Nowhere to Go When The Sky is the Limit

As I've written about before, privacy is a complex and ever-evolving topic. It's easy to get caught up in the idea that there's always more we can do to protect ourselves online. But what happens when one day you crest the last hill and realize there's nowhere to go? When you feel like you've maxed out your privacy? Have you done everything you can think of to secure your digital life? This week, I want to talk about the idea of doing “enough” in privacy, and when to know if you've crossed that finish line.

The Top of the Mountain

So, you feel like you've maxed out your privacy? Congratulations! That's a huge accomplishment in today's digital landscape! But let's be real – it can also be a little overwhelming when you've still got that momentum built up and you're unsure if there's more room to grow or where. When you focus on a singular goal for so long and put so much effort into it, it can leave you feeling a little hollow once you get there. This is why a lot of successful, high-achieving people don't do well after retirement. They either get back to work somewhere else or take up a hobby or something.

You probably already know the signs if you're feeling this way. You probably conscious know. “Am I missing anything?” “Let me check out this new tool someone suggested.” “Let me read Privacy Guides for the 500th time this week.” So what do you do when you feel that way?

Threat Modeling

I have harped on threat modeling ad nauseum, to the point that it's become a meme among some of my readers. I wear this as a badge of honor because threat models serve so, so many useful purposes in the privacy community.

The main and most critical purpose of a threat model is allowing us to know what needs to be done, but on the flipside it also lets us know when we've done enough. When we take the time to establish a clear threat model, we can say “I need a password manager that does XYZ” and “I need to make sure I don't share ABC information online.” But when you look at threat models in a sort of inverted way, they can tell us that once we've done that, we're good. Once we've got our password manager, our operating system, and our safe habits formed, it's okay to check that box off and go “I'm solid.” So if you're finding yourself going “can I do more?” the first step is to ask yourself “have you sufficiently covered your threat model?” If you find cracks, then you need to work on those first. If not, then what?

The Finish Line

So suppose you've checked and you're doing everything in accordance with your threat model. You're meeting the bare minimum in all your areas. Now what? Well, you could try to go a little further. Just cause you're passing the class doesn't mean you can aim for an A. In fact, I encourage people to go above and beyond and do as much as they reasonably can. But of course, the key word there was “reasonably.” The truth is that there's always more to do. There's an old joke I saw online a long time ago about making music. From rough memory, it went a little something like this:

I used to use premade beats, but I felt like that was cheating so I started making my own. Then I started to feel like using premade samples was cheating so I started making my own. Then I started to feel like using premade drums was cheating, so I learned how to make my own drums. Then I feel like using premade drumheads was cheating, so I learned how to make my own out of goat skins. Then I felt like buying goat skins was cheating. I haven't made a lot of music lately but my goat farm is doing well.

While I do encourage people to go above and beyond, there's always a point of diminishing returns in basically any field. I've discussed this at length in previous blog posts, too. For most people, the point of “too far” presents in ways like:

If you feel like you're at a point where you can't take the next step to improve your privacy without giving up valuable relationships or opportunities but you've checked and you're covering all the minimum requirements of your threat model, that may be your sign that you've crossed the finish line. This may be a controversial take in the privacy community, but I believe sometimes it's okay to just sit back and go “okay, I'm done.” As I said earlier, threat models exist to tell us when it's okay to stop just as much as they exist to tell us when we can keep going, and so long as you're meeting those basic requirements, I think we need to allow room for people to say “I think I'm good here” and stop.

Next Steps

However, all that said, there is one critical caveat to all of this: things change. New services pop up, old services disappear, and now your tools and techniques are no longer serving your threat model. So if you've read this far and gone “you know what? You're right Nate. I've got my threat model covered and I think I'm ready to say I crossed the finish line,” that's great! I'm happy for you! But I would discourage you from simply washing your hands completely and walking away. The finish line will move someday, and it's important you know when that happens. For this reason, I encourage you to find ways to stay updated on privacy. This could take many forms. You could be hands-on in various chat rooms and forums, sharing what you know with others or soaking up the discussions. Alternately, this could be very hands-off and passive, following current events podcasts like Surveillance Report or Firewalls Don't Stop Dragons or YouTube channels like Techlore, Privacy Guides (or of course, my own). There's also numerous blogs (like this one) or news outlets you could follow if you're more of a reader. Regardless of what form it takes, it's important to find a way to stay in the loop. Figure out what works best for you and make sure you're keeping an ear to the ground so you don't get caught off guard.

Conclusion

Feeling like you've maxed out your privacy is a normal part of the journey. By recognizing that it's okay to have a finish line while also staying updated on the latest developments in cybersecurity, you can maintain a healthy balance between security and sanity. Remember that threat models cut both ways, and with a well-defined one you'll be better equipped to navigate the ever-evolving landscape of online privacy.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...