Wang Li

Cybersecurity x Network Security - Educational Posts Only

[Wang Li @wanglisec]

Here it is: https://t.co/vXTITy35Gw

Searches over 40 billion breach records.

Personally tested & saw a lot of my compromised passwords.

Check if any of your data is out there for free

[Protect My Data @protectmydata_]

SIM-swap attempts. "Your bank" calling. Endless smishing.

All three start with a number someone bought. Take it off the lists and the attack surface shrinks.

#SIMSwap #Smishing #Privacy #DataBrokers

[Wang Li @wanglisec]

@0xOvergeared One that you must win >

[Wang Li @wanglisec]

Built this because I got tired of data brokers selling my information

Searches over 40 billion breach records - you don't need an account to run it.

Here it is: https://t.co/B4H8BY1NoL

Check if any of your data is out there for free

[Protect My Data @protectmydata_]

One-time removal isn't removal. Brokers repopulate from upstream sources, so a cleared listing reappears weeks later.

Every bump gets caught by a weekly re-scan and refiled — until it stays gone.

#DataBrokers #Privacy #DataRemoval

[Wang Li @wanglisec]

@decoysdotme Exactly - often the most convenient way of doing things is the least secure

[Wang Li @wanglisec]

@luisalrp It's a commercial service. The breach search is free and doesn't require an account, but the removal engine is proprietary.

[Wang Li @wanglisec]

Built this because I got tired of data brokers selling my information

Searches over 40 billion breach records - you don't need an account to run it.

Here it is: https://t.co/B4H8BY1NoL

Check if any of your data is out there for free

[Wang Li @wanglisec]

@ArifHos57498917 @protectmydata_ That's usually where all the problems start!

[Wang Li @wanglisec]

@munjer_hossain @protectmydata_ 100%

[Wang Li @wanglisec]

@DouglasBarclay3 No - you simply enter your email to see what breaches your email has been a part of (if any) and if it has, it will show you what information was breached - so if you see that your password was part of a breach, you know to change it - informative tool

[Wang Li @wanglisec]

Here it is: https://t.co/vXTITy35Gw

Searches over 40 billion breach records.

Personally tested & saw a lot of my compromised passwords.

Check if any of your data is out there for free

[Protect My Data @protectmydata_]

SIM-swap attempts. "Your bank" calling. Endless smishing.

All three start with a number someone bought. Take it off the lists and the attack surface shrinks.

#SIMSwap #Smishing #Privacy #DataBrokers

[Wang Li @wanglisec]

Here it is: https://t.co/vXTITy35Gw

Searches over 40 billion breach records.

Personally tested & saw a lot of my compromised passwords.

Check if any of your data is out there for free

[Wang Li @wanglisec]

Deleting the app doesn't delete the account.

The profile stays live, the data stays held, and the breach notification goes to an inbox you stopped checking.

Delete the account. Then the app.

[Wang Li @wanglisec]

Your work email in a breach is a company problem, not a personal one.

It gives attackers your employer, your role, your naming convention, and a foothold for targeting colleagues.

Don't use it for personal signups.

[Wang Li @wanglisec]

Nobody gets breached and finds out immediately.

Median dwell time is measured in months. By the time a company discloses, the data has been sold, resold, and merged into profiles.

Speed of disclosure is not speed of theft.

[Wang Li @wanglisec]

Free antivirus that scans your browsing, sells telemetry, and injects "offers" is not free.

Your OS already ships with something decent. Most third-party security suites are the thing they claim to protect you from.

[Wang Li @wanglisec]

QR codes are just links you can't read.

Every instinct you've built about checking a URL before clicking is disabled by design.

Phishing moved to physical stickers over real menus and parking meters. It works.

[Wang Li @wanglisec]

Encryption at rest sounds great until you ask who holds the key.

If the company can read your data, so can anyone who compromises the company. End-to-end means they can't. The difference is everything.

[Wang Li @wanglisec]

The weakest link in your security isn't your password.

It's the support agent at a company you signed up to in 2016, who can reset your account for anyone who sounds convincing enough.

[Wang Li @wanglisec]

"We take your privacy seriously" appears in almost every breach notification ever written.

If a company only tells you what it holds after losing it, that's the answer to how seriously.

[Wang Li @wanglisec]

Attackers know your renewal dates.

Insurance, domain, hosting, TV licence - all findable. A phishing email that arrives the same week something genuinely expires is far harder to spot.

Timing is a targeting technique.

[Wang Li @wanglisec]

Ransomware crews don't break in anymore. They log in.

Stolen credentials from a previous breach, bought cheap, tried everywhere. No exploit, no zero-day, no genius.

Reused passwords are the attack.