Encryption solves one problem extremely well: nobody in the middle reads the words.
It does not hide that you and a particular person exchanged forty messages between 11pm and 2am, and then you both went quiet for three days, and then one of you published something.
That pattern is content. It's often better content than the words would have been, because it's structured, cheap to collect at scale, and it doesn't require anyone to read anything.
the four places I look
1. files
Photos are the notorious one and everyone knows about GPS coordinates by now. The tags people forget are the boring ones: camera make, model, lens, and especially body serial number, which quietly links every photo you've ever posted from that camera into one set. Doesn't matter that they were posted from four different accounts.
Inspect before you publish. Always.
# every tag, grouped by family, short names
exiftool -a -G1 -s image.jpg
# the usual suspects, specifically
exiftool -GPS:all -Make -Model -Serial* -CreateDate -Software image.jpg
# work on a copy, strip everything writable
cp image.jpg image-pub.jpg
exiftool -all= image-pub.jpg
# confirm it's actually gone
exiftool -a -G1 image-pub.jpg
One gotcha that bites people: by default exiftool leaves the untouched original next to the cleaned file as image-pub.jpg_original. I have watched someone strip metadata correctly and then upload the _original because it sorted next to the other one in the file picker. Check your directory before you drag anything anywhere.
Also worth knowing: some platforms strip EXIF on upload and some don't, and which ones do changes without announcement. Never rely on the platform. Strip it yourself.
2. documents
Worse than photos, honestly, because the surface is bigger and nobody thinks about it.
Office files and PDFs routinely carry the author name, the last person who saved it, total edit time, a revision counter, tracked changes and comments you thought were accepted, the template path (which often contains a username), and sometimes a printer name. A PDF also records the producing software and, frequently, the original filename.
If a document is going anywhere public, the safest habit is: build the public copy fresh rather than cleaning the working copy. Paste text into a new blank document, export, then inspect the export. Cleaning is error-prone; regenerating is not.
3. timing
You cannot strip a timestamp off a network. But you should know what yours says.
Plot your own posting times over a month. You'll see a sleep window, a working day, and probably a lunch break. That's your timezone to within an hour or so, and then a holiday gap narrows the country. Add a device timestamp with a timezone offset baked in and you're done.
Small habits help more than they should:
- Schedule posts rather than publishing at the moment you write.
- Set a device to UTC when its local time doesn't need to be right.
- Don't reply instantly to everything. A consistently fast response time is itself a pattern.
4. style
Stylometry is real, and it's the leak you can't run a tool against.
Reused bio text, a signature em-dash habit, the same three misspellings, a specific way of opening a message, a niche reference you deploy every few weeks. None of these prove anything alone. Two of them agreeing is usually enough for a human who's already suspicious.
The thing that connects two identities is almost never one damning artifact. It's two boring ones that point the same direction, noticed by someone patient.
cheap wins, ranked by effort
| what leaks | what it reveals | cost to fix |
|---|---|---|
| photo EXIF | location, device, serial-linked photo set | one command |
| document properties | author, org, edit history, template path | regenerate the file |
_original backups |
everything you just stripped | look before uploading |
| posting times | timezone, sleep schedule, workday | scheduling, some patience |
| writing style | identity linkage across accounts | genuinely hard |
Effort goes up as you go down that table, and so does how much it actually matters. Which is the usual shape of this work.
the framing I keep coming back to
Ask what an observer learns without opening anything. Not the contents — the envelope. Who talked to whom, how big, how often, from where, at what hour, using what.
For most of us most of the time this is a hygiene issue, not a crisis: strip your photos, regenerate your documents, don't post at exactly 8:02am every weekday from a device set to your home timezone.
But if you handle anything sensitive — sources, an org's internal work, someone else's safety — the envelope deserves the same seriousness as the letter. Encrypting a message and then leaking the pattern of messages is a very sophisticated way of accomplishing nothing.