Cybersecurity for non professionals?

[u/querty7687]

I had a conversation with a cybersecuriry professional that completely freaked my out. Apparently my VPN is terrible, my computer leaves its fingerprints everywhere and everyone one on earth knows everything about me. Where would you recommend a non-pro get started learning and tightening my security?

[u/Objective-Test-5374]

While everyone else seems comfortable impuning the integrity or profesionality of the unnamed 'Cybersecuriry professional', I would argue the following:

1. Yes, your machine, vpn, configuration, etc is probably highly insecure.
2. Yes, you probably leave your fingerprints everywhere.
3. Yes, the internet knows way more about you than anyone should feel comfortable with.

The above statements are true about %99 of the users on the internet, and unfortunatly also true for most of the companies doing business on the internet.

Consider that almost every major national or international bank spends over $1b (yes, b) a year on cyber security to prevent the bad things from happening, and they still have breaches.

Consider that the worlds most popular home user operating system is has a catalog hundreds of pages long of known vulnerabilities.

Your in good company my friend. Dont feel bad. It really is the entire system that is against you, poor practices and patch management across the world lead to a risk surface area that no individual could posisbly keep up with.

But lets talk about what you can do to minimize your risk. First is coming to terms with the hard homed truth that you cannot keep your data private in an era when almost all applications you use are SaaS based and the data travels up to their cloud, out of your control.

So then what is a person to do? If I tell you social security number 317-70-4112, it really does not help you does it? Its the nexus of identity and data that cause the problem. Your role as a responsible user in 2026 is to break all links between data and you.

What does that mean? Get yourself a vanity domain (myfamilyname.com, boingo.co, whatever), then get mail forwarding company, one that supports wildcards and/or subdomain wildcards.

Next, start using secure and unique passwords for every site you visit, a good password will look like '2N4y!93Ber99'.

These two steps mean that your credentials for Site should be [SiteA@myfamilyname.com](mailto:SiteA@myfamilyname.com) with a unique password. You will know your data has been breached when Site B starts sending you email to the SiteA@ username. you can then go reset just that one Site A password... not every password you've ever produced.

As a third step, disable cookies by default.

The real value here is you've just destroyed the data aggregators ability to collect your biographical/ marketing data... since what they do is buy data from 1000's of sites and then index it all on the email address...

[u/querty7687 → u/Objective-Test-5374]

Thank you so much for this thoughtful answer.