Ask HN: How would you secure your laptop against the NSA?

It's maybe the wrong question, or part of a bigger question of how do you secure information you want to keep from a state-level actor. Your laptop may be part of that but also your mobile device, home phone, cloud services, and other people who also have access to the said data. Also how determined they are to get the data is another factor, and can they achieve what they need to another way without 'your' data.

First they need an RCE, probably for your browser, maybe your TLS library. For a state actor, this is not a problem. Let's assume it's your browser. They need you to visit a page with their malicious payload. They can use phishing, they can take over a site you visit. Or they can take control of some machine in the path between you and sites you visit. From there they can MitM a TCP connection to inject the payload. (They might not even need to be in the path, but most exploits to MitM a TCP connection not in your path only work for long running connections). Now all you have to do is make an un-encrypted connection to any site, and they've got you.

Now they have taken over the browser process. Maybe you decided to be safe and do all your browsing in a VM, or use something like Qubes. Then the NSA has to break out a virtualization escape from Xen/VMWare/whatever. Difficult, but not impossible, and entirely within the NSA's capabilities. Once out of the VM, they can use an OS exploit to get into kernel space, or just do some privilege escalation and load a kernel module.

From here they've got complete control of your machine. They can do disk and memory capture, capture all your keystrokes, record your screen, etc.

All of the above can be done without leaving a clear footprint in network traffic or on disk. An analyst could find it, given time, but I wouldn't trust any sort of AV program or network monitor to catch any of this automatically. Exfilling data is a little more complicated to avoid leaving a giant footprint in the network traffic. Probably the best thing is to take advantage of that staging server they set up in your path: your machine can make a TCP connection to an innocent-looking IP address and get the connection MitM-ed. Break the data into pieces and hide it in innocent-looking requests to generic places and have it intercepted.

Notice everything I've described can be done completely remotely, without any physical access, and can be applied to basically any setup you have. The bottom line: once you're dealing with a adversary sophisticated enough to be able to use multiple 0days against ubiquitous programs, there's not much you can do. Your best defense at this point becomes security through obscurity: force them to have to figure out what setup you have to progress through your system. This might slow them down enough that they get caught.