> If your threat model DOES include US intelligence agencies, you shouldn't use almost any mainstream browser, most protocols (including https://), social media (including HN), etc...

No, you can simply use Qubes OS and use whatever software you want in disposable VMs and perhaps have several identities. It works for me (or so I hope).