← Back to Library

How to protect your online privacy with a threat model

Most privacy guides chase the latest app, but The Hated One argues that chasing tools is a losing game because the landscape shifts too fast. The piece's most striking claim is that consistency comes not from software, but from a rigorous mental framework called a threat model. In an era where even trusted search engines can suddenly compromise user data, this shift from product dependency to methodological independence is the only path to lasting security.

The Failure of Tool-Centric Privacy

The Hated One opens by dismantling the industry's reliance on specific products, noting that "the inventory of recommended countermeasures changes all the time." They point to the recent exposure of a popular privacy browser as proof that "on the long enough timeline you can't trust any single product." This is a sobering reality check for users who believe buying a specific subscription solves their problems. The author argues that this approach creates a false sense of security, whereas a consistent method allows users to "proactively mitigate privacy threats as they arise."

How to protect your online privacy with a threat model

The core of the argument is that users must stop asking "which tool is best?" and start asking "what am I protecting, and from whom?" This reframing is powerful because it places the agency back in the hands of the user rather than the vendor. Critics might note that this approach requires a higher cognitive load than simply installing a recommended app, potentially alienating less technical users. However, The Hated One insists that without this foundation, users are "using privacy tools improperly" regardless of their quality.

The secret is to start with a threat model.

Mapping the Invisible Data Flow

To build this model, the author introduces the "Linden" privacy threat model, a mnemonic for seven specific categories of privacy violation. The first step is identifying assets, which The Hated One breaks down into "transactional data" (the content) and "contextual data" (the metadata). The distinction is vital because, as the author warns, "we kill people based on metadata." This stark phrasing underscores the lethal potential of seemingly innocuous data points like IP addresses and timestamps.

The Hated One guides the reader to create a data inventory, mapping exactly where information travels. They argue that users must understand if their data is "collected how it is stored and whether it is shared with third parties." This granular tracking is essential because metadata is often "rarely protected" yet uniquely traceable. By forcing users to document every credential, data collection point, and third-party share, the method exposes the hidden architecture of modern surveillance.

Identifying the Adversary

A crucial pivot in the piece is redefining the enemy. The Hated One writes, "because privacy is a different goal than security our adversaries aren't just going to be external attackers." They categorize threats into three sources: external attackers, organizational sources (including malicious employees), and receiving parties. This broadens the scope of protection beyond hacking to include the very companies users trust with their data.

The author suggests that "fully authorized entities with legitimate access to our data are a privacy threat." This challenges the common assumption that if a company isn't hacked, the user is safe. The Hated One argues that understanding who holds the data is necessary for "eliminating our data footprint." This is a strategic shift from defense to reduction, suggesting that the best way to stop data theft is to ensure there is less data to steal.

The Seven Threats and the Trade-Offs

The piece then details the seven Linden threats: linkability, identifiability, non-repudiation, detectability, disclosure of information, unawareness, and non-compliance. The Hated One highlights the tension between security and privacy, particularly regarding non-repudiation. They explain that while non-repudiation is useful for e-commerce receipts, it is a "severe privacy threat" for whistleblowers or those needing plausible deniability.

Regarding unawareness, the author states it is "in my opinion the most common problem of modern day privacy issues." They argue that users "tend to submit way too much information to service providers without a second thought." This places significant blame on the user's lack of education but also on service providers who fail to offer "user friendly privacy controls." The Hated One suggests that much of this violation could be avoided by "merely giving less data about yourself."

A large portion of the blame lies on the backs of service providers.

Finally, the author addresses non-compliance, urging readers to look beyond legislation to "upholding the best data protection principles." They ask users to benchmark systems by asking if data is collected "without your consent" or if the service is "storing more personal data than required." This moves the conversation from legal compliance to ethical data stewardship.

Bottom Line

The Hated One's strongest contribution is the insistence that privacy is a process, not a product, offering a durable methodology that survives the rise and fall of specific software. Its biggest vulnerability is the high barrier to entry, requiring users to perform complex data mapping and threat analysis that many will find daunting. Readers should watch for how this framework adapts as AI-driven profiling makes behavioral identification even more pervasive.

Sources

How to protect your online privacy with a threat model

by The Hated One · The Hated One · Watch video

privacy tools are inconsistent the inventory of recommended countermeasures changes all the time dug.go was recently exposed for allowing microsoft records in their mobile browser their search engine is still used and recommended for privacy but the browser can no longer be trusted this happens all the time an emerging privacy tool is recommended for a long while only to be advised against overnight companies drop support they change ownership or security research invalidates their merits on the long enough timeline you can't trust any single product so what if instead of focusing on the tools you'd learn a consistent method that would help you proactively mitigate privacy threats as they arise you'd be able to actually evaluate your own exposure and adapt your privacy strategy to your needs at your own pace as the threats emerge you wouldn't be using privacy tools improperly and you wouldn't get a false sense of security because every decision would have a reason this is exactly what this guide aims to give you it will introduce you to a tested methodology with which you'll be able to achieve a strong privacy the secret is to start with a threat model privacy engineers have been researching the right methodology that will encapsulate all privacy goals in one comprehensive model they found one by comprising a list of seven threat categories that lead to privacy violation in modern systems these categories are linkability identifiability non-repudiation detectability disclosure of information and awareness and non-compliance this methodology is called the linden privacy threat model linden is a mnemonic for the seven thread categories for our threat modeling exercise we will use lint and go cards to help us elicit and mitigate all the threats we could face in our time linden will give us the consistent method of finding the right tools to protect our privacy now and in the future let's begin the first step of our threat modeling journey will be to identify our assets that is what we are trying to protect this is all the personal information created by us or generated by our usage of apps and services information can be broadly split into two categories transactional data and contextual data you want a document collection of both of the data categories transactional data refers to the content of the communication while contextual data mostly refers to the metadata they're both equally ...