I understand security is a continuum rather than a binary, which is why I'm asking this question.
I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about safe online practises when it comes to malware/privacy. The main thing I’m concerned about is reinstalling the OS with the least risk possible when it comes to inadvertently installing a compromised version of the OS/inadvertently allowing unauthorised access to my machine after a fresh reinstall.
So my question is: what’s the safest way to reinstall the OS with the least risk of being hosed?
A couple of outstanding/relevant points:
I’d rather not use the recovery partition. I think it’s an issue to have a restore point in a potentially compromised HD. I’d use Internet Recovery (which downloads the same recovery functions from the machine's firmware rather than booting from a partition on the HD) as I could wipe the drive and repartition it to remove the pre-existing recovery partition, but then this poses another question about what wifi connection to use.
I currently do not have access to a VPN. I’m pretty sure there is one compromised machine that uses the same home wifi network I do but there’s nothing I can do about that (long story), and it’s exceptionally slow. I could use an Apple store’s unsecured wifi but we all know the risks when it comes to using public wifi - and more importantly, after a fresh reinstall, the firewall is disabled by default which I feel like is an exceptionally risky thing especially on public wifi (but remote login/screen sharing is disabled by default, and I guess I could just go out of range of the store’s wifi after the OS is downloaded and is being installed?).
My knowledge of the command line is basic at best (so creating a bootable drive is out of the question), and I’m not too comfortable plugging a bootable drive in my machine that I don’t know where it’s been previously (so using a Genius Bar drive with the OS I need on it seems risky).