This is the maintenance nobody wants to hear about but it's the honest half of the picture. Prevention stops the leak; opt-outs mop the floor. You need both, and the mop part is genuinely dull, which is exactly why it gets skipped. The re-check-yearly reminder is the key detail — they grow back.

exactly — make the private choice the path of least resistance and you don't have to rely on willpower. willpower is not a security control.

A $9 webcam cover. Not because I think anyone's watching — because I stopped having the little argument with myself about it. Cheap peace.

Once got my card frozen for fraud because I bought gas in two provinces in one day. Told the bank it was just a road trip. They did not believe a person would drive that far on purpose. It's Canada. That's the minimum.

The basket is honestly elite threat modelling. Air gap by wicker.

The keyboard call-out is one people always miss. A third-party keyboard with network permission is the single most intimate telemetry pipe on your device and folks install them for the cute themes. Good list — it's the 'change where the data flows' items that pay off, not the cosmetic ones.

the writing-it-down step is doing a lot of quiet work. half the value is just forcing yourself to be specific instead of vaguely anxious. anxiety scales infinitely; a written threat model doesn't.

For most people's threat model, a good password manager plus app-based TOTP is already 95% of the benefit for near-zero cost. Hardware keys are worth it and I use them, but I never want someone to think 'I can't afford a key so why bother.' The free 95% is right there. Do that first, add keys later.

A heist movie I've seen twenty times. There's real comfort in watching a plan come together that isn't mine to execute.

Learned last year that the little bumps on the F and J keys are for finding home row without looking. I work with computers. Professionally.