Archive note — reviewed July 2026: This article preserves my perspective from January 2021, but security products and platform protections change quickly. I have removed the old vendor shortlists and linked to current guidance from the Australian Signals Directorate’s Australian Cyber Security Centre. Start with its current personal cyber-security guidance, not a five-year-old product recommendation.
You are the product.
Preface
Alright, well that’s quite a statement. What do I mean by that? We live in a world surrounded by ‘free’. Free shipping, free software, etc. However — all of these things boil down to the need to make a profit. The fallacy of ‘free’ has blinded us by and large to the fact that we are paying for it, just in ways we don’t immediately see.
Free shipping is easy — typically prices for products are jacked up to include the typical shipping costs, so it looks like you’re getting something for nothing. Classic sales trick. However, software can be a little tricker.
Services that we all use on a day to day basis, think Google, Facebook, etc. use and sell our information to advertising agencies in order to help businesses target us and maximise their returns. You’d be surprised the level of detail that these digital conglomerates know about you. Dare I say it, often these organisations know you better than you know yourself.
Doesn’t feel good, does it? Here are some practical changes you can make to stop being the product.
I believe the saying is “new year, new you” — but I like the current you; and so do the big tech companies. As great as ‘free’ software is these days, and we are plagued with it (Facebook, Google, Instagram, Twitter etc.), remember that these companies need to make money somehow; and trust me, they make bank.
When the conversation of privacy comes up, the fallacy of “If you have nothing to hide, then you have nothing to fear” likely ensues. I think this is typically because people either can’t see the larger issues, don’t know the dangers of, or can’t be bothered protecting themselves. However, I bet that they all still lock their doors at night. There are a lot of great resources already debunking the fallacy of the previous ‘argument’; I’ll include links at the end.
Side note: a good read about what a future that ignores the right to individuals privacy is George Orwell’s 1984. I know, you probably read it in high school, but read it again — you might appreciate it more.
But as we move into a new year — I propose we do something different. Instead of ‘new year, new me’, what if we say ‘new year, better me’? In order to take the first step, I propose that we take a digital cleanse; to make sure we’re safe, secure, and that we stop being ‘the product’.
Our digital cleanse 🤖
First off, let’s start with the basics…
Antivirus 🦠
Hey, we’re all guilty of it and we all have our own ‘reasons’ that we’ve used to justify to ourselves why we think that we don’t need to run that scan.
- “I don’t download illegal software”,
- “I don’t open phishing emails”,
- “I know which websites are reputable and which may be malicious”,
- “I own a Mac and they don’t get viruses”
You are wrong. You are underestimating the ingenuity of those trying to steal your information, your identity and track your digital (and sometimes physical) movements.
Updated guidance: use the protections supported by your current operating system, keep them enabled and updated, and only install security software from a legitimate source. Phones do not work exactly like desktop computers: modern iOS and Android devices include built-in protections, and third-party “scanner” advice varies by platform. The ACSC maintains current advice on antivirus software and protecting against malware.
Use privacy-first software 🥸
The next thing is to change which search engine you’re using, and your default browser.
Now I know this may ruffle some features, but Chrome sucks. Don’t get me wrong, user experience is second to none, and has some fantastic tools for developers. However, it tracks you — you become the product.
If you want to try an alternative, compare current privacy policies, tracking protections, update practices, and the settings available to you. A browser brand is not a permanent privacy guarantee, and those details can change after an article is published.
If you really want to take back your identity, change your default search engine. For this, I recommend two very different options.
- DuckDuckGo — this is the more privacy-first alternative. I’ve been using DDG for a while now, and haven’t really needed to switch back to Google. One of the main issues with alternatives that I’ve found is trying to find very technical solutions websites; this is where others struggled and Google thrives. This hasn’t been an issue for DDG, so give it a go!
- Ecosia — this one isn’t for everyone, but each time you search, a portion of the ad revenue generated actually goes towards planting trees! It’s still in it’s infancy phase, and has a lot of growing to do, but it is a great option for those that want to actively be more sustainable.
Update all of the thing ✨
You know that update window that keeps popping up, and you keep saying “Try my tomorrow”? Well today’s the day. You’re going to commit to updating all of your devices.
Pretty much every update you will get will include some form of component to it that is centered on creating a more secure environment for you to operate on.
Not that long ago, we saw the devastating impact on the WannaCry virus, and all of its spinoffs. The vulnerability was actually already addressed in a Microsoft Windows update — the only computers that were vulnerable to such an attack were those that didn’t have the update!
This wasn’t the first, and definitely will not be the last large scale ransomware attack we will see. As we become more and more digital citizens, we are more reliant on the tools and services that being so affords us. So please, backup your important documents; to the cloud, and if they’re sensitive and/or very important, to offline storage as well, and make sure that everything is up-to-date!
Ok, now we more into the more involved solutions.
These take a little bit more effort and time, but please believe me — they are becoming increasingly important; and I’ll tell you why.
Password Managers! 🗂
I will be straight with you — they are a bit of a pain to setup, but you will never need to remember a password EVER AGAIN.. well, maybe just one.
I like to think I’m quite savvy when it comes to the ‘run of the mill’ cyber attacks, but this year I found out the hard way that some of my passwords had been compromised due to one of the services I use being hacked and my credentials leaked.
This lead me to go on a frenzy of deleting unused accounts, rapidly changing passwords to be 20 characters long and all different. However, how the hell was I going to manage all of these password? Enter, the password manager.
I’ve tried a few over the last couple of years, but the one that I was with the longest, Dashlane, never really made me want to use it. It was cumbersome, obstructive and overall quite unintuitive to use. (However, from what I hear, they’ve done some good work addressing these issues now)
I decided to try a password manager on the referral from a friend, and it was one of the most useful cyber-security changes I made. I only needed to remember one strong master login, and it handled unique credentials for the rest.
And best of all, no two passwords are the same. So the next time a service that I use gets hacked and they leak peoples credentials, the only thing I need to worry about is updating one password!
Rather than preserving a vendor shortlist here, use the ACSC’s current guide to choosing and securing a reputable password manager. Prefer unique credentials or passkeys where supported, and protect important accounts and the password-manager vault with multi-factor authentication.
Use a VPN ☁️
The original version of this section treated a commercial VPN as a blanket answer. That was too simple. A VPN can be useful in some circumstances, but it shifts trust to the VPN provider and does not make unsafe behaviour or a compromised device secure. Keep devices and browsers updated, verify sensitive sites, use multi-factor authentication, and start with the ACSC’s maintained steps for securing yourself online.
“If you have nothing to hide, you have nothing to fear”
As promised, a list of readings if you are interested in this topic.
Sydney Criminal Laywers — The Fallacy of ‘You Have Nothing to Fear if You Have Nothing to Hide’