Computer "10" List

This is the baseline. Not the advanced course, not the paranoid tier, just the ten habits that separate a computer an attacker can walk into from one they mostly cannot. Do these and you have closed the doors that ordinary breaches actually use: reused passwords, text-message codes, unpatched software, and an operating system quietly narrating your day to advertisers. Every item here protects you first, at home, on your own machine. The fact that it also protects your employer is a bonus, and it is exactly why this list is worth building a habit around rather than a policy.

THE CORE IDEAThese are not corporate security chores. They are personal defenses that happen to double as corporate ones, because the same habits guard your bank account and the company login with the same muscle. Learn them for yourself and they run everywhere you do, which is the only way security ever actually sticks.

The list

1. Use a password manager, and keep a printed recovery card for the master key somewhere safe. Reusing one password across sites is the single most common way regular people get compromised, because one breach anywhere becomes the key to everything. A manager makes every login unique without asking you to remember any of them.
2. Turn on two-factor authentication everywhere, and get it off SMS. A text-message code can be stolen by hijacking your phone number, so use an authenticator app or, better, a hardware key. This is the difference between a stolen password being an inconvenience and being a disaster.
3. Use a privacy-respecting browser and blunt fingerprinting. As of February 2025 Google permits advertisers to fingerprint your device, and a fingerprint survives clearing cookies because there is nothing to clear. A hardened browser and its anti-fingerprinting settings are now more important than they were, not less. See how tracking actually works in 2026.
4. Understand what a VPN does and does not do. "Use a VPN all the time" is dated advice. Nearly every site you visit is already encrypted with HTTPS, so the old coffee-shop-Wi-Fi fear is largely obsolete, and a VPN mostly moves your trust from your internet provider to the VPN company while hiding your IP from the sites you visit. Use one deliberately, for reasons you can name, not as a magic shield. For everyday coverage, put encrypted DNS on the whole device instead, which filters trackers for every app rather than just the browser.
5. Turn on full-disk encryption and confirm it is actually on. BitLocker on Windows and FileVault on the Mac are the only things standing between a lost or stolen laptop and everything on it. Newer Windows 11 often enables device encryption by default, but do not assume it, open the setting and verify.
6. Block remote images in email. A message that loads external pictures is quietly reporting back the moment you open it, from where, and on what device. Turning off remote content removes a tracking pixel most people never knew was there.
   • Gmail (web): Settings gear → See all settings → General tab → Images → select "Ask before displaying external images" → Save Changes.
   • Outlook (new Outlook and web): Settings → Mail → Reading → Files → Download External Images → "Ask Before Downloading."
   • Outlook (classic desktop): File → Options → Trust Center → Trust Center Settings → Automatic Download → check "Don't download pictures automatically in HTML e-mail messages or RSS items."
   • Apple Mail (macOS): Mail → Settings → Privacy → uncheck "Protect Mail Activity," then check "Block All Remote Content."
7. Compartmentalize with separate browsers or profiles. Keep work, personal, and sensitive logins in different browsers or profiles so they are not stitched into one continuous record of you. It is the cheapest version of running separate identities, and it costs nothing but a habit.
8. Keep the operating system and apps updated, automatically. Unpatched software is the other main way in, alongside stolen passwords. Turn on automatic updates so the fix arrives before the exploit does, and restart when asked rather than clicking "later" for a month.
9. Kill personalized ads and turn off the advertising ID. Every major operating system assigns you an ad identifier and profiles you by default. Switch it off at the source.
   • Windows 11: Settings → Privacy & security → General → turn off "Let apps show me personalized ads by using my advertising ID," along with the other toggles on that screen.
   • macOS: System Settings → Privacy & Security → Apple Advertising → turn off "Personalized Ads."
   • The Apple and Android lists cover resetting the ad ID on the phone side, where it matters most for the bidstream.
10. Check your privacy dashboards and prune them. Each company keeps a dashboard showing what it has collected about you. Visit yours, see what is there, delete what you can, and switch off the collection you do not want. It is the one place you get to look back at the machine and take something away from it.
    • Apple: privacy.apple.com → get a copy of, correct, or delete your data.
    • Google: myactivity.google.com for your activity, and the Privacy Checkup at myaccount.google.com/privacycheckup to switch collection off.
    • Microsoft: account.microsoft.com/privacy → review and clear your browsing, search, location, and activity history.

Verified and limited

The menu locations and platform behaviors above were checked against current Windows and macOS in September 2026, and vendors move settings without warning, so if a path is off, search the settings screen for the item by name. Two honest limits. This is a floor, not a ceiling: it stops the common, opportunistic compromise, not a targeted adversary who has singled you out, and higher-risk situations need the deeper guides. And a checklist changes nothing until it becomes behavior, so if you do not know which of these to do first, the SparkForge Threat Model Planner will sort them into a personal order, and the SparkForge how-to guides carry the step-by-step for each one.

THE ONE-LINE LESSONNone of these ten are advanced, and that is the point. The compromises that actually happen walk through the doors this list closes, so being able to do all ten without looking them up is most of personal security, handled.