Security & Privacy

Threat models, encryption, and zero-trust architecture

63 articles · 18 tutorials · 2 courses · Updated

Overview

Security is not a product you buy; it is an architecture you maintain. This handbook approaches security from first principles — starting with threat modeling, moving through practical hardening techniques, and into advanced network architecture and incident response.

Privacy and security are related but distinct concerns. Both are covered thoroughly here. The goal is practical, verifiable improvement — not security theater.

Learning Roadmap

Beginner

Build a solid personal security baseline. Protect your accounts, devices, and communications without paranoia.

  1. Threat Modeling Basics

    Security is contextual. Define who your adversaries are and what they want before implementing any controls. A journalist has different needs than a developer.

    ~1 week

  2. Account Security Fundamentals

    Unique strong passwords with a password manager, hardware or TOTP 2FA on everything, and an understanding of phishing mechanics.

    ~1 week

  3. Passkeys & Modern Authentication

    WebAuthn/FIDO2 credentials have reached critical mass. Understand the cryptography and migrate your accounts where possible.

    ~1 week

  4. Device Hardening

    macOS and Windows both have security controls that ship disabled. Full disk encryption, firewall configuration, and update hygiene.

    ~1 week

Intermediate

Move beyond personal security to infrastructure: network architecture, VPNs, and practical cryptography.

  1. Zero-Trust Networking

    Implement "never trust, always verify" on your own infrastructure using Tailscale or a custom WireGuard mesh. Eliminate open ports and VPN concentrators.

    ~2 weeks

  2. Practical Cryptography

    Symmetric vs. asymmetric encryption, key management, TLS internals, and GPG for signing. Understand what you are actually trusting when you see the padlock.

    ~2 weeks

  3. Network Security & Firewalls

    Configure pfSense or OPNsense for deep packet inspection, DNS filtering, and network segmentation using VLANs.

    ~2 weeks

  4. Privacy-First Workflow

    Email, messaging, browsing, and DNS — each can be hardened without sacrificing usability. A practical guide to degoogling without friction.

    ~2 weeks

Advanced

Offensive knowledge for a defensive mindset, incident response, and building secure systems at scale.

  1. Penetration Testing Fundamentals

    Understand how attackers think. Network reconnaissance, vulnerability scanning, and exploitation basics using your own homelab as the target.

    ~3 weeks

  2. Incident Response

    Detect, contain, and recover. Build detection rules, understand forensics basics, and know what to do in the first 24 hours after a breach.

    ~3 weeks

  3. Security Architecture at Scale

    Design systems that are secure by default: secrets management, IAM design, audit logging, and supply chain integrity.

    ~4 weeks

Featured Guides

Frequently Asked Questions

Is a VPN actually necessary?

It depends on your threat model. A VPN hides your traffic from your ISP and from anyone on the same network (useful on public Wi-Fi). It does not make you anonymous — your VPN provider sees your traffic instead. For most people, DNS-over-HTTPS and a reputable VPN on untrusted networks is a reasonable baseline. Tailscale is the better solution for accessing your own services remotely.

What is the best password manager?

Bitwarden is the strongest recommendation for most people — it is open-source, audited, cross-platform, and free for personal use. 1Password is excellent for teams and has superior emergency access features. KeePassXC is the right choice if you want fully local storage with no cloud component. Avoid browser-built-in password managers for serious use.

How do passkeys work technically?

A passkey is a FIDO2/WebAuthn credential consisting of a public/private key pair. The private key never leaves your device. When authenticating, the site sends a cryptographic challenge your device signs with the private key. Possession of the private key (protected by biometrics or device PIN) proves your identity. There is nothing to phish, intercept, or steal from a server breach.

Is Zero Trust only for enterprises?

No. Tailscale makes a zero-trust mesh network trivially deployable at home. Define access control rules so only your laptop can reach your NAS, only your phone can reach your home automation hub, and nothing is exposed to the internet. The conceptual model scales from your home to a Fortune 500.

What is the real risk of reused passwords?

Credential stuffing. Attackers purchase leaked database dumps (tens of billions of credentials exist in breach databases) and automatically test them against every major service. If you reuse a password from any service that has ever been breached, every account using that password is compromised. This is the single most common account takeover vector.