Why should relatively-public personal identifying information be kept secret online if at all?

Question

I don't want to get hung up on technical terms, just laying out basics for this question: I understand personal identifying information (PII) as that info which is not apparent to people who cross paths with you day to day and which could be used to prove your identity. For example, my name and face are not really private because anyone I casually do business with could get that info. My birthdate and address are much less apparent and are considered PII. My social security number is a whole different tier of private, being sensitive personal information (SPI).

I grew up in the wild west internet (there's fringe PII - apx. age) and was advised never to reveal PII-type info. Basically conceal one's real identity as much as possible, for safety sake.

Knowing more now, I wonder if this precaution is warranted, especially in the context of persona persistence between platforms which could leak some PII. Most internet use, sure I don't want my name out there tied to it, but I don't feel like I need to cover my tracks in general. Conversely, I see some benefit in letting my actual or pseudonymous identities persist online, and I wouldn't be opposed to lightly-vetted or simply-determined users connecting dots between personas, i.e. friends or acquantances knowing two different profiles both represent me, including a PII-filled one like LinkedIn. I'm asking if my intuition here is right or more risky than I think.

The risks of revealing PII are I think:

• Identity theft
• Stalking
• Planning crimes
• Doxxing/slandering/harassing

For those reasons, I can see reason to use a pseudonym posting publicly. But I also don't see those threats as particularly concerning in general, like when meeting someone on a message board or a stranger on Facebook or LinkedIn. Someone finding my profile on LinkedIn already has a lot of information that could be used to harass me, just as it's useful for potential employers to vet me. It has to do with target incentive: why me among numerous others? And even if someone online pursued one of those malicious acts, how would it be any different or more likely than encountering that malevolence with a completely offline relationship? Is it that the internet is vaster (so greater chance of running into bad apples) and might have a deeper look in my life (so greater vulnerability when encountering bad apples)? An online criminal could choose from any number of other profiles to glean info from, so as long as I don't give away SPI, it seems like basic PII and my online activity is not any worse to reveal online than revealing my PII and 'in real life' activity day to day.

Why should relatively-public personal identifying information be kept secret online if at all?

Answer 1

It makes no sense to keep information secret if they are trivially and cheaply obtainable by others anyway.

For everything else somebody has to put some non-trivial effort and/or costs into collecting and associating such information. Due to this it will only be done if the expected return at least matches the efforts and costs needed to obtain such information. And due to limited resources a potential attacker can only target a limited number of victims this way.

By making such previously harder to obtain information easier to get one lowers the costs for obtaining the information. This means less efforts and costs are needed by a potential attacker to get the same return which makes it more likely that it is worth the effort. And due to the lower costs the attacker can also target more victims with the same resources. Both together increase the risk that these information gets misused.