## Instructions - Roll out passkeys + 2FA everywhere: password manager first, then email, bank, cloud, social — no SMS if avoidable. - Migrate to Bitwarden/1Password: import browsers, dedupe, 20-char random, emergency kit printed offline. - Turn OS telemetry off: Windows Diagnostic Off + debloat, macOS analytics off, Android/iOS limit ad tracking. - Lock webcam/mic: OS per-app permissions deny-by-default, physical shutter/sliders, Teams/Zoom per-meeting check. - Encrypt everything: BitLocker/FileVault ON, phone PIN+biometric, USB with VeraCrypt, cloud with E2E (Proton/iCloud ADP). - Back up encrypted: 3-2-1 with restic/Borg + passphrase in manager, test decrypt yearly or it failed. - Harden browsers: uBlock, containers, third-party cookies blocked, history clear on close for shopping profile. - File GDPR/CCPA deletion: list brokers (Spokeo, Acxiom), opt-out, request exports, delete old accounts via JustDeleteMe. - Freeze credit + lock SIM: carrier PIN, port-out block, credit freeze all bureaus to kill SIM-swap + loans. - Audit app permissions quarterly: location Photos Contacts — set to While Using or Ask, remove unused apps. - Use aliases + masked mail: SimpleLogin/Relay for signups, separate finance mail never used for promos. - Plan breach response: unique passwords limit blast, have offline backup codes, know bank freeze number saved. ## Examples - Example 1: Family rollout: 1Password family, dad passkeys email+bank, printed kit in safe, SMS 2FA removed. - Example 2: Windows harden: telemetry Basic>Off, disable ad ID, Edge data off, mic per-app deny, BitLocker on. - Example 3: Broker cleanup: opt-out Spokeo/Whitepages, Google Results About You removal, DeleteMe quarterly. - Example 4: Phone lost: Find My wipe, revoke sessions, restore from encrypted iCloud + Bitwarden, 1h back. ## Workflows - Workflow A — 2FA rollout: 1. Inventory logins 2. Manager import 3. Email first 4. Banks 5. Social 6. Kill SMS. - Workflow B — OS harden: 1. Updates auto 2. Telemetry off 3. Permissions deny 4. Disk encrypt 5. Firewall on. - Workflow C — Backup encrypt: 1. Borg init --encryption 2. Daily script 3. Offsite copy 4. Decrypt test 5. Log. - Workflow D — Deletion request: 1. Export data 2. Delete account 3. Email GDPR request 4. Confirm 30d 5. Check broker. ## Templates - 2FA rollout checklist: ``` [ ] Password manager installed + emergency kit printed [ ] Email (Gmail/iCloud) passkey + TOTP, recovery codes saved [ ] Bank + brokerage hardware key or TOTP, SMS removed [ ] Apple/Google account Advanced Protection / ADP ON [ ] GitHub/npm/social TOTP, backup codes in manager [ ] Carrier PIN + port block, credit freeze confirmed [ ] Old SMS 2FA audit: zero remaining on critical accounts ``` - OS telemetry checklist: Windows Privacy Diagnostics Off, Tailored Off, macOS Share Analytics Off, iPhone Tracking Deny. - GDPR request email: Subject Erasure request Art.17 — Account {email}, request delete + processors, confirm 30 days, ID attached. - Encrypted backup log: Date Tool Borg Path USB+Cloud Decrypt-Test PASS Notes passphrase in Vaultwarden. ## Tools - Bitwarden / 1Password — passkeys, TOTP, Watchtower exposed-password alerts, family sharing. - YubiKey 5 — FIDO2 hardware key for email/bank/GitHub, backup key in safe. - SimpleLogin / Firefox Relay — alias per site, disable on spam without exposing real mail. - VeraCrypt / Cryptomator — container/file encryption for USB and cloud before upload. - Restic / Borg — deduplicated encrypted backups with prune policies that actually work. - JustDeleteMe / DeleteMe / Optery — find delete links and auto opt-out from 200+ brokers. ## Advanced - Go phishing-resistant: FIDO2/WebAuthn only for email/cloud, remove TOTP fallback where possible. - Segment identities: finance mail + number separate from social/shopping to limit breach correlation. - Self-host Vaultwarden for full control: backup sqlite nightly, fail2ban, Authelia SSO in front. - Verify E2E: check iCloud ADP green, Proton recovery phrase offline, no plaintext cloud notes. - Threat-model travel: burner alias, minimal devices, encrypted clone, remote wipe tested before flight. - Log quarterly audit in sheet: accounts, 2FA type, backup tested, brokers removed — track score over time. - Disable lock-screen previews for mail/messages so shoulder-surfers and stolen phones leak nothing. - Rotate backup codes yearly and shred old emergency kits to keep offline secrets fresh. ## Documentation - CISA MFA guide — why SMS fails, FIDO2 rollout order for high-value accounts. - EFF Surveillance Self-Defense — device encryption, permissions, protest/travel checklists. - Apple/Google privacy docs — ADP, Advanced Protection enrollment steps official. - GDPR Art.17 / CCPA templates — erasure verbiage that gets compliance reply. - Bitwarden / 1Password migration — import, emergency access, family kit printing.