>they cannot reach out into my real life and actually harm me

I would be careful with that assumption. The reason you are not hurt is mostly because people don't want to hurt you. The reward is not high enough.

I'm not trying to diminish your importance, for all I know you could be facebook employee #17 or have gold bars buried in your yard.

But any of the top security guys will tell you safety is a function of an attacker's motivation and resources.

It's not theoretical either, you can google people who took lots of time building up their protections and then challenged a pen test. We're talking people with good above average safety practices, that got owned within 24hrs. Social media, banking accounts, everything.

> banking accounts

How would they do this? Access to my bank account requires a password I never use for any other service, and a physical non-internet-connected 2FA token I keep on my person.

Using other information they have acquired they would phone the bank’s customer service line, convince them that they were you & gain control of the account. How hard this is depends on the bank. The fact that you have a strong password & two factor authentication is irrelevant.

I guess it's plausible that they could phone my bank and convince them they were me, even though the bank asks several control questions like "what was the amount on your recent bill to Company X?". But assume they've gotten past that, how do they then "gain control of my account"? If they ask for a new 2fa chip or a new debit card, that gets sent to my address by registered letter, so I have to go to the local post office and present photo ID to get it. I don't have any other ways of accessing my account than by internet bank or debit card.

You should not assume an attacker would walk in through the front door like you do. There are more components in the stack, all of which could be a worthy target.

All it takes is a couple opsec slip-ups to give a dedicated group of attackers the clue they need to link your identities together. Maybe you'll never make a mistake or say something that the wrong kind of person takes umbrage with, but is it really fair to put that task on every single Internet user?

Back in the day, it was standard advice for n00bs.

I don't think the main worry should be about being harmed. Yes, we can all avoid taking it personally and being harmed. We do that by avoiding, by withdrawing, by not engaging. That is the real damage - it is no longer safe to discuss things. People talk about hyper-partisanship but a large part of this is that there are actors who are just in it for the lulz and people that have emotional problems in their lives who use political discussion as a way to exercise their personal anger.

Sure, we can personally stay safe, but public discourse cannot.

I don't say this to troll you but googling your HN name reveals more than enough to know your real name, where you live and start linking it all to other non-programming hobbies (piano!).

Yes, that can be problematic. But hey, maybe it's misdirection ;)

Who do you think Mirimir is?

I'm sorry but I'm not here to check your opsec for you.

Probably Maximillian Holm. Am I close?

There's an amazing number of people who will disassociate their identities online, but still cross one used name over to an auction or property site, where it's easy to deduce someone's real name v

I've tried this approach too. Though it's challenging to maintain the constant vigilance that's sometimes required. I doubt it's a workable solution for most of the people I know.

Yes, I do exactly that. Also, all of my meatspace professional writing is private, so the chances of stylometric outing are minimal. Mirimir is currently my online professional persona, and I generally don't get into arguments using it. There are other personas for that.