> Threat Model First

Before you do anything, you need to answer one question: who is your adversary?

A security researcher protecting a blog post has a different threat model than a journalist in an authoritarian regime. A regular person worried about data brokers has a different threat model than a whistleblower leaking documents. The measures you take depend entirely on who you're protecting against and what you're protecting.

🔑> Passwords & Authentication

Passwords are the first line of defense and the most commonly broken one. The average user reuses 5-10 passwords across dozens of accounts. One breach cascades into dozens of compromises.

Use a Password Manager

A password manager generates and stores unique, random 60+ character passwords for every site. You only need to remember one master password. This eliminates the #1 human error in credential security: reuse.

• Bitwarden — open source, self-hostable, free for personal use. AES-256 encryption, zero-knowledge architecture.
• Proton Pass — open source, zero-knowledge, integrated into Proton ecosystem.
• KeePass — local-only, no cloud dependency, database file you control entirely. Best for people who don't want any third party holding their password vault.
• 1Password — closed source but well-audited. Good UX. Less transparent.

Critical rules for the master password itself: minimum 20 characters, use a passphrase (four or more random words), never store it anywhere except in your memory. If you must write it down, store the paper in a physical location you control.

Enable 2FA — But Do It Right

Two-factor authentication adds a second layer. But not all 2FA is equal:

📧> Email Security

Email is the primary vector for phishing and social engineering. It's also the primary identity anchor for most online services. Protecting it is non-negotiable.

Use an Encrypted Email Provider

Traditional email (Gmail, Outlook, Yahoo) is unencrypted in transit between mail servers (though TLS is now common, it's not end-to-end). The mail server operator can read everything. Your email provider is a trusted third party — and trust is a vulnerability.

• Proton Mail — zero-knowledge, end-to-end encrypted, based in Switzerland. Open source client. Free tier available.
• Tutanota — similar to Proton, German-based, also zero-knowledge. Free tier.
• Self-hosted (Mail-in-a-Box, Modoboa) — full control, but you're responsible for security, deliverability, and maintenance.

Email Hygiene

• Never click links in unsolicited emails. Hover over them. Read the actual URL. If it says "Your account is locked, click here" — don't click. Navigate to the service directly.
• Use a secondary email for registrations, newsletters, and anything low-trust. Your primary email is your identity. Don't hand it out freely.
• Enable DMARC, SPF, DKIM if you host your own domain. Prevents others from sending email as you (spoofing).
• Be suspicious of urgency. "Act now or your account will be deleted." Legitimate services give you time. Pressure is a manipulation tactic.
• Verify out-of-band. If an email says "your boss needs a wire transfer" — call your boss. If an email says "IT needs your password" — call IT. One phone call kills 90% of phishing.

📱> Secure Communication

If you're going to talk to someone about something sensitive — personal, professional, or political — the channel matters as much as the message.

🌐> Browser & Network Security

Your browser is your primary attack surface. Every website is potentially hostile. Every script is potentially malicious. Every pixel is a fingerprinting vector.

Browser Hardening

• Firefox + uBlock Origin — best default. uBlock Origin blocks trackers, ads, and fingerprinting scripts. Enable "Enhanced Tracking Protection" set to "Strict."
• Brave — built-in tracker and ad blocking. Convenient but less transparent. Closed source components.
• Disable JavaScript by default (uMatrix / NoScript). JavaScript is the most common vector for browser exploits and tracking. Allow it per-site when needed.
• Use separate profiles — one for personal banking, one for general browsing, one for sensitive work. Compartmentalization limits blast radius.
• Disable or restrict WebRTC — can leak your real IP behind a VPN.
• Check HSTS Preload — forces HTTPS. Most major sites already support it, but verify for sensitive services.

Network Privacy

• Use a reputable VPN — encrypts your traffic between you and your ISP. Prevents local network surveillance (public WiFi, hotel networks, hostile offices). Proton VPN, Mullvad, and IVPN are good options. The VPN is NOT a substitute for good hygiene — it just adds a layer.
• Use DNS-over-HTTPS (DoH) — prevents DNS poisoning and ISP-level DNS spying. Firefox and Proton VPN support this natively.
• Consider Tor for sensitive browsing — not for everything (slow), but for accessing sites that might be geoblocked or for extra anonymity layers. Use the official Tor Browser only.
• Disable IPv6 if your ISP is hostile — IPv6 can bypass some VPN configurations. Check your VPN provider's documentation.
• Use WireGuard for self-hosted VPNs — modern, fast, auditable. Better than OpenVPN in most cases for personal use.

Wi-Fi Security

• Home network: WPA3 (or WPA2-AES if WPA3 isn't available). Never WEP, never WPA2-TKIP. Change the default router password. Disable WPS.
• Public Wi-Fi: VPN or no sensitive traffic. Coffee shop networks are honey pots. Never bank, log in to sensitive accounts, or share sensitive information without a VPN tunnel.
• Enable "Private Address" / MAC randomization on your phone. Prevents device tracking across networks.

📋> Digital Hygiene & Operational Security

This is where most people fail. Not because they lack tools, but because they leak identity through behavior.

Reduce Your Digital Footprint

• Separate identities. Use different handles for different contexts. Your personal social media, your professional LinkedIn, and your anonymous forum account should not be cross-referenceable. A single shared name, email, or photo can link them all.
• Review your data. Use tools like Have I Been Pwned (haveibeenpwned.com) to check if your email appears in known breaches. Change passwords for compromised accounts immediately.
• Limit social media exposure. Every post, photo, check-in, and like is a data point. Geotagged photos reveal where you live and where you work. "Today's the 5th anniversary of my wedding to @username" reveals your relationship, anniversary, and their identity.
• Think before you share. A picture of your office whiteboard. A photo of your passport at a hotel. A tweet from a conference revealing your company and role. These are OSINT gold for attackers.

Device Security

• Enable full-disk encryption (BitLocker on Windows, FileVault on macOS, LUKS on Linux, native on iOS/Android). If your device is stolen, the data is useless without the key.
• Keep software updated. This isn't optional. Security patches fix exploited vulnerabilities. Auto-update is not a bug — it's a feature. The "reboot required" nag is the patch preventing the breach.
• Use a reputable antivirus/EDR for Windows machines (Defender is now genuinely good). On macOS, Gatekeeper + XProtect is baseline. On Linux, keep your packages updated.
• Biometric lock + strong device password. Your phone is a mini-computer with your identity, contacts, photos, and credentials. Protect it like one.
• Review app permissions regularly. Does that flashlight app need your contacts? Does that weather app need your location when the screen is off? Revoke permissions you don't recognize.

Physical Security

• Don't leave devices unattended in public spaces. "Over-the-shoulder" attacks and quick device grabs are real.
• Shred or incinerate paper with sensitive information. Old credit card applications, bank statements, printed passwords — all of it goes in a cross-cut shredder, not the trash.
• USB drives found in parking lots: do not plug in. Ever. The curiosity cost is too high. If you're testing, do it in an isolated virtual machine with no network access.
• Physical access to your devices — a locked room, a locked drawer, a bag that's hard to grab. Security starts at the physical layer.

🔒> Data & Encryption at Rest

Encryption protects data in transit. You also need encryption at rest — protecting data when it's sitting on a disk, in a backup, or in a cloud service.

• Encrypt sensitive files with tools like VeraCrypt (open source, cross-platform, full-disk or container encryption). For individual files, GPG (GNU Privacy Guard) provides strong encryption and signing.
• Encrypt your backups. An unencrypted backup is an unencrypted system with better storage. Use restic, Borg Backup, or Proton Drive (E2EE) for backup encryption.
• For long-term sensitive data, consider offline storage. An encrypted USB drive in a safe or a bank box. Air-gapped. Disconnected. The data doesn't exist online at all.
• Understand the 7-2-1 backup rule: 7 copies of critical data, 2 different media types, 1 offsite. If you only have one backup on one drive in one location, you don't have a backup — you have a copy.

🎭> Phishing & Social Engineering Defense

As discussed on the social engineering page, the human is the vulnerability. But you can build habits that make you harder to manipulate:

• The "Pause Rule": Any request that creates urgency ("act now," "within 24 hours," "immediate action required") triggers a mandatory pause. Breathe. Verify through a separate channel. The urgency is the manipulation — removing it removes the pressure.
• The "Second Channel" rule: Any request for credentials, money, or sensitive information that arrives via email, chat, or phone should be verified through a different channel. Email says "wire $50k to new vendor"? Call the CFO on a known number. Phone says "it's me, send the code"? Hang up, call back on a known number.
• Check the URL before you type anything. Not "securelogin-microsoft.com" or "paypal-verify.account.com." The actual domain. If it's not the exact domain you expect, don't log in.
• Don't trust the display name. "Sarah from IT" could be anyone. Check the actual sender address. Hover over the link. Read the full domain. Look at the SPF/DKIM headers if your email client shows them.
• Report, don't just delete. If you get a phishing email, report it to your IT team or the relevant abuse address. Your report helps protect the next person. Silent deletion helps only you.

⚙️> Self-Hosting & Data Sovereignty

The ultimate form of digital self-defense is not depending on someone else's infrastructure for the things that matter to you. Every cloud service you use is a point of trust. Every third-party API is a point of failure. Every subscription is a point of control.

What You Can Self-Host

You don't need to self-host everything. That's neither practical nor necessary. The principle is progressive sovereignty — the more critical the data, the more you want control over the infrastructure. Your email and documents matter more than your ad blocker. Your documents matter more than your calendar.

If you're running a Proxmox server (like I am for this site), self-hosting becomes almost trivial. A few LXC containers, a reverse proxy, a TLS certificate from Let's Encrypt, and you're running your own infrastructure. This site is proof of concept: Proxmox LXC, Nginx, Tor. No cloud dependencies.

🧠> The Mindset

None of this is about paranoia. It's about proportionality and awareness.

You don't need to live in a bunker. You don't need to burn your phone and buy a burner in a different country. You don't need to distrust every stranger. But you do need to understand the threat landscape — not to live in fear, but to make informed choices. The difference between "I don't care" and "I don't know what I'm doing" is the difference between a security posture and a security accident waiting to happen.

Security is not a destination. It's a practice. You don't "be secure" and then stop. You update, you review, you learn, you adapt. New threats emerge. New tools appear. New vulnerabilities are found. The people who stay safe are not the ones who did the most in 2024 — they're the ones who stayed aware in 2025, 2026, 2027.

Start with one thing. Enable 2FA on your email. Get a password manager. Update your software. That's the whole mountain. The rest is just walking.

// the best offense is a good defense // the best defense is awareness //