Sometimes I see attitudes in the privacy community like there’s no valid reason to use any messenger other than Signal or everyone should use GrapheneOS on their phone and Linux on their PC, or no one should use Brave, just use Firefox, or don’t use Firefox because Mozilla is doing things I don’t like, just use Vivaldi.
This is not helpful. The sort of elitist, small-minded attitude of everyone should use the same tools and techniques I do, otherwise they’re stupid or a lost cause is deeply harmful to the goal of increasing people’s privacy and security, improving their digital rights and their relationship with technology.
Everyone is different. We all have different goals, different threat models, different lifestyles. We have different preferences for the things we like to use, and we have different things that we worry about. We also have varying levels of skills, knowledge, time, energy, and how comfortable we are with technology.
This is all totally okay. Not everyone needs to go hardcore. Not everyone needs to fully abandon cloud services or big tech products. Not everyone needs to self-host NextCloud. Not everyone needs to use GrapheneOS. Not everyone needs to use a Yubikey for 2FA or a local KeePass database for their passwords.
Using an iPhone is a better choice for many people than a phone with stock Android in terms of privacy. GrapheneOS is even better in many ways for that goal, but also has a steeper learning curve and worse software compatibility. Self-hosting is great, but it requires you to know what you’re doing, buy additional hardware (or rent a VPS), and be willing to manage everything (install updates, change security settings for your server, make your own backups, etc.).
Some people will use Tor Browser for most of their browsing. Others will use Firefox with uBlock Origin, Brave Browser, Vivaldi, or Safari with Wipr 2 or AdGuard. Some people will use Mullvad VPN, iVPN, or Proton VPN. Many people will be okay with iCloud Private Relay or decide that simply using encrypted DNS is enough for them.
These are all valid choices. We shouldn’t shame people because of them. We should match the tools and techniques with a specific person and their life instead of trying to forcefully shove said person into a perfect privacy box that we made for them.
People should use a password manager. That’s just a fact. It is recommended by countless security experts. That said, I can envision a situation where writing passwords on a piece of paper would be justifiable. I wouldn’t do it, and I recommend you don’t, but if an elderly person is not comfortable with using a password manager, or a homeless person doesn’t have their own device and can only use public computers, using a notebook to write down unique passwords may be a better solution than using the same, weak password for every account.
Ideally, everyone would delete their Facebook account. I wish that was the case, but many people can’t or are not willing to do so. Does that mean that we should just throw up our hands because we can’t do anything for them? I don’t think so. We can still encourage them to use a secure password, enable 2FA, add a passkey, change the visibility of their posts and various metadata about their account, use Facebook in the browser instead of the mobile app, and block Facebook trackers on other websites. All these measures aren’t as good as getting rid of Facebook entirely, but there are still a step forward.
We should all remember that privacy is a journey. Try to make small, incremental improvements to your setup and not stress too much about where it is lacking. Perfect privacy or perfect security doesn’t exist, but we can still try to achieve as much as is reasonable for us.
It’s also okay to scale back a bit when you realize that some choice that you made is becoming too burdensome. For example, I used to use too restrictive blocklists in my browser-level and DNS-level adblocker. I frequently had to add exceptions because the sites I wanted to access didn’t work. Now I try to use filters that still block a significant chunk of ads, trackers, and other junk, but also prioritize not breaking sites for the sake of achieving hardcore privacy.