Digital privacy/security: Here's what I've learned; what have you found helpful?

TL;DR (too long; don't read) version: Digital privacy/security is easier than I thought, let's pool resources, here's what I mean by data, our needs are all different so our recipes will probably all be different, here's a YouTube video that might help, more resources to follow.

*Please take note that I am not an expert. My purpose is to share what I've found helpful, give an example of some things I'm doing and might do in the future, and open up a space where other permies can share what they do and have found helpful. My recipe is for me, and likely won't fit your individual needs. Please, please do your own research for your own needs.

Digital privacy protection isn't a new concept to this forum, but I haven't been able to find a thread dedicated to this subject. I stumbled onto the topic several weeks ago while preparing for my switch to Linux from Windows (something I'm preparing to do sometime this year). I thought beefing up online privacy was complicated and hard and expensive, but I was surprised to find it doesn't have to be any of those things. It's so approachable that I wanted to share what I've been learning with all of you. I think there's value in having a space where we pool our resources and experience with this topic.

To put it in familiar terms, I think I've found two privacy scales. One is
“how secure my data is from any interested party”, and the other is
“how deeply I understand all the technologies that impact how available my data is.”

Based on what I've learned, it seems a person can get pretty high on scale A without having to move the same amount on scale B. This is good, because on the “techie or normie” spectrum, I'm much closer to normie with a light sprinkle of techie knowledge.* I'm not afraid to tinker a bit (see uBlock Origin in the resource post below), but I don't want to spend a lot of time on it (past the initial setup), and I don't want to have to learn much about why/how it works in order to use it.

What I'm thinking of as “data” for the purposes of this thread: any identifying information shared via the internet.
It helps me to divide it into 3 broad kinds, for starters:

all the old-school analog bits that have been around for decades (name, DOB, physical address, phone #, SSN, account #s, email address, etc)

all the inadvertent bits of data debris I create when I use the internet or anything connected to it (topics I'm interested in, social media I follow, brands I buy, genres I watch/listen to, location of my connection to the web, browsing habits, etc.)

all the intentional, on-purpose bits I share that reveal something about me (groups I join, social media posts/comments I write, pages/posts/products I like/thumbs up, location sharing with family/friends, pictures I post, etc.)

Like so many other things in life, everyone's needs in this area are probably different. Taking some time to figure out what your individual privacy goals are might help you pick and choose the best-fitting methods. It's called making a “threat model”. I don't have experience with this, as I didn't discover the concept until after I'd already started making changes.To wrap up, I'll embed a video from Techlore (about 12 minutes long) which walks you through making a threat model in a simple, approachable way.
I'll follow this post up with links to resources I've found helpful, and things I've done or am considering doing in the future.

Lots of links ahead! Have you used any of these? What other steps have you taken? What other resources do you rely on to stay informed about this topic?

Background: I'm currently running Windows 10 Pro on a 10- or 11-yr old Dell Latitude e7440. It has the Intel Core i5 w/ 8GB RAM and 256GB on a Solid State Drive – no camera and no fingerprint scanner. I use it for web browsing, casual game-playing, video watching, word processing, and photo transfer (phone to external hard drives). I routinely use Apache Open Office, Firefox, e-Sword, and a few offline desktop games. (Black Xs denote things I have already implemented.)

General Resources

x Test your browser's privacy/security level at Electronic Frontier Foundation's Cover Your Tracks (link leads to About page. Click the paw print logo then click Test Your Browser button to start the test.)

x Take a privacy quiz (Link to Techlore's website)

Various Privacy & Security apps/services (Link to lists compiled by Techlore)

3 YouTube channels I have found helpful:

- Trafotin Kind of rant-y at times, but seems experienced and sounds like he does his off-video homework. Advocates privacy, and being willing to change products if an app or service comes along that performs better, or if our current setup becomes obsolete or inadequate.
- Techlore Have compiled a big resource of products and services they trust/recommend. Lots of tutorials and advice on various tech topics. Developed an online course around this topic (I have not explored the e-course.) Maintains a website with privacy & security resources which they have researched.
- The Hated One Sinister-looking visuals on this channel but the tutorials seem thorough and well-researched. It may help to slow down playback speed to get all the info. I've found he does a good job of showing each step on the screen.

Computing & Web Browsing

x Use Firefox instead of default OS browser

x Configure Firefox for better privacy (aka “hardening” Firefox)

Link to slightly dated but still informative YouTube tutorial (9 minutes)

x Install the uBlock Origin Firefox add-on

x Change uBlock Origin settings to Medium mode

- Link to 2018 YouTube tutorial (17 minutes) This video is still recommended by uBlock Origin's developer in his wiki file..
- This is a lot less intimidating than it first seems. Initial setup requires some time, and there's a learning curve involved. But it's very doable.

Install Arkenfox.js user profile for Firefox?

- Link to YouTube tutorial (36 minutes) I'm still undecided about doing this. It supposedly can break websites.

Quit using Firefox's built-in password manager

Keep my OS current w/security updates (get on a schedule/routine)

I struggle here. Windows updates are so unpredictable, and (whiny voice) I like things to stay the same! But, sigh, no excuse.[/list]

Resources to help know which updates to accept when:

1. Krebs on Security breaks down Windows Patch Tuesday updates.
2. Susan Bradley, an author at AskWoody.com, has a rating system for knowing whether to install a Windows patch right away or not.
3.Trafotin has an in-depth YouTube video about this (16 minutes long).

Switch OS from Windows 10 to a stable, actively-developed, current Linux OS
-I've chosen Fedora Workstation, running default GNOME. (The GNOME desktop environment looks visually less distracting, and different from Windows. These are pluses for me. Here's a rant-y but informative YouTube video about it. (17 minutes) I want to do this in the next year, preferably in the next 9 months.)

Install and use next-level browser: Mullvad? Brave?

Install and use Tor Browser

Password management

x Install KeePassXC password manager and begin using it to generate and save all passwords

Research 3rd party iPhone password managers, choose one, install, & use

Delete all passwords from Firefox & Safari/iPhone's default password managers

Phone

x Configure settings (especially location services) to make it more private

Research and implement further phone privacy practices (different browser? different messaging app?)

3/4x Delete all social media apps (I still have Facebook Messenger installed.)

Buy anonymized phone or buy an anonymizable phone and anonymize it

Privacy by compartmentalization

Create separate profiles in Firefox (YouTube tutorial: custom profiles in Firefox 14 minutes)

Create separate compartments for different areas of life (i.e.; business, social media, & personal identities), each with its own software (YouTube tutorial: next-level compartmentalization 25 minutes)

Highest level (Dunno if this will be possible for me, but it's my eventual aim)

Get rid of the smart phone

Delete all social media accounts

Use only desktop-based Free, Open-Source Software (or secure proprietary software if it is better suited for my needs that is secure, no subscriptions/accounts) (no web apps)

Cash-only transactions

Install and use Qubes OS (Link to Qubes OS intro page)

All the links worked from the preview at the time I posted this.

I came across two other Permies threads about this topic.

email platforms for various community groups
and
Internet Privacy When Organizing Events: Possible?

I'm working on migrating passwords into KeePassXC (laptop) and Strongbox (phone).
Next thing to learn: I keep encountering the concept of "passkeys" new technology versus "passwords" old technology. Is anyone here familiar with using them?
I'm wondering if they're the inevitable next step that we'll need to adapt to, or optional.

First, a super-helpful permies resource thread! At least two links (so far) to lists of free, open-source software and privacy-respecting software and services.

Two-year report (summer 2026)

I switched from Windows to Fedora Workstation (GNOME desktop environment) last year. Love it so far!
It lets me keep my workflows separate and decluttered.

KeePassXC and its browser extension manages passwords on my laptop. Impressions: robust, powerful, easy to use. Probably am not utilizing it to full potential.
Strongbox handles passwords on my phone.

I pay for Proton Mail, mostly so I can have access to some Proton Pass services. It is so worth it to me. Encrypted emails, aliases, multiple addresses to send from so I don't have to give out my main account address - I feel I'm getting big value for my money.
I fully expect to expand my use of the Proton suite of services in the future.

I browse the internet in a somewhat-hardened Firefox.
If I need to log in to any Big Tech accounts, or shop and pay for something, I use Brave browser (aggressive blocking), choosing a profile specific to what I'm doing (shopping, YouTube/Google, Facebook).

uBlock Origin (medium mode) in Firefox continues to perform well. I understand it's no longer available as a full version in Brave (or other Chrome-based browsers).

I search with DuckDuckGo. I don't love it but I like it way better than Big Tech options. Nor do I have time these days to spend researching and experimenting. I accept DDG as the best for me, right now.
Partly that is DDG, but mostly I'm frustrated by wading through AI-generated results. A sometimes-useful workaround: restricting my results to those published before 2020. Not a perfect solution.
I like that Duck search settings are so tweakable; however I prefer Firefox to forget all the cookies. So I think my DDG settings get forgotten too, and I'm not prepared to open the cookie flow just for Duck.

I discriminate between which Free, Open-Source Software I aquire. I favor actively maintained/updated options, and Fedora-verified ones. A few favorites, so far: LibreOffice, GIMP, Inkspace, WINE (from Fedora repositories, using Terminal), Planify, Progress, VLC (media player), and Pika Backup.
I'm familiar with Audacity (audio manipulation) and will probably get it at some point but don't need it currently.

I still have my old laptop running Windows 10. I turn it on rarely. I keep it away from the internet. I run one Windows-based program in WINE (e-Sword). It's not perfectly smooth, and I may keep the Windows laptop solely for that use. Undecided so far.

I think my biggest weakness right now is that I visit Kongregate regularly to play free online games. I'm not a gamer; this habit helps me wind down in the evenings. I haven't found a substitute yet. I do this in hardened Firefox with uBlock Origin running on medium mode. I don't have an account there; I don't log in.
I'm not sure how serious I should be (from a privacy/security perspective) about changing this habit.
Can anyone tell me?

I have more to do but switching to Fedora was a major step forward. I'm happy with the progress I've made, and am content to tread water at this level for a bit. I still am working out some things in Linux (haven't found a backup system to satisfy me yet) and I'm still getting used to using Terminal. Weaning off Gmail is the ongoing next big task, but there's no set deadline for that yet.

Sara, you can install Privacy Badger too. It's developed by the Electronic Frontier Foundation (EFF) as a tracking control, available in the extensions library of most browsers. I use Linux-Mint Debian Edition v.7 with the Cinnamon Desktop Environment and also use both Firefox and Brave. I also use Thunderbird for email accounts as it can easily log in to several email accounts at once, giving me a local utility for all of my email accounts. To set up Proton on T-bird you have to download Proton's app. Proton has a how-to on their site. T-bird has a good spam filter, plus you can easily build your own filters to sort emails. T-bird can optionally identify probable phishing emails for you too.
One of the first things I do after an installation is to make sure ufw (uncomplicated firewall is enabled with default filters. That's basically all I use for system security. I also have my browsers set to delete all data when they're closed, cache, history, cookies, etc. Yeah, I have to log into all accounts when I start the browsers up again, but it helps cut down unknown tracking.
As for reducing or eliminating your online ID ... Between each state's DMV and courthouse records as well as some other surprising sources of publicly available private info, which are amazingly accessible to the public in several ways, removing your ID from the 'net is a waste of time, and if you use one of the ID removing services, you're throwing your money away. Most state DMVs even sell your info to insurance companies and licensed private investigative services including firms that offer background checks for employment and insurance screenings. Your ID is out there and there's not a darned thing you can do about it.
Another good source is Kim Komando. She's built herself into quite the know-it-all, but in a good way.
Several months ago I was notified that a slug of my personal health and probably financial info was hijacked from a health care central info bank. I'm now reviewing my credit records regularly through the 'big three' plus a couple other sources. I'm checking into my bank site regularly to look over all transactions, and the site that was hacked has also offered to put me on a financial security watch program, which I accepted of course. So, between all the publicly available 'private' information available for sale and the hacking going on, you've got no privacy in actuality. The best you can do is to keep big tech tracking at bay as best you can and avoid as many targeted ads as possible.
For those few people who don't own a PC or a cell phone and think they're safe, got some really bad news for them.

Lots of new resources ahead - thanks for all the suggestions, Blaine!

Blaine Clark wrote:Sara, you can install Privacy Badger too. It's developed by the Electronic Frontier Foundation (EFF) as a tracking control, available in the extensions library of most browsers.

I have used that in the past; thanks for the reminder! Here's Privacy Badger's FAQ page in case anyone wants more info. I came across some discussion about using other ad/tracking blockers alongside uBlock Origin. uBO's developer doesn't recommend it, but some (reddit) people do so with seemingly no ill effects.

To set up Proton on T-bird you have to download Proton's app. Proton has a how-to on their site.

Oh, yeah! I forgot about that option. Proton Mail Bridge. Here's that setup guide you mentioned. Looks like it's currently (October 2026) only available to paying users with a Proton Mail account. I think there's a free 14-day trial available for the free tier though.
Proton has desktop and mobile apps now; I'm pretty happy with both. I have not explored their filtering and organization options yet.

One of the first things I do after an installation is to make sure ufw (uncomplicated firewall is enabled with default filters. That's basically all I use for system security.

I had to do some reading on this one, because it's been ages since I thought about a firewall and I wondered if I'd missed something when I switched to Linux. I found helpful articles on UFW at both LinuxVox and LinuxConfig. Both are recent sources.

As best I can tell (reading online and poking around in my Terminal), Fedora comes with firewalld pre-installed and enabled by default. Whew!
Here are a couple links to articles on the common Linux firewall flavors (iptables, firewalld, and ufw):
This one covers all three methods
This older source from 2018 discusses iptables and firewalld

And Techlore discusses Linux firewalls in this older video (2021), beginning around the 3:09 mark:

I also have my browsers set to delete all data when they're closed, cache, history, cookies, etc. Yeah, I have to log into all accounts when I start the browsers up again, but it helps cut down unknown tracking.

I liked that about the Firefox hardening guide I followed – every new window is a private window and data is cleared on close. My habit is to log in only when I need access, so the inconvenience seems minimal for me, too. Using a secure password manager helped with that (currently KeePassXC for me).

Your ID is out there and there's not a darned thing you can do about it.

It’s such a tangle, isn’t it? There’s so much we can’t take back. Without our knowledge or permission, our personal information and habits became a commodity to be sold and traded. I definitely felt hopeless at first when I learned about the extent of info that is gathered about us just in the course of living a normal life.
what websites I visit
where I spend my money
what products I buy
my methods of payment
how often I buy things
what products I research
what operating systems and software I use
where I access the internet from
on what devices
All that (and more!) is data that can potentially be connected to me, analyzed, and sold in our brave new world.

When I learned there were free, relatively simple changes I can make to reduce and sometimes even prevent this happening, that was empowering. Over time, as I make these changes, I get more clarity on my goals in this space. I personally don't need total anonymity (though some people might) at this stage in my life. I do find that I can reduce how much info is collected, and I can influence which identifiers are connected to each other. Also with these tools, I can better steward what is mine - doing what I can to make sure only the necessary parties have access to it, and no one else. So far the returns are worth the investment of time for me.

I really like how Henry of Techlore presents this:

Security asks: can the wrong people access this data?
Privacy asks: who knows what about me, and did I consent to that?
Anonymity asks: can this be traced back to me at all?

Another good source is Kim Komando. She's built herself into quite the know-it-all, but in a good way.

I found Kim Komando's website and  and her YouTube channel to explore, thanks!