Digital hygiene
Short summary
Andrej Karpathy walks through the security and privacy tools he personally uses, starting with password managers and hardware keys and moving through email, browsers, search, VPNs, and ad blocking. The core argument is that data brokers and breaches make everyday online habits a real attack surface, so small changes to how you log in, pay, and receive mail pay off a lot.
- Use a password manager with unique passwords everywhere, and protect it with hardware security keys (he recommends YubiKey, buying 2-3 and storing them separately) rather than SMS codes, since SIM swap attacks make phone-number 2FA weak.
- Mint a new virtual credit card per merchant (he uses privacy.com) and use a virtual mail service for your address, so a single leak doesn't link your purchases or expose where you live.
- Avoid smart home devices, which collect data and get hacked often, and switch to Signal, Brave, and Brave Search, paying for a subscription to keep the company's incentives aligned with the user.
Full summary
The post opens with a warning about the data economy: big tech firms build profiles to sell ads, data brokers enrich and resell them, and breaches feed the dark web, which in turn fuels phishing, ransomware, card fraud, and identity theft. From there it becomes a practical checklist, ordered from basics to niche. The core advice is to use a password manager (the author uses 1Password) so every account gets a unique, hard-to-crack password and one leak doesn't unlock everything. That manager then becomes the thing you most need to protect.
That protection comes from a second factor, and here the author is blunt about SMS codes. SIM swap attacks, where someone convinces a phone carrier to port your number to their device, make text-message 2FA weak, and the author says several of his friends have been victims. His recommendation is hardware security keys, specifically YubiKeys, which store private keys in a secure element that never touches your laptop. He suggests buying two or three and keeping them in separate locations so losing one doesn't lock you out. Where a service only offers TOTP codes, the YubiKey can hold those too, accessed through its authenticator app by tapping the key to your phone over NFC. Biometrics (Face ID on iOS) come next as a third factor, and he argues security questions are a scam: their answers are often findable online, so you should answer them with random strings stored in your password manager. Full-disk encryption (FileVault on Mac) is a basic must, so a stolen laptop yields nothing.
The rest of the list covers habits and tools that reduce what companies collect about you. He advises avoiding "smart" devices, citing always-on microphones, cloud data collection, and a CO2 monitor from China that demanded his exact location before it would display a reading. For messaging he prefers Signal, which encrypts content and stores less metadata than iMessage or WhatsApp, and he recommends turning on 90-day disappearing messages. For browsing he recommends Brave, a Chromium-based browser that keeps Chrome extensions working, and Brave Search, a privacy-focused engine with its own index, which he says he pays $3 a month for. Finally, he suggests a unique virtual credit card per merchant (via privacy.com, with spending limits) so card numbers can't be linked across services or leaked in bulk, and using a virtual address for merchants that don't need your real one.