Security is not equal to privacy. Even if you do use 2FA and change your passwords all the time. You don’t gain any additional privacy.

Changing your google password and adding 2FA to your google account does nothing to make your life more private because google still can read all your emails, and sell your data regardless of 2FA.

The best habits to maintain privacy are to avoid using the services of companies that’s business model is violating your privacy.

Some pro privacy habits might be:

• Avoid any google products or services.
• Avoid and Meta products or services.
• Don’t use any free software or services that are not community run / non profit. They make money from selling your data.

In a positive light these habits might be reflected as:

• Using a google free phone. (i.e. GraphineOS or CalyxOS or /e/OS or even an iPhone as a last resort.)
• Use Lemmy, mastodon and other alternatives to big social media corps.
• Pay for reputable e-mail hosting with a reputable provider, (Ie Microsoft365 Business Account, Tutanota, or Proton Mail) or host your own.

Privacy isn’t all or nothing. Small steps are still improvements. Microsoft respects their business client’s privacy because that is what is demanded and Microsoft makes money by providing B2B services. Apple is in the business of selling expensive hardware and iCloud services so they don’t need to violate your privacy as much. These products while not perfect are leaps and bounds better then using any google or meta product.

Small steps are good steps.

If I had to choose one thing to do I would say to drop any phone that has the play store pre installed.

I pepper my randomly generated passwords. For example, imagine you have a random string generated from your password manager. If the password manager's database is breached or your master password is leaked somehow, the attackers have access to all of your information.

Now think of a word or acronym or something.. Something simple (can be simpler than a normal password). When you add a login, save the generated string to the manager but use a combination of the string + unique word for the website login.

Let's assume CHEESE is my pepper word.

The generated string: hjifd;39Vq$7}

Saved to password manager: hjifd;39Vq$7}

Submitted to website: CHEESEhjifd;39Vq$7}

Now even if the database is leaked my passwords are still mostly useless.

I don’t understand how changing your password or using 2FA enhances your privacy? I use a different fake name on each website I register, also use a different mail alias for every website I sign up to.

Use Linux, a VPN, Firefox with containers and multiple privacy add-ons. I use Veracrypt volumes to store "private" information in the cloud.

Yubikey, always on vpn, use mullvad browser when not logged into anything.

Mull on the phone, always on vpn.

For logging into services use different chrome profiles, one set of cookies per profile in chrome.

Keep the phone in airplane mode, with wifi on, as much as possible use randomized mac address. Uninstall apps not in use.

Pay for as much as you can using cash or monero http://kycnot.me

I use a password manager and a different password for each website/service/tool.

I give a fake phone number to companies who ask for one. I also often sign up with temporary emails when possible.

Different password and email for each site (I pay for Firefox Relay, only has one instance of a site that blocked it so far). Edit to add: Firefox Relay can also provide a phone number (for a cost) that you can use on sites instead of your own. There are caveats to keep in mind for when to use it, but it helps.

Proton Mail instead of Gmail.

Proton Drive instead of Google Drive / OneDrive. More expensive, so keep this in mind.

Proton VPN when concerned about the security of my internet connection.

Hosted VPS in a cloud provider for photo storage using an open source photo focused content management system.

Pihole hosted in a VPS to help block various trackers (and ads too, but that's convenience, not privacy protection).

Wireguard to connect to VPS hosted services. Option to turn on full tunnel, but generally obsolete with Proton VPN as an option.

Proton is on here a bit mainly because they offer a decent suite of services. There are others that are available.

The thing is, none of this is free and protecting your privacy rarely will be. There are FOSS solutions to help, but you generally need to pay for hosting and access (even if it's buying a raspberry pi). Proton is more accessible to many than something like setting up services on a VPS behind Wireguard.

If you wanna go full paranoid, you can use tiered personal VMs for web browsing. High security ones for things like banking and what not can be destroyed and spun up on demand. And others where it's less important can be refreshed at longer intervals depending on your convenience requirements. Still need to ensure your host/base images are protected, but it will minimize exposure on the guest vm to malware. Less likely to have a keylogger get your bank login info if it's a brand new VM each time.

I don't divulge my security practices publicly, online. That would be incredibly dumb.