There's enough questionable information in this that it's not worth engaging point by point, but here are a few things worth noting: > changing your passwords

There's enough questionable information in this that it's not worth engaging point by point, but here are a few things worth noting: > changing your passwords regularly can have some potential benefits (mostly for companies) No. This goes back to the way-too-broad Appendix A ("Estimating Password Entropy and Strength") of NIST SP 800-63 in 2004. Which explicitly says "Readers are cautioned against interpreting the following rules as anything more than a very rough rule of thumb method to be used for the purposes of E-authentication", but, you know, it's NIST and became a whole thing anyway. NIST finally came out explicitly against rotation in 2017. The specific guidance since then: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator." > Macs, for example, are notoriously secure That's like saying Windows Phone is notoriously secure. I mean, maybe? But mostly nobody cares enough to attack them. Macs aren't directly targeted much because a) the business world doesn't run on them, and b) most attacks are credential phishing, i.e. platform-agnostic, for the handful of mac-using targets you might care about. There are still plenty of attacks on macs, pentesting tools for them, LOOBins, so on. Just most users aren't on macs, workloads aren't on macs, infrastructure (Exchange servers, domain controllers) isn't on macs. Probably it would be worthwhile to attack them more, honestly. Maybe the bad guys just haven't seen Moneyball yet. > the vast majority of compromises [...] convince the targeted user to hand over their own credentials or download malicious software or otherwise convince the target to somehow give the attacker access Well, yeah. Chrome replaced Internet Explorer, PDF.js replaced Acrobat Reader, the Microsoft Office Equation Editor replaced itself, Flash is gone. The exploitable computing surface today is way smaller than it was 10 years ago. At the same time, everyone's identities and accounts have moved to the cloud, so the juice-to-squeeze ratio of targeting a device is way down. Still happens every day, but rarely with exploits. I'm not sure "you chose to run the malware, idiot" supports the claim that "you don't need antivirus", though. Like, people do dumb things sometimes. That's exactly why they might need antivirus. The built-in stuff is as good as anything else for consumers, so sure, stick with Defender or whatever. That's still antivirus. The ~98th percentile of people by tech-savviness should probably turn it on.