the low level fraud tools, maybe some similar things. It's way more dramatic, actually. It's way more or less dramatic than movies make it sound. So what does this all mean to you? Here's an example that I like to use with my clients, and it gives them real perspective about this kind of stuff. So let's say someone got the login credentials for your county's tax account. You know, the place where you go pay your property taxes. And let's say that someone ended up finding that on the dark web. What's the worst case scenario here? Someone logs in and pays your property taxes for you. Please. Honestly, if somebody wants to pay my property taxes, I say go right ahead. I'll even give you the login. That might be the greatest identity theft stolen story ever told if that were to actually happen. Now, I know this is silly, but the point is real. Not all credentials carry the same risk. A log into a government payment portal is very different from your login to the email account, or your bank account, or your Apple ID or your Google account. The potential for actual harm is widely different depending on what account we're talking about, and this is why the conversation should not be. The dark web has my information. I need to panic, but instead should be what accounts matter and what accounts are properly protected. So let's talk a little bit about what you can actually do. A few practical steps that can actually make a difference in your life. So step one is check to see if your information has been exposed. So the easiest way to do that is to go to. I have been I'll put a link in the show notes because of the strange spelling. Pond is something that is slang in online gaming. That means I got you. The site is free and was built and ran by a well-known security researcher named Troy Hunt, and it's widely trusted in the cybersecurity world. You type in your email address and it tells you if your email has shown up in any data breaches. It's a great first step to understanding what, if anything, has been exposed. I put one of my addresses in and it came back empty. I put another one in, probably the oldest one that I have, and there were dozens referring to sites that I had long since changed my passwords for. Step number two stop reusing passwords. This is a big one. If you've listened to my show at all, you know that my feeling about using passwords is is this. You want to make sure that you are using unique passwords across as many sites as you can, and again, it depends on what those sites are. This is how a majority of account takeovers happen. They're not using some sophisticated hacking operation. It's just that someone takes a leaked username and password combination, tries it on 4 or 5 different websites, and they get lucky because the person has reused the same password everywhere. So step three is if you're going to use unique passwords, which I said we should, you want to make sure you use a password manager. Now you've heard me talk about this before as well I use LastPass. Other services are out there like one pass and even your computer and browser has password managers built in. You should use them. It's a secure place to store unique passwords so that every site you go to, you only have to remember the one password that unlocks the keys of all their passwords, and make sure that password is a really good password. If you're curious about that, go back in my feed and listen to those episodes. If you can't find the one about that, email me at Franken Tech Makeover and I will help you find it. It is so important. Step number four turn on two factor authentication or multi-factor authentication, depending on how you've heard it in the past. You've heard me talk about this too, and it means that if someone even has your password, they can't get into your account without a second code, and that second code usually is sent to your phone or is in an app, it's one of the most effective protections available. And most most major services support it. You know, another thing that you've heard me talk about are passkeys. Passkeys are the next generation of that. You can look for Passkeys in your logins to find out if that's something that you can use as well. And then finally, step number five, consider freezing your credit. Now this is not really technical, but if you're practically if you are worried about these kind of things, identity theft and stuff, a credit freeze is free and surprisingly underused. You requested through one of the three major credit bureaus, or you can request it from all three Equifax, Experian, and TransUnion. And it prevents anyone from opening a new line of credit in your name without giving permission. It doesn't affect your As accounts, and the credit score is the same. You can lift the freeze temporarily when you need to apply for something, like you want to buy a car, and it's one of the strongest protections against the most serious forms of identity theft. And did I mention it was free? All the services have paid things you can buy, but simply freeze. My credit is always free. I've turned this on for all my accounts and it's never cost me a dime. So look, the dark web sounds scary. Mostly because the name sounds scary and the news treats it like the opening scene to a thriller. But most people, in most situations, the real risk is not some shadowy figure on a secret marketplace with your personal information to on a monitor, but rather it's the boring stuff. It's the reused passwords. It's the no. Two factor authentication. It's never checking whether or not your email was part of a breach. The dark web is real. It is where stolen data does end up. But the answer is not to panic every time you hear that headline or get a notification about it. The answer is to take a few practical steps so that your information is out there somewhere and it can't do much damage. So if you ever checked to see if you were part of an email breach, and if you did, what did you find? I'm willing to bet a lot of people will be surprised with what you came up with. So. But let me know because I'd like to hear. And as always, if you have ideas for topics you'd like me to cover, please feel free to contact me via email at Frank at your Tech Makeover. That's it for now. Thanks for listening to your tech makeover, if you haven't already. Don't forget to subscribe to this podcast so that you don't miss an episode. And if you're on Substack, make sure you subscribe to the newsletter so you don't miss the alerts about this content or other contents that I post that also is free, by the way, you can also check out your tech makeover. Com where you can find more information about each of my episodes. And if you want to find out something more about me, please visit Bravo! Until next time, I'm Frank Bravo, and this has been your tech back over.