I originally wrote this piece for the Privacy Guides blog, although the information herein has been largely superseded by my contributions to their Threat Modeling and Common Threats pages, which I recommend exploring.