hello and welcome to recon village my
name is kayla k
and i will be walking you through a
presentation on ocean for sex workers
so for starters you know 2020 was a
strange year
i have a lot of friends friends and
friends who were looking for
alternative ways to make money this year
so obviously you know bands took to
twitch to try to do socially
distanced concerts we had people trying
to start a podcast
but overwhelmingly the way that people
found to make money was through only
fans
or just for fans
so as the person that people know who
does security a lot of people came to me
and said
you know how can i stay safe and
anonymous
i thought that made a good idea for a
community project
so i thought about it you know what are
some of the limitations to
an entertainer's anonymity so obviously
there's some that are harder to change
than others
you have physical attributes such as
physique tattoos
birthmarks hair and eye color
additionally your location a big scam
that popped up over the year was the
amazon wishlist trap
again promotion was fairly difficult
because there's a huge
conflict between promotion and privacy
they're not mutually exclusive which
i'll discuss but they're not
it's not easy to achieve a balance
either
additionally uh payments there was the
venmo trap
so these payment platforms which are
also social media platforms
and again you know stolen images so
finding leaked images and recordings can
be very difficult
and of course you know there's always
data breaches
so there are lessons to be learned from
things like ashley madison
so my general answer was if you know how
to use open source intelligence
you might stand a chance
and i thought in order to explain this
it would be good to create
a sex workers toolkit so
in working with people throughout the
year i did a lot of work to
help people understand there's a
difference between
establishing an alias and just picking a
stage name
establishing an alias is much more than
just picking a stage name
also using best practices for privacy
doesn't mean that you can't promote um
but you do have to strike a balance
and you can have a lot of fun with
counterintelligence tactics
and this becomes especially apparent
once you learn how to cyber stalk
yourself
your alias and any counter intel that
you put into the world
so when i say that an alias is more than
a stage name
when you want to be an entertainer an
entertainer you should start by checking
your real identity
and the identity of your significant
others friends
and roommates i usually recommend
starting with thatstem.com
a lot of the services to do this within
the ocean framework
have turned into paid for services but i
wanted to make sure that
anything that i talked about within the
sex workers tool kit was free
and available to individuals at no cost
so um if you were to use that tool
you'll probably be likely to you'll
likely be dismayed to be honest you're
going to be disappointed because you're
likely to find your home address
your phone number your email address and
social media
not just your own but of anyone who's
been
physically close to you so this is
problematic because
the process of cyber stalking and
immediate in a world with social media
isn't just about you it's about everyone
who's
physically in your orbit or
online in your orbit online as well so
in order to break this out further when
you're establishing
an alias you want to get a dedicated
business phone
there can be no overlap in your phone
contacts or your search history
so when you're deciding to go into this
any social media is immediately going to
pick up on your contacts
and start referring people to you that's
very problematic
if you're trying to have a hidden
profile if you're trying to maintain
some
anonymity in the world or at least keep
some privacy
from certain people who would normally
be
on your facebook instagram twitter
account
um additionally when it comes to
creating a new email
you're going to want to create a new
email and a backup email
you're going to want to make sure that
those have
multi-factor authentication on them you
want to make sure that they have a
secure password
and if you can use a system with n-10
decryption
something like protonmail that would be
a big plus when it comes to delivering
private messages additionally
you want to start by creating a virtual
po box with your stage name
and you want to use that fake address
for all of your new accounts
you do not want to create any accounts
on only fans just for fans
cash app or anywhere else until you have
this
step out of the way you want to make
sure that your virtual po box is located
in a different city that you live in
this relates directly back to the
amazon wishlist scam so the amazon
wishlist scam
is that a lot of people will say that
they want to buy you gifts
and many genuinely do but as an
entertainer
when someone buys you a gift off of your
wish list they're at least given
your city and your state
where and when you combine that with
information from your pictures
and the social media and promotions that
you put out there you end up with a lot
of identifiable data that could allow
someone to figure out your
geographic location in addition uh
there was a scam out there that if you
allowed them to buy you something they
could set themselves up as a third party
and amazon releases your actual address
information to that third party
so scammers would put up the item that
you wanted
pretend that they were selling it
purchase it from themselves
and then they would be given your
physical address
and location um
immediately from amazon it would be
released and they would know where you
live
this is a huge problem for anyone who's
an online
in the online entertainment industry
anyone who's working for only fans or
just for fans
the fine line between a parasocial
relationship
and an actual relationship is often
blurred it does not help if
those people who don't understand the
difference get your physical address
so i can't understate the need for this
if you're going to have an amazon
wishlist
you can't go back and do this step later
this has to be
one of your first steps that you
actually perform
additionally um when it comes to
your social media accounts you're going
to need them to promote you're going to
have to create an instagram
you're going to have to create a you
know facebook a twitter whatever
snapchats you know tech talk whatever
it is that you would like to use for
promotional purposes
this has to be absolutely separate from
anything that you've done previously
and the extent to which it needs to be
separate cannot be understated so
i'll go into some of the issues around
photo posting and some of the stuff that
you need to do in order to protect
yourself
when i talk about privacy but when it
comes to establishing an alias there
cannot be
any overlap you cannot friend any of
your friends
you cannot share um what you're doing
with anyone who's in your social circle
if you hope to maintain anonymity from
everyone
else who's in their social circle
all right
so moving on obviously when you're
establishing an alias
you want to use a vpn you should never
reveal your real ip address
your real ip address can be geolocated
using open source intelligence tools
this means that someone could figure out
your exact street
address or at least down to a couple of
blocks
for most services just using your actual
ip address
additionally um when it comes to payment
platforms a lot of people do private
videos
outside of only fans or just for fans
they get to keep more of the money that
way
this is problematic for reasons i'll
talk about
later um whether it's legal protection
or
privacy or ability to take legal action
however um it is one of the best ways to
make money
so when you're establishing an alias you
need to set up a cash app
if venmo is linked to your contacts and
social group then you should use
cash up and vice versa if venmo
is not your primary one and you're using
hash app then you need to switch to
venmo for your business account
you should never share the information
between them
you never want to share the social
networks on those two
platforms additionally
when you're creating a alias you want to
create a fake
real you this is for plausible
deniability purposes
you can go on linkedin give them a real
sounding job
you can use the same photoshop filters
that you use
on your content for your only fans or
just for fans
this gives you plausible deniability and
you can track
the people who are tracking that sounds
like a honeypot
in order to figure out what your risks
are
so it's a interesting
way to build up your cyber skills
because you know this person isn't real
any traffic that's driven to this fake
real you
is going to be driven by people who are
trying to cyber stalk you
so it'll give you a chance to cyber
stalk them back and prove your skill set
and also to see how much interest there
is in you
in this uh you know not so wholesome or
maybe wanted way all right
the last item on establishing an alias
is you got to have fun
you should use a mask wig eye contacts
use concealer to cover tattoos moles and
birthmarks this is all part of the
counter intelligence
and you can have a lot of fun with that
so counterintelligence will be
any challenges around your physical
attributes you can actually address with
those counterintelligence
tactics you can use photoshop to
slightly change your features
you can get tattoos and put them where
you don't have tattoos
you can cover up the tattoos you do have
you can change your hair color
you can change your eye color and you
can wear a mask
so there are multiple ways to layer
these kind of
counter intelligence techniques in the
real world as well as online
so when it comes to using best practices
for privacy
this is a multi-part issue so privacy
and promotion
are at odds with each other in concept
so conceptually there's some real
problems there but in practice
some privacy practices are essential to
your safety as an entertainer
so if you want to stay anonymous you may
be less successful
than if you weren't trying to stay
anonymous that's
at this point being quantified it's kind
of a known fact of the industry
um there are phenom of phenomenal
exceptions
but for the most part the more private
you are
the less promotion the less promoted you
are and therefore
less accessible and you may not get as
big of a following
but if you're interested in striking a
balance between privacy and promotion
there are things that you can do
so removing the permissions from your
social media apps on your phone
on your business phone and making sure
to never share your location
is extremely important so i have an
example here of geocreepy.com
you can go and view all of the
locations ever associated with someone's
social media accounts and in pulling
that up
obviously that gives an attacker an
entire
list of places to meet you
naturally which is could be unwanted
so obviously it's really creepy there
are a lot of tools like this
but this one's very visual i recommend
you go to geocreepy.com
and give it a try i think
when it comes to using practices for
privacy
your past social media can be compared
to your promotional media
so to put that in perspective if you've
taken a photo
at a location that you love for your
original social media
changing the permissions on your
original account is not enough to
protect you
so you can use facebook graph to go
through any picture
whether it's been whether your privacy
settings have been set or not
so just by using facebook's own tools
you're able to see
past items that are in their history and
using those past items they may be able
to
see that it was you putting a similar
post at a spot that you love
on your real social media accounts as
well as your
obviously promoted um social media
accounts
so this is problematic you should really
take into account the physical location
there are a lot of efforts to do
geolocation not just through
metadata you should always remove your
metadata but
even more uh you know complicated ways
have been used
so as an example you can go to
suncalc.net
or look up more look at more of the
tools on the osimp framework
if you go to suncalc.net it helps to
geolocate
someone according to the sun's
positioning
in a photo so just time of day when
posted
uh the way that the sun is reflected in
the post
may be enough to help someone figure out
where you are
at least to a relative degree
and with additional features that can
help them
stalk you which is not something that
you want
when it comes to keeping your social
networks you should also keep your
social events separate
so similarly if you go to a special
invite-only event
you should not be taking a picture with
your private cell phone and your
business cell phone
to promote uh where you are
at the same time just by putting those
two things up at the same time
that obviously uh gives positive
correlation to anybody who might be
using a tool like facebook graph to go
through your historical
pictures and try to figure out if that
version of you on facebook matches the
version of you
and your uh promotional materials
again um you know facebook's not the
only one
this can be done with instagram this can
be done with tech talk
or snapchat or any of the social media
platforms
you want to be really careful to keep
your social networks and social
events separate just even seeing someone
in the background of your picture
if that person actually keeps the a very
public
social media profile they'll be able to
find you
through stalking them to a relative
degree as well
additionally uh removing metadata from
photos before you store or share them
is important to ensuring that your
location is not discovered
this is a basic thing but not everyone
is aware there are
varying degrees of you know technical
skill sets there are a lot of tools for
removing your metadata
i will say the one thing that seemed to
be the most common mistake in sharing
metadata
was not removing the metadata before it
was stored
so if your icloud account was breached
then they could get all of your pictures
which included metadata
so you want to go ahead and make sure to
restore your meta you want to remove the
metadata before you
even store it you want to keep a copy of
the picture that has no metadata on it
additionally you know a lot of services
remove it but wherever you store it it
can be stolen from that location
um so you want to make sure that you are
scrubbing it as soon as the photo was
taken
all right so using best practices for
promotion
so not just talking about privacy here
um we have to strike a balance so
there's good news
in the ocean world kind of so let me
explain what i mean by that
um you might be grateful to find there's
so many social media management
monitoring tools so you have
wiki.kenburberry.com as an example we'll
have
all of these social media and management
monitoring tools many are paid for but
there's still a lot that are free
and you can use uh oh sent on your
competition
so you can create a private list of your
competitors on twitter
no one will know who you are following
so that allows you to know when they're
online know when they're offline
know when the right time to blast out a
tweet
knowing how to pick up their followers
you can get a lot of
intelligence off of what your
competitors are doing without them even
knowing
additionally you can use facebook watch
to notify
when they're promoting or going online
similar for ig
you have the same thing for tick tock so
that's another way that you can use osen
to track your competition
and of course you can set up google
alerts to see anything that pops up
about a specific competitor online
the reason why i say this is good news
is you can do it to your competition
but they could also do it to you and of
course an attacker can use this
but this is the level to which even if
you're using good privacy practices
you are still going to have this amount
of information out there
so use it to your advantage um and
hopefully
it'll help you with promoting your
account
and when it comes to using best
practices for safety
you want to use the platform security if
you're on only fans or just for fans
there are security options there never
start streaming without at least taking
a peek at those security options
probably the most important thing you
can do is use multi-factor
authentication on your email
and all of your accounts you want to
make sure that
you never click on links or open files
that were sent to you whether it's in
chat or email
you should never open those files
there's no need
um and avoid clicking on any links just
because they can
um compromise the machine that you're on
whether that's your
cell phone or a laptop so you want to be
very careful
when you're doing that additionally
platforms like
only fans are just for fans tie your
real identity to your alias
and there's nothing you can do other
than contact them and ask that they
increase their security efforts
so unfortunately this is the part where
i said
if you know ocent then maybe you stand a
chance even if you were to do everything
right
and be very good at what you're doing
um you're still at the mercy of your
payment platform
and you're at the mercy of these
platforms that host your content
to ensure that they're actually taking
steps to protect your privacy
and your safety
so what's next for me over the next year
so two interesting problems relating to
ocean popped up over the last year
um number one banning in accounts not
the same as banning a user
making moderation ten times as hard as
it should be i think there's
room to create an ocean tool and i've
been uh
working on that with another woman that
i invited to help me with the project
and um the second thing is that most
money is made off of private recordings
which lack licensing and tracking to
prevent piracy
if you have someone who uses fraps to
record without your consent only fans
and then upload it to another adult site
you can use the only fan lawyers to send
them
a notice that to send the platform that
they uploaded it
to a notice that it must be removed but
your only ramifications are legal
ramifications through the only fans
platform
you have no other way to
get these recordings off if you
privately provide them to someone
so there's definitely some work to be
done there the biggest challenge is
finding out where your image has been
uploaded
if they didn't specifically use your
alias or your stage name it's going to
be very difficult to
find and even if you do find it
obviously you'd have to reach out to a
lawyer or work with someone to get it
taken down
this leads to a lot of entertainers
using
watermarks on their videos and
watermarks do lead to a lot of
complaints
so well there are image recognition
tools
like robo10 out there they're not very
good at this point
um there's definitely a lot of work
being done in the space
and a lot more that can be done so
i hope to come back with some
interesting
uh tools next year
and in order to help me build those
tools i invited jalen denise
um she's going to be running the twitter
account and she's a developer
she's got experience in the industry and
she'll be able to
help me with all of the cyber security
questions that everyone has been sending
so you can go to the modestyproject.com
or you can tweet directly at her let her
know if you've
uncovered any other scams or have any
other questions
and we hope to speak to you soon thank
you