Proportional Personal Digital Security

The pace, scope and sheer randomness of recent breaches have brought me to reconsider my laissez-faire approach to personal digital security.¹ What do I mean by that? Up until now, I was the kind of guy who tried to avoid all kinds of multi-factor authentication because, of course, it’s just annoying.

I have long adopted Felix von Leitner’s (“Fefe”) “Lying on the Internet”² stance, because it’s only a matter of time until your data gets hacked, stolen or leaked one way or the other. Yet I always assumed that I would never become a person of interest. Because what is there to get?

But as in any good mob movie drive-by, with capable LLMs at scale and at marginal cost in the hands of anyone, you (or I, for that matter) could just fall victim by chance.

One month of security incidents

In the last four weeks alone: Hackers heated supermarket fridges in nine European countries, after a first round in France where some caught fire. PHP patched two critical vulnerabilities that could allow unauthenticated remote code execution. GitLab patched a flaw rated 10 out of 10. An AI model found a Linux kernel bug that leads to remote root access. eMudhra certificate-authority keys were compromised. ConnectWise disclosed compromised Cloud Backup identities, exposing customers’ Microsoft 365 environments. LiteLLM distributed credential-stealing malware through PyPI and its official Docker images. Railway warned that customer secrets may have been accessed. OpenCode said its users’ AI provider keys may have been exposed. Zeabur announced it would shut down after its second security incident in two months. A Latvian telecom left 125 million text messages in an exposed database, bank codes included.

Some organizations took websites offline while patching the PHP vulnerabilities. And by the time I publish this, it is probably all outdated, and dozens of new vulnerabilities have surfaced.

Walled gardens around sandcastles

It’s probably too early to call the end of the global Internet. But I can see an argument for putting more systems behind explicit access controls, kind of creating smaller subwebs, the opposite of the current global Internet.

It is much harder to build a sandcastle than to tear one down, so you might as well build a walled garden around it. If automated exploitation gets cheaper faster than organizations can patch their software, keeping services publicly reachable becomes more expensive. More of the web could retreat into private networks, with restricted connections between them.

Digital hygiene, with a sense of proportion

But enough about that. Where did I start after my personal watershed moment? In 2025 Andrej Karpathy, probably ahead of his time as usual, published a piece on digital hygiene.

Inevitable and regular data breaches eventually runoff and collect your information into dark web archives, feeding into a whole underground spammer / scammer industry of hacks, phishing, ransomware, credit card fraud, identity theft, etc.

I took this as my guiding principle when rethinking my approach to personal digital security. I think the only piece that was missing for me was an approach to proportionality. Basically the Pareto-optimal point between maximum security and maximum convenience.

What does that look like in practice? I ask myself what happens if an account gets taken over. For most of them the honest answer is: not much. Someone gets my (fake) address and a password I use nowhere else. Annoying, but I’ll live.

Then there are the few accounts that everything else hangs on. If someone gets into my Apple ID or my main email, they can reset pretty much everything else. So those get the full, annoying treatment, and I’ve stopped complaining about it.

The other thing I look at is how often something gets in my way. Disk encryption I turned on once and never thought about again. A hardware key I have to dig out every time I log in somewhere is a different story, so it had better protect something that would really hurt to lose.

Who am I protecting myself from? The drive-by. If someone with time and money really wants to get to me specifically, they probably will, and I’m not going to rearrange my life for that.

My digital hygiene checklist

So going down Karpathy’s list, this is what I did:

• Password manager: Already did, using Apple Keychain / Apple Passwords. But I’m considering switching to 1Password. Not necessarily for security reasons, mostly because they introduced 1Password for Agents.
• Hardware security key: I bought two YubiKeys and set them up for my “most valuable” accounts, like my Apple ID and my main email.
• Biometrics: Already using.
• Security questions: This is a big one, but it’s such a hassle to reconfigure all of those.
• Disk encryption: Already using.
• DNS-based blocker: Set up a Pi-hole with HaGeZi’s Pro and Threat Intelligence Feeds lists, which together block about 1.6 million domains.
• Internet of Things: Created a guest network with full isolation and only Internet access, and put my Shelly devices as well as my Dreame vacuum robot on that.
• Messaging: Unfortunately still using WhatsApp. This is probably the biggest convenience one. I’m just delusional enough to think that WhatsApp is also end-to-end encrypted (it has used the Signal Protocol since 2016).
• Browser: Should probably be using Brave. Still using Chrome and Safari.
• Search engine: Signed up for Kagi, just didn’t get the hang of the experience, so I’m back to Google for now.
• Credit cards: I’m using Revolut to mint virtual and disposable credit cards tied to scoped pockets and wallets.
• Address: See above (“Lying on the Internet”).
• Email: I set up a custom domain and I use Proton SimpleLogin to mint separate addresses for each service.
• VPN: I use Proton VPN whenever possible.
• Network monitor: Probably an interesting next step.

Where convenience still wins

So, am I unhackable now? Of course not. But looking at the list, most of it I had to do exactly once: an afternoon for the Pi-hole, two YubiKeys, a guest network. Since then I barely notice any of it.

What I skipped is the stuff that would annoy me every day. I’m still on WhatsApp, still on Chrome, back on Google. I know. For now that’s a price I’m not willing to pay, and I’m fine admitting that this is convenience winning.

Maybe that changes. If the drive-bys keep getting cheaper, I’ll probably have to move a few more things over to the annoying side. Next up are the security questions. Fittingly, I’ll just lie.