I've been paranoid about this idea for a while, that I'll be an idiot, lose control of myself, and turn off my precious firewall. I'm scared about my password as well. I'm worried a hacker will hack my Linux PC? Under these conditions, is it even possible? I know about offline hacking, but that doesn't matter for me usually, since I usually have my lappy at home.
If your question really is "is it even possible?" then the answer is yes.
Your primary concern with that setup is client-side attacks.
If malware infects your PC, it could start a reverse shell. Your firewall can combat this with egress filtering, but it is tricky nonetheless. Even ICMP may be used for reverse shell communication, or the traffic may be encrypted or obfuscated. Or the malware may simply exfiltrate your data to a remote server.
You may unwittingly install this malware yourself. Software you already use like a browser or browser plugin may have a vulnerability that could be exploited, e.g. drive-by-downloads.
Defences are numerous. You can keep your software up to date, only install trusted software and use your judgment when browsing. Furthermore, you can run anti-virus software. Of course, there are many, many measures you can take.
In order to decide what action to take, consider the risks and your threat model. Ask questions like:
- What's at stake?
- What level of risk am I comfortable with?
- Am I defending against random or targeted attacks, by whom?