Digital privacy/security: Here's what I've learned; what have you found helpful?

TL;DR (too long; don't read) version: Digital privacy/security is easier than I thought, let's pool resources, here's what I mean by data, our needs are all different so our recipes will probably all be different, here's a YouTube video that might help, more resources to follow.

*Please take note that I am not an expert. My purpose is to share what I've found helpful, give an example of some things I'm doing and might do in the future, and open up a space where other permies can share what they do and have found helpful. My recipe is for me, and likely won't fit your individual needs. Please, please do your own research for your own needs.

Digital privacy protection isn't a new concept to this forum, but I haven't been able to find a thread dedicated to this subject. I stumbled onto the topic several weeks ago while preparing for my switch to Linux from Windows (something I'm preparing to do sometime this year). I thought beefing up online privacy was complicated and hard and expensive, but I was surprised to find it doesn't have to be any of those things. It's so approachable that I wanted to share what I've been learning with all of you. I think there's value in having a space where we pool our resources and experience with this topic.

To put it in familiar terms, I think I've found two privacy scales. One is
“how secure my data is from any interested party”, and the other is
“how deeply I understand all the technologies that impact how available my data is.”

Based on what I've learned, it seems a person can get pretty high on scale A without having to move the same amount on scale B. This is good, because on the “techie or normie” spectrum, I'm much closer to normie with a light sprinkle of techie knowledge.* I'm not afraid to tinker a bit (see uBlock Origin in the resource post below), but I don't want to spend a lot of time on it (past the initial setup), and I don't want to have to learn much about why/how it works in order to use it.

What I'm thinking of as “data” for the purposes of this thread: any identifying information shared via the internet.
It helps me to divide it into 3 broad kinds, for starters:

all the old-school analog bits that have been around for decades (name, DOB, physical address, phone #, SSN, account #s, email address, etc)

all the inadvertent bits of data debris I create when I use the internet or anything connected to it (topics I'm interested in, social media I follow, brands I buy, genres I watch/listen to, location of my connection to the web, browsing habits, etc.)

all the intentional, on-purpose bits I share that reveal something about me (groups I join, social media posts/comments I write, pages/posts/products I like/thumbs up, location sharing with family/friends, pictures I post, etc.)

Like so many other things in life, everyone's needs in this area are probably different. Taking some time to figure out what your individual privacy goals are might help you pick and choose the best-fitting methods. It's called making a “threat model”. I don't have experience with this, as I didn't discover the concept until after I'd already started making changes.To wrap up, I'll embed a video from Techlore (about 12 minutes long) which walks you through making a threat model in a simple, approachable way.
I'll follow this post up with links to resources I've found helpful, and things I've done or am considering doing in the future.

Lots of links ahead! Have you used any of these? What other steps have you taken? What other resources do you rely on to stay informed about this topic?

Background: I'm currently running Windows 10 Pro on a 10- or 11-yr old Dell Latitude e7440. It has the Intel Core i5 w/ 8GB RAM and 256GB on a Solid State Drive – no camera and no fingerprint scanner. I use it for web browsing, casual game-playing, video watching, word processing, and photo transfer (phone to external hard drives). I routinely use Apache Open Office, Firefox, e-Sword, and a few offline desktop games. (Black Xs denote things I have already implemented.)

General Resources

x Test your browser's privacy/security level at Electronic Frontier Foundation's Cover Your Tracks (link leads to About page. Click the paw print logo then click Test Your Browser button to start the test.)

x Take a privacy quiz (Link to Techlore's website)

Various Privacy & Security apps/services (Link to lists compiled by Techlore)

3 YouTube channels I have found helpful:

- Trafotin Kind of rant-y at times, but seems experienced and sounds like he does his off-video homework. Advocates privacy, and being willing to change products if an app or service comes along that performs better, or if our current setup becomes obsolete or inadequate.
- Techlore Have compiled a big resource of products and services they trust/recommend. Lots of tutorials and advice on various tech topics. Developed an online course around this topic (I have not explored the e-course.) Maintains a website with privacy & security resources which they have researched.
- The Hated One Sinister-looking visuals on this channel but the tutorials seem thorough and well-researched. It may help to slow down playback speed to get all the info. I've found he does a good job of showing each step on the screen.

Computing & Web Browsing

x Use Firefox instead of default OS browser

x Configure Firefox for better privacy (aka “hardening” Firefox)

Link to slightly dated but still informative YouTube tutorial (9 minutes)

x Install the uBlock Origin Firefox add-on

x Change uBlock Origin settings to Medium mode

- Link to 2018 YouTube tutorial (17 minutes) This video is still recommended by uBlock Origin's developer in his wiki file..
- This is a lot less intimidating than it first seems. Initial setup requires some time, and there's a learning curve involved. But it's very doable.

Install Arkenfox.js user profile for Firefox?

- Link to YouTube tutorial (36 minutes) I'm still undecided about doing this. It supposedly can break websites.

Quit using Firefox's built-in password manager

Keep my OS current w/security updates (get on a schedule/routine)

I struggle here. Windows updates are so unpredictable, and (whiny voice) I like things to stay the same! But, sigh, no excuse.[/list]

Resources to help know which updates to accept when:

1. Krebs on Security breaks down Windows Patch Tuesday updates.
2. Susan Bradley, an author at AskWoody.com, has a rating system for knowing whether to install a Windows patch right away or not.
3.Trafotin has an in-depth YouTube video about this (16 minutes long).

Switch OS from Windows 10 to a stable, actively-developed, current Linux OS
-I've chosen Fedora Workstation, running default GNOME. (The GNOME desktop environment looks visually less distracting, and different from Windows. These are pluses for me. Here's a rant-y but informative YouTube video about it. (17 minutes) I want to do this in the next year, preferably in the next 9 months.)

Install and use next-level browser: Mullvad? Brave?

Install and use Tor Browser

Password management

x Install KeePassXC password manager and begin using it to generate and save all passwords

Research 3rd party iPhone password managers, choose one, install, & use

Delete all passwords from Firefox & Safari/iPhone's default password managers

Phone

x Configure settings (especially location services) to make it more private

Research and implement further phone privacy practices (different browser? different messaging app?)

3/4x Delete all social media apps (I still have Facebook Messenger installed.)

Buy anonymized phone or buy an anonymizable phone and anonymize it

Privacy by compartmentalization

Create separate profiles in Firefox (YouTube tutorial: custom profiles in Firefox 14 minutes)

Create separate compartments for different areas of life (i.e.; business, social media, & personal identities), each with its own software (YouTube tutorial: next-level compartmentalization 25 minutes)

Highest level (Dunno if this will be possible for me, but it's my eventual aim)

Get rid of the smart phone

Delete all social media accounts

Use only desktop-based Free, Open-Source Software (or secure proprietary software if it is better suited for my needs that is secure, no subscriptions/accounts) (no web apps)

Cash-only transactions

Install and use Qubes OS (Link to Qubes OS intro page)

All the links worked from the preview at the time I posted this.

I came across two other Permies threads about this topic.

email platforms for various community groups
and
Internet Privacy When Organizing Events: Possible?

I'm working on migrating passwords into KeePassXC (laptop) and Strongbox (phone).
Next thing to learn: I keep encountering the concept of "passkeys" new technology versus "passwords" old technology. Is anyone here familiar with using them?
I'm wondering if they're the inevitable next step that we'll need to adapt to, or optional.

First, a super-helpful permies resource thread! At least two links (so far) to lists of free, open-source software and privacy-respecting software and services.

Two-year report (summer 2026)

I switched from Windows to Fedora Workstation (GNOME desktop environment) last year. Love it so far!
It lets me keep my workflows separate and decluttered.

KeePassXC and its browser extension manages passwords on my laptop. Impressions: robust, powerful, easy to use. Probably am not utilizing it to full potential.
Strongbox handles passwords on my phone.

I pay for Proton Mail, mostly so I can have access to some Proton Pass services. It is so worth it to me. Encrypted emails, aliases, multiple addresses to send from so I don't have to give out my main account address - I feel I'm getting big value for my money.
I fully expect to expand my use of the Proton suite of services in the future.

I browse the internet in a somewhat-hardened Firefox.
If I need to log in to any Big Tech accounts, or shop and pay for something, I use Brave browser (aggressive blocking), choosing a profile specific to what I'm doing (shopping, YouTube/Google, Facebook).

uBlock Origin (medium mode) in Firefox continues to perform well. I understand it's no longer available as a full version in Brave (or other Chrome-based browsers).

I search with DuckDuckGo. I don't love it but I like it way better than Big Tech options. Nor do I have time these days to spend researching and experimenting. I accept DDG as the best for me, right now.
Partly that is DDG, but mostly I'm frustrated by wading through AI-generated results. A sometimes-useful workaround: restricting my results to those published before 2020. Not a perfect solution.
I like that Duck search settings are so tweakable; however I prefer Firefox to forget all the cookies. So I think my DDG settings get forgotten too, and I'm not prepared to open the cookie flow just for Duck.

I discriminate between which Free, Open-Source Software I aquire. I favor actively maintained/updated options, and Fedora-verified ones. A few favorites, so far: LibreOffice, GIMP, Inkspace, WINE (from Fedora repositories, using Terminal), Planify, Progress, VLC (media player), and Pika Backup.
I'm familiar with Audacity (audio manipulation) and will probably get it at some point but don't need it currently.

I still have my old laptop running Windows 10. I turn it on rarely. I keep it away from the internet. I run one Windows-based program in WINE (e-Sword). It's not perfectly smooth, and I may keep the Windows laptop solely for that use. Undecided so far.

I think my biggest weakness right now is that I visit Kongregate regularly to play free online games. I'm not a gamer; this habit helps me wind down in the evenings. I haven't found a substitute yet. I do this in hardened Firefox with uBlock Origin running on medium mode. I don't have an account there; I don't log in.
I'm not sure how serious I should be (from a privacy/security perspective) about changing this habit.
Can anyone tell me?

I have more to do but switching to Fedora was a major step forward. I'm happy with the progress I've made, and am content to tread water at this level for a bit. I still am working out some things in Linux (haven't found a backup system to satisfy me yet) and I'm still getting used to using Terminal. Weaning off Gmail is the ongoing next big task, but there's no set deadline for that yet.