After many years of living in bad neighborhoods, I've learned a few things:

1) If someone is determined to rob/attack you, they can/will eventually do it. However...
2) Almost all thieves are lazy, and can be easily discouraged.

The internet is a bad neighborhood, so the same rules apply.
There is no such thing as perfect security, but you can discourage almost everyone who would do you harm.

After many years of working in IT, I've learned a few things:

1) People are lazy, and won't use security tools if they require even a minimum of work. However...
2) They will stop being lazy after the first time they get hacked/robbed (which they eventually will be).

So the trick is making the security tools as easy to use as possible.

Unless you can't imagine a single possibility of calling, emailing, or texting something in the future that you wouldn't want intelligence/law enforcement/hackers to read, then we all need to put encryption in our online lives.
Because if you wait until you actually need it, it's already too late.

During any online debate regarding the NSA mass domestic spying, someone will likely declare that you can't defend yourself from the government, and that the only solution is to simply self-censor (aka the "I don't have anything to hide" defense).
   Well that simply isn't true.

Here's what I've been doing.

Use Signal on your phone

The Feds recently subpoenaed Open Whisper Systems for records on its users. They didn't get much.

Unfortunately for the government, Signal keeps only minimal logs on users, so the vast majority of the requested information was unavailable.
The American Civil Liberties Union, which represented Open Whisper Systems in the fight, has published a number of court filings related to the the request. Portions of the filings are redacted and much about the subpoena is still secret — including the case number, the date it was served, and the details of the underlying case — but it’s clear that the government sought detailed information on the users including subscriber name, payment information, and associated IP addresses.
It’s also clear that almost none of that information was ultimately produced. One of the phone numbers named by the government did not correspond to a Signal account, and logs on the other number showed only when the user first signed up for the service and when they most recently logged in.

Signal is a free app for your phone that uses end-to-end encryption by default for all users for your phone calls and text messages, but only if the other person also installed the Signal app.
Gradually I've managed to get most of my friends and immediate family to install Signal. None of them have since complained.

WhatsApp (Facebook) and Allo (Google) also do encrypted messenging, but with huge security holes.

As for your phone itself, you should of course enable encryption and set up a swipe/pin/password.
Also turn off bluetooth, wifi, and location, both for security and to save your battery. You can always turn them on when you need them.
No matter what, don't do anything financially important with your phone. They are just too insecure for it.

Secure Protonmail

I abandoned my Yahoo account many years ago and moved to Google, but the recent news about Yahoo inspired me to take the next step.
“It does not make sense that U.S. surveillance agencies would serve Yahoo Mail with such an order but ignore Gmail, the world’s largest email provider, or Outlook. There is no doubt that the secret surveillance software is also present in Gmail and Outlook, or at least there is nothing preventing Gmail and Outlook from being forced to comply with a similar directive in the future. From a legal perspective, there is nothing that makes Yahoo particularly vulnerable, or Google particularly invulnerable.”
- Andy Yen, co-founder of ProtonMail

I am in the process of migrating to Protonmail.

All emails are secured automatically with end-to-end encryption. This means even we cannot decrypt and read your emails. As a result, your encrypted emails cannot be shared with third parties.
No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account.

Like Signal, they couldn't fink on you if they wanted to. Plus, Protonmail is in Switzerland, and doesn't answer to FISA warrants.

Created by former CERN scientists, ProtonMail ensures that the mails are encrypted at the browser level itself which means that the ProtonMail servers receive mails in an encrypted format. They are transmitted to the recepients also in the encrypted format. The decryption keys are only known to the sender and recipient. This reduces the risk of any third party intercepting your mails since the data is in the encrypted format.
While services such as Gmail also offer some level of encryption, it is not end to end – hence you get those targetted advertisements, because you have given Google permission to go through your mails to send you those timely Google Now cards.

Moving email addresses is a Big Deal.
Believe me, I know. It's a process.
But if you never start, it'll never happen.

Besides, just like you should have more than one browser on your computer (because one will eventually get gummed up), you should have more than one email address (to separate your important email from the garbage).

I've also noticed that Google knows most of what I've done on my Android phone (minus Signal), and that's not cool at all. So it's time to separate.

Use Tor

Or at least take some basic security steps with your browser.
Install Adblock, HTTPS Everywhere, be careful with Flash, and clear your history every time you close your browser.
Also, get in the habit of using DuckDuckGo to search instead of Google.

Tor does all that, plus it anonymizes your IP address. It's not perfect, but it's darn close. However, with so much locked down, Tor might not do everything you are used to doing.
Also, if you torrent, use Tribler. It's slower, but you won't have anyone asking you to "pay up".

Use Linux

This is the big one, and the hardest one to get people to do.
At the very least, get off of Windows. Microsoft has put NSA backdoors into Windows since the 90's.

But that isn't even the biggest reason to get off of Windows. As I said yesterday, 99.4% of virus are made for the Windows operating system, and viruses are the #1 method used by hackers.
Linux, OTOH, is practically immune from viruses. Why is that?

In Windows users by default have access to everything in the system because they are given administrator rights. If the virus will be able to penetrate their system, they can quickly gain access to important parts of the system. On the other hand, in Linux, they have a lower access rights, and, theoretically, the virus can only access local files and folders, the system will remain safe.

This isn't totally true, but it's partly true.

Linux works in many environments and distros such as Linux Mint, Debian, Ubuntu, Gentoo, Arch, and many others. Various email clients, the environment console and system packages also make the system extremely fragmented and difficult for any virus. The architecture of Windows is not so divided, so a virus could easily reach the many computers of the system which will cause harm to their users.
The number of users using Linux is much less in comparison with Windows and Mac OS. As the number of users is smaller, less viruses will strive to hit their computers to gain access to important data.

No matter how you cut it, viruses for Linux are extremely rare, while they are everywhere in the Windows world.
Viruses used to be rare for Macs too, but they are becoming more common as Macs get more popular. However, Macs are still a far better choice.
Also, Linux is free and open-source, so you can be confident there are no backdoors.

Linux distros today are extremely easy to install, and not difficult to use.
However, you won't have your typical apps you are accustom to.
If all you do on your computer is stuff on the web, then Linux is a good choice. Otherwise, it depends on what you use your computer for.
I personally use Linux Mint.

Common sense practices

No list is complete without a list like this.

Another diatribe about passwords

Changing passwords and making sure that you don't use the same password for multiple sites is still very important -- in spite of recent warnings that frequent password changes might result in simpler, more guessable passwords. If one of your accounts is compromised, you probably don't want all of them to suffer the same fate.
And the passwords you choose should be complex enough to not be easily guessed.

Privacy

Don't post anything you're not willing to have go public. I hear so many people complaining about their lack of privacy. At the same time, they share the intimate details of their lives on Facebook, Twitter, etc. Keep enough information private that you have a chance of knowing some things that no one who isn't very close to you will know.

Scrutinizing links

Don't trust links -- examine them, retype them, and don't click unless you're confident they're not leading you astray. Hover your mouse over links and make sure they point to the resource they pretend to point to. And beware of carefully crafted look-alikes. An extra letter, a 0 in place of an O, or a b in place of a d might not be obvious unless you look closely.

Don't trust public WiFi

Don't trust WiFi in public places with anything you wouldn't share with anyone -- especially don't log into sensitive accounts like your bank accounts. You might be sharing everything you type and could be completely oblivious to the possibility that someone is snooping.

I'll add more as I think of it.