http://prism-break.org/
I pretty much use Tor for everything, only use open source, use VPN for stuff that I can't do over Tor (email and streaming mostly).
All of the Tor/VPN stuff is done at the router so every device I connect to the network "just works" without hassle.
I use chromium (chrome without google crap in it), and firefox mostly. With the ghostery plugins, https everywhere (thanks eff) in both of them.
The noscript/certificate patrol in firefox, and I only use FF for banking. Those plugins really secure the browser, but they are annoying as hell for general browsing. I use chromium for that.
Every other browser plugin is disabled or (better) never installed in the first place. I avoid java like the plague, and I run flash in a sandbox and it is limited to specific trusted websites.
I use full-disk encryption on my workstation and all of my laptops. (Especially important on laptops because they can get lost/stolen easily.)
Run a custom FreeBSD-based OS (built from the console up, not based on PCBSD) on my workstation and servers, Linux on the laptops (better hw support and power management).
I own an android phone, but I leave it in a drawer and I never carry it with me. I run the cyanogenmod rom, text secure, and red phone. I mostly use it to receive calls from family members and do development with.
Email is a hard problem to solve. I need it to work for day-to-day business. I just VPN from here to my servers and send plaintext. It sucks, but it is more of a network effect problem. Solving email requires everyone to change to something better at the same time. See: IPv6 as an example. lol.
I do use PGP (Thunderbird+Enigmail+GNUPG+FreeBSD), but the number of people that I use PGP with is very small. Probably around 5-10 people tops.
Anyone else out there as paranoid as I am?