The protection of personal data on the internet is very important. However, many times we think we are protected, while in reality we are not. For example, changing passwords and encryption are not enough. Additionally, many people tend to sell or recycle their old devices without thinking about the consequences. A study by the security company Rapid7 showed that devices sold in stores with used devices contain the personal data of previous owners.
Josh Frantz, a researcher at Rapid7, bought used electronics from stores that supposedly "clean" the devices before selling them. He bought 41 computers, 11 hard drives, 6 cell phones, memory cards, and flash drives.
Among them, Frantz discovered more than 366,000 files (documents and images). He had access to very personal information, such as social security numbers, credit card numbers, driver’s licenses and passports.
“When I got a computer, I would boot it up to see if it was working properly and if it needed a password to log in. I wrote a PowerShell script that would find all the images, documents, saved emails , and chat history. Then, it would all be organized on the desktop and I could take it with a USB drive,” he wrote in a blog post.
According to Frantz, if you want to sell or recycle your devices, you must first “clean” them thoroughly. It is the only way to protect your data from aspiring thieves. However, simply performing a factory reset is not enough.
Frantz showed how we can “clean” an Android device. The first step is to encrypt our data, via an application, and the second is to restore factory settings. As for iPhones and iPads, the reset can be done as follows: settings > general > reset > erase all content and settings. According to Frantz, if someone wants to recycle their old device but is sure that their personal data will not be leaked, it is better to destroy it and burn it, as long as there are no toxic byproducts.
“If you are worried that your data might fall into the wrong hands, destroy the data”, he said. “If you want to do a good deed and give someone your old device, make sure you have removed your personal data. Only if you do it yourself can you be sure that the «cleaning» has been done.”.
