We keep telling home users “just use common sense, update your stuff, and you’ll be fine.” But the last year has made that feel a little too simple.
On one hand, browsers are tightening extension rules (Manifest V3 in Chromium) in the name of security and performance. On the other hand, we’re still seeing large-scale campaigns living inside home routers, especially older end-of-life models, plus the usual wave of phishing and account takeovers. (arXiv)
So I’m curious what people here think is the “real” weakest link for typical home users right now, and what advice actually moves the needle.
Recent reporting and research summaries point to campaigns compromising ASUS home routers at scale, with a big emphasis on end-of-life devices and stealthy persistence. Even if you do not run an ASUS router, the pattern is familiar: consumer edge devices get ignored, they do not get patched, and they end up becoming someone else’s infrastructure. (Privacy Guides)
2) Browsers and extension power is being reduced
Manifest V3 is often framed as “security hygiene” because extensions can be a major malware path. But it also changes how effective privacy and content blocking can be, and for many users content blocking is part of staying safe (malvertising, scam popups, fake update prompts). There’s also research looking at how MV3 impacts blocking ability. (arXiv)
3) Account takeovers and “human layer” attacks are still escalating
Beyond pure malware, organized cybercrime ecosystems keep blending online intrusion with extortion and real-world harassment. That pressure tends to hit regular people first because they are easier targets. (The Guardian)
Points people bring up:
Points people bring up:
Points people bring up:
On one hand, browsers are tightening extension rules (Manifest V3 in Chromium) in the name of security and performance. On the other hand, we’re still seeing large-scale campaigns living inside home routers, especially older end-of-life models, plus the usual wave of phishing and account takeovers. (arXiv)
So I’m curious what people here think is the “real” weakest link for typical home users right now, and what advice actually moves the needle.
Current context (why I’m posting this now)
1) Routers as a long-lived footholdRecent reporting and research summaries point to campaigns compromising ASUS home routers at scale, with a big emphasis on end-of-life devices and stealthy persistence. Even if you do not run an ASUS router, the pattern is familiar: consumer edge devices get ignored, they do not get patched, and they end up becoming someone else’s infrastructure. (Privacy Guides)
2) Browsers and extension power is being reduced
Manifest V3 is often framed as “security hygiene” because extensions can be a major malware path. But it also changes how effective privacy and content blocking can be, and for many users content blocking is part of staying safe (malvertising, scam popups, fake update prompts). There’s also research looking at how MV3 impacts blocking ability. (arXiv)
3) Account takeovers and “human layer” attacks are still escalating
Beyond pure malware, organized cybercrime ecosystems keep blending online intrusion with extortion and real-world harassment. That pressure tends to hit regular people first because they are easier targets. (The Guardian)
The debate: three “camps” with real arguments
Side A: “The browser is the new perimeter”
Argument: Most home user compromises start in the browser: phishing, drive-by scams, shady extensions, fake downloads, sponsored search traps. Tightening extension capabilities is a net win.Points people bring up:
- Extensions are a supply-chain risk: even good tools can be sold, updated, or cloned.
- Reducing what extensions can do can reduce damage when something goes bad.
- Built-in protections (Safe Browsing style features, sandboxing) matter more than “a pile of add-ons.”
Side B: “No, the router and IoT are the real soft underbelly”
Argument: A compromised router can outlive OS reinstalls, new browsers, even new devices on the LAN. Home routers are “set-and-forget,” and attackers know it.Points people bring up:
- End-of-life routers are everywhere, and many owners never replace them.
- Router compromises can enable DNS hijacking, transparent proxies, credential theft, and botnet activity.
- Big botnets built from hacked routers and IoT keep showing up in DDoS and other campaigns. (Privacy Guides)
Side C: “The real crisis is account takeover, not malware”
Argument: Password reuse, phishing, MFA fatigue, SIM swaps, and social engineering are still the highest-frequency way normal people lose money and access.Points people bring up:
- Even perfect endpoint security cannot stop someone who gives away session tokens or approves a push.
- Passkeys and phishing-resistant MFA help, but adoption is uneven and recovery flows can be messy.
- Victims often lose email first, then everything else falls like dominoes.
My “boring” take (to poke holes in)
If I had to rank advice for a typical home user who will only do a few things:- Fix the router lifecycle (replace EoL, update firmware, disable remote admin, strong admin password, turn off UPnP if you do not need it).
- Browser minimalism (fewer extensions, only reputable ones, review permissions).
- Account hardening (unique passwords, authenticator-based MFA, passkeys where possible, lock down email first).
Questions to drive the debate
- If MV3 makes “best-in-class” blocking harder, do you consider that a net security improvement or a net security loss for home users? (arXiv)
- Would you rather have a browser that restricts extension power, even if it reduces user control, or do you prefer maximum capability with the risk that extensions can be abused?
- If you could only convince a non-technical relative to do ONE thing this weekend, would it be: router replacement, browser change, or account hardening?
