In 99.999999999% cases I prefer prevent instead of defend tactic. I block adds, 3rd part content (including cookies) and usually access sites I already known. I use Gentoo Linux and I decide what’s inside my environment setup part by part. Maybe it’s a bit too manual, but in exchange I don’t have support for everything like cups without a printer and so on.

Most of apps and services is open source alternative for BigTech products. I rarely use Google, Twitter/X account only for giveaways, Discord only for a contact with family and Slack also for Elixir contacts. I had a LinkedIn account, but for some reason just checking inbox was a “suspicious activity” and because of that they require my ID scan (which in many countries is illegal btw.), so I showed middle finger and stopped using it.

I do not pay by card online. I prefer cash or “old, good” bank transfer. Simply most type of attacks that require “rush without thinking” does not work on me. On a single key I access a terminal with lots of useful information and actions.

obraz1200×659 124 KB

I use a Yubikey as a 2FA for doing anything with root access in my computer.

Also, for critical files, I create a vault with CryFS (which I can easily manage using the Gnome app called Vaults) and only mount it when I need something from it.

For firewall, I have a small device running PFSense that manage all the internet access to my local network instead of handling that in each computer.

Finally, for data storage and backup I use a NUC as a NAS with all data and I have a wireguard VPN setup on it so i can access it when I’m not at home.

macOS

Apart from the obvious like setting a password etc…

• Turn on FileVault to encrypt your drive: Privacy & Security > FileVault
• Turn on your firewall: Network > Firewall (then periodically click on ‘Options’ to check those in the list of incoming connections).
• Enable end-to-end encryption of iCloud data: iCloud > Advanced Data Protection

Oddly - none of the above is on by default!

• Install LittleSnitch to allow/disallow connections to the web (there are free alternatives)
• Set up Time Machine backups (encrypted and usually run two and keep old copies)
• Check Privacy & Security > Files * Folders to see which folders your apps can access
• Check Privacy & Security > Full Disk Access
• Check Privacy & Security > Accessibility to see which apps can ‘control’ your Mac
• Check Lock Screen > require password after screen saver begins immediately/whatever you require
• Check General > login items for apps/services that automatically start at login
• Check your folder permissions (particularly if you have added any to you home folder). Folder > right click > info (should be you > Read & Write and everyone > no access)
• Privacy & Security > Advanced > log out automatically after inactivity (means a password would be required instead of just Touch ID)

You may also want to look at Apple’s new Lockdown Mode, which they say can offer extreme protection.