Someone dropped a question into a group chat last week: "which VPN should I get?" That was the entire message. No context, no because-of-what.
I used to just answer. Now I ask a question back, which apparently is annoying: who are you hiding from?
It's not rhetorical. A VPN relocates the exit point of your traffic and moves your trust from an ISP to a company whose whole marketing budget goes toward telling you it is trustworthy. That's a real thing it does. It's just not "safety" — it's one specific move against one specific adversary, namely someone watching the network segment you're sitting on, or a site doing coarse geography from your IP.
If the person you're actually worried about is an ex who knows your account recovery answers, the VPN did nothing. Zero. You bought a feeling.
the shape of the wrong question
Tool-first thinking always has the same shape:
feel exposed → acquire thing → feel less exposed
That middle step is doing emotional labor, not security work. And it's a loop, because the anxiety comes back in a month, so you buy the next thing. I've sat down with people who had a hardened laptop, three password managers, a hardware key still in its blister pack, and a personal phone signed into an app that had been quietly syncing their entire contact list under their full legal name for two years.
Actually — that's unfair to the tools. The tools were mostly fine. The problem is they got picked before anyone said out loud what they were for.
an inventory, not a shopping cart
Three columns. On paper, or in a text file you delete afterward.
Assets. Not "my data." Be embarrassingly specific. The list of people who message me about their employer. My home address. The fact that I'm the one running that account. My drafts folder.
Adversaries. Who wants any of that, and why they'd bother. Give them roles, not names.
Consequences. What happens if they get it. "Mildly humiliating" and "someone shows up at my door" are not the same row and should not get the same budget.
That's the whole exercise. If it doesn't fit on an index card, it isn't a model yet.
A threat model that lists every possible attacker is functionally the same as having no threat model. You've written down the whole world and called it analysis.
personas
I reuse roughly the same cast and adapt per situation. "Cost" here means their cost — time, money, exposure, odds of getting noticed.
| persona | what they want | what it costs them | what actually stops it |
|---|---|---|---|
| the opportunist | anything sellable, at scale | near zero, fully automated | unique passwords, MFA, patching |
| the snoop | to know about you specifically | hours, and they may already have access | device locks, compartments, boring habits |
| the aggregator | your behavior as a product | it is their business model | blocking, minimizing, fewer linked accounts |
| the resourced adversary | one specific outcome, and they'll pay | weeks and real money | mostly not being their target; then process |
The uncomfortable row is the last one. If a patient, well-funded adversary is genuinely in your model, no consumer product on the market solves that, and anyone selling you one as a solution is lying to you. What helps is procedure: compartments, less data held, smaller blast radius, and people around you who know what to do when something goes sideways.
the boring wins
Once the card exists, the recommendations get dull. That dullness is the tell that they're correct.
- A password manager, with every account actually migrated into it — not just the new ones.
- Phishing-resistant MFA on the accounts that can reset your other accounts. Email first. Email is always first.
- Automatic updates on everywhere, no exceptions carved out for "stability."
- Full-disk encryption with a passphrase you could survive being asked for.
- Backups you have restored from at least once. An untested backup is a rumor.
- Fewer accounts. Delete things. Data you don't hold can't leak.
Nothing there is fun. It closes out the opportunist almost entirely and most of the snoop, which for the majority of people is the overwhelming share of their real risk. And that's the point — clear the noise so the genuinely hard 5% gets your attention instead of being drowned in it.
it rots, so re-read it
Threat models go stale fast. Change jobs and the adversary list changes. Start covering a new industry and it changes. End a relationship and it changes immediately, usually in the direction of someone who knows your recovery answers and your dog's name.
I re-read my card every quarter and after anything eventful. Ten minutes. Maybe half the time I delete a row, which is the best possible outcome: one fewer thing to defend, forever.