5

Well this question may not be about computers, but it most definitely is about information security, so I'll give it a try...

I've been repeatedly told in my life that I should always carefully check each piece of paper for any piece of personal information it might carry before throwing it away. This includes bank reports, bills, pen&paper notes about other peoples' telephone numbers with their name and surname, and even my old tests from school that contain my name and surname and the oh-so-very-important information that I scored the grade of 4 for being able to simplify three polynomials but failing to simplify the fourth one.

I tried to follow that advice, but the longer I think about it, I'm curious what the exact risks are? Let's break this by case:

  • a bank report should clearly not be seen by any untrusted individuals;
  • a telephone numer or an e-mail address can be sold to spammers, but let's face it, they likely have it anyway
  • I can't imagine how could anyone abuse the information that some no-name scored a 4 in one of their many school tests?

Even more importantly, how would any ill intentioned individual get all of this information? They would either have to search the recycle container or work in the recycling station. I don't know the facts so I cannot judge, but I find it hard to believe that crooks hire bums who walk from street to street searching bins and containers for any piece of personal information they might find? That some ill intentioned peaople might get themselves hired by a recyclicling station for this purpose seems a little bit more probable to me, but then again, don't crooks have a quadrillion of better ways to obtain some personal information they may seek?

What are the risks of throwing a piece of paper with some personal information to a public recycle bin or container without destroying that piece of personal information first and how can this be exploited?

  • I argue this question may be on topic based on this quotation from security.stackexchange.com/help/on-topic : "Topics include, but are not limited to: (...) physically securing the (...) information assets" (emphasis mine) – gaazkam Feb 20 '18 at 19:04
  • 2
    It is on-topic, don't worry. Information security is often a computer-dominated field but what you are asking is still squarely in the realm of infosec. – forest Feb 21 '18 at 6:32
5

This practice sonuds a bit over the top to me. Sure, I would be careful with leaving my credit card number or email password in the trash. But apart from highly sensitive information like that, I just would not care.

Emails and phone numbers? There are easier and less smelly ways to harvest them. Bank statements? Might be useful for social engineering, and perhaps something there could be used to impersonate you to the bank in an attempt to take over your account. But again, searching through peoples trash at random doesn't really pass a cost benefit test. Your old school material? Now this is just getting silly...

So unless you are a very attractive target, I'd relax. You might want to brush up your polynomials, though.

  • 1
    You don't have to be a very attractive target to become the victim of a dumpster diver mounting a social engineering campaign against you or someone who's personal information you have handled. Simply gaining access to phone payment records can allow effective social engineering techniques that can be used to obtain in detail a person's legal residence, full name, etc, yet you wouldn't think that the amount of money you paid for your phone service in a given time period could be in any way sensitive. – forest Feb 21 '18 at 6:31
  • @forest I'd throw my phone bills in the trash without loosing any sleep over it. As I write in the answers, there are information that could be used for social engineering. But given the high cost of the attack - you can hardly automate this - I would not worry about it. For almost everybody there are more low hanging fruit than buying a shredder. – Anders Feb 21 '18 at 6:38
0

I do not believe even checking whether a piece of paper contains personal information is worth the time spent doing that. Just shred it all, even if you do not consider yourself a target for fraud or harassment right now.

It may be expensive to recover and subsequently use the bits of information you throw away, but given their highly variable risk, part of which may only become apparent in the future, making it almost impossible to recover seems reasonable.

  1. As more and more data is no longer printed on paper, the information that is printed is more likely delivered that way because that was deemed more secure. The worthiness of protection of your average "read/scan & throw away" snail mail can be expected to increase over the years.
  2. For crooks targeting you, specifically, i believe the risk of doxxing/harassment is one of the main concerns about thrown away paper. Since you probably do not restrict your online activities based on who might dislike you next week, you might want to handle things you throw away today in a way secure against what may come next week.

A full set of contract no + address + birth date can be enough to meddle with your phone.

Your phone company probably does not require a great deal of information from you (or your impostor) before making potentially dangerous changes ("SIM swapping", "port out scam"). Note that e.g. Twitter is vulnerable by design to anyone abusing your phone number, so this is not limited to breaking 2FA or scamming your personal contacts.

The key here is not the individual data, you are right the scammers will have that, its extremely high confidence in a set of data belonging together and thus not triggering the usual abuse prevention mechanism in the first social engineering attempt.

Even minuscule portions of PII in the trash bin can break identity separation.

If you ever said anything online that a substantial part of a large audience did not like, there is a chance you become target for a certain kind of people without knowing until its too late. Someone might dumpster dive around potential addresses to find any document that is linked to both your online and offline appearance.

Something as harmless as shipping documents for a product you referred to could be sufficient to confirm your identity. Your 4th grade tests will probably do, too.


If you believe a machine that does not make shredding too labor intensive is prohibitively expensive, check again. They have become much cheaper.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.