<li><ahref="#no-logging-but-logging-anyway-policies">No logging but logging anyway policies:</a></li>
@@ -1091,17 +1088,6 @@
</ul>
<p>You should not trust cloud providers with your (not previously and locally encrypted) sensitive data and you should be wary of their privacy claims. In most cases, they can access your data and provide it to a third party if they want to<ahref="#fn256"class="footnote-ref"id="fnref256"><sup>256</sup></a>.</p>
<p>The only way to mitigate this is to encrypt your data on your side and then only upload it to such services <strong>or just not use them at all.</strong></p>
<h2id="your-browser-and-device-fingerprints">Your Browser and Device Fingerprints:</h2>
<p>Your Browser and Device Fingerprints<ahref="#fn257"class="footnote-ref"id="fnref257"><sup>257</sup></a> are a set of properties/capabilities of your System/Browser. These are used on most websites for invisible user tracking but also to adapt the website user experience depending on their browser. For instance, websites will be able to provide a “mobile experience” if you are using a mobile browser or propose a specific language/geographic version depending on your fingerprint. Most of those techniques work with recent Browsers like Chromium-based<ahref="#fn258"class="footnote-ref"id="fnref258"><sup>258</sup></a> browsers (such as Chrome/Edge) or Firefox<ahref="#fn259"class="footnote-ref"id="fnref259"><sup>259</sup></a> unless taking specific measures. Browser and Device<ahref="#fn260"class="footnote-ref"id="fnref260"><sup>260</sup></a> Fingerprinting are usually integrated into the Captcha services but also in other various services.</p>
<p>We will address <ahref="#browser-and-device-fingerprinting">Browser and Device Fingerprinting</a> further down but this is a basic introduction to the methodology behind it and why it is used in practice.</p>
<p>It should also be noted that while some browsers and extensions will offer some fingerprint resistance, this resistance in itself can also be used to fingerprint you as explained here <ahref="https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/"class="uri">https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/</a><sup><ahref="https://web.archive.org/web/https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/">[Archive.org]</a></sup></p>
<p>This guide will mitigate these issues by randomizing or hiding many of those fingerprinting identifiers by:</p>
<ul>
<li><p>Using Virtualization (See <ahref="#appendix-w-virtualization">Appendix W: Virtualization</a>);</p></li>
<li><p>Using specific recommendations (See <ahref="#appendix-a5-additional-browser-precautions-with-javascript-enabled">Appendix A5: Additional browser precautions with JavaScript enabled</a>;</p></li>
<li><p>Using hardening <ahref="#appendix-v1-hardening-your-browsers">Appendix V1: Hardening your Browsers</a>);</p></li>
<li><p>and by using fingerprint-resistant browsers (like Brave or Tor Browser).</p></li>
<p>There was an attack published that can deanonymize users if they have a known alias. For example, an attacker trying to track the activities of a journalist can use that journalist’s public Twitter handle to link their anonymous identities with their public one. This breaks compartmentalization of identities and can lead to complete deanonymization, even of users who practice proper OPSEC.</p>
<p>The attack, published at <ahref="https://leakuidatorplusteam.github.io/"class="uri">https://leakuidatorplusteam.github.io/</a><sup><ahref="https://web.archive.org/web/20220720023429/https://leakuidatorplusteam.github.io/">[Archive.org]</a></sup>, can be mitigated using the well-known <ahref="https://noscript.net/">NoScript</a> extension and will be our preferred recommendation.</p>
@@ -1130,7 +1116,7 @@
<h2id="local-data-leaks-and-forensics">Local Data Leaks and Forensics:</h2>
<p>Most of you have probably seen enough Crime dramas on Netflix or TV to know what forensics are. These are technicians (usually working for law enforcement) that will perform various analysis of evidence. This of course could include your smartphone or laptop.</p>
<p>While these might be done by an adversary when you already got “burned”, these might also be done randomly during a routine control or a border check. These unrelated checks might reveal secret information to adversaries that had no prior knowledge of such activities.</p>
<p>Forensics techniques are now very advanced and can reveal a staggering amount of information from your devices even if they are encrypted<ahref="#fn261"class="footnote-ref"id="fnref261"><sup>261</sup></a>. These techniques are widely used by law enforcement all over the world and should be considered.</p>
<p>Forensics techniques are now very advanced and can reveal a staggering amount of information from your devices even if they are encrypted<ahref="#fn257"class="footnote-ref"id="fnref257"><sup>257</sup></a>. These techniques are widely used by law enforcement all over the world and should be considered.</p>
<p>Here are some recent resources you should read about your smartphone:</p>
<ul>
<li><p>UpTurn, The Widespread Power of U.S. Law Enforcement to Search Mobile Phones <ahref="https://www.upturn.org/reports/2020/mass-extraction/"class="uri">https://www.upturn.org/reports/2020/mass-extraction/</a><sup><ahref="https://web.archive.org/web/https://www.upturn.org/reports/2020/mass-extraction/">[Archive.org]</a></sup></p></li>
<li><p>SANS Digital Forensics and Incident Response Videos, <ahref="https://www.youtube.com/c/SANSDigitalForensics/videos"class="uri">https://www.youtube.com/c/SANSDigitalForensics/videos</a></p></li>
</ul>
<p>And finally, here is this very instructive detailed paper on the current state of IOS/Android security from the John Hopkins University: https://securephones.io/main.html<ahref="#fn262"class="footnote-ref"id="fnref262"><sup>262</sup></a>.</p>
<p>And finally, here is this very instructive detailed paper on the current state of IOS/Android security from the John Hopkins University: https://securephones.io/main.html<ahref="#fn258"class="footnote-ref"id="fnref258"><sup>258</sup></a>.</p>
<p>When it comes to your laptop, the forensics techniques are many and widespread. Many of those issues can be mitigated by using full disk encryption, virtualization (See <ahref="#appendix-v1-hardening-your-browsers">Appendix W: Virtualization</a>), and compartmentalization. This guide will later detail such threats and techniques to mitigate them.</p>
<h2id="bad-cryptography">Bad Cryptography:</h2>
<p>There is a frequent adage among the infosec community: “Don’t roll your own crypto!”.</p>
<p>And there are reasons<ahref="#fn263"class="footnote-ref"id="fnref263"><sup>263</sup></a>‘<ahref="#fn264"class="footnote-ref"id="fnref264"><sup>264</sup></a>’<ahref="#fn265"class="footnote-ref"id="fnref265"><sup>265</sup></a>’<ahref="#fn266"class="footnote-ref"id="fnref266"><sup>266</sup></a> for that:</p>
<p>And there are reasons<ahref="#fn259"class="footnote-ref"id="fnref259"><sup>259</sup></a>‘<ahref="#fn260"class="footnote-ref"id="fnref260"><sup>260</sup></a>’<ahref="#fn261"class="footnote-ref"id="fnref261"><sup>261</sup></a>’<ahref="#fn262"class="footnote-ref"id="fnref262"><sup>262</sup></a> for that:</p>
<p>We would not want people discouraged from studying and innovating in the crypto field because of that adage. So instead, we would recommend people to be cautious with “Roll your own crypto” because it is not necessarily good crypto:</p>
<ul>
<li><p>Good cryptography is not easy and usually takes years of research to develop and fine-tune.</p></li>
@@ -1160,9 +1146,9 @@
<p>Yet, this is not stopping some from doing it anyway and publishing various production Apps/Services using their self-made cryptography or proprietary closed-source methods:</p>
<ul>
<li><p>You should apply caution when using Apps/Services using closed-source or proprietary encryption methods. All the good crypto standards are public and peer-reviewed and there should be no issue disclosing the one you use.</p></li>
<li><p>You should be wary of Apps/Services using a “modified” or proprietary cryptographic method<ahref="#fn267"class="footnote-ref"id="fnref267"><sup>267</sup></a>.</p></li>
<li><p>By default, you should not trust any “Roll your own crypto” until it was audited, peer-reviewed, vetted, and accepted by the cryptography community<ahref="#fn268"class="footnote-ref"id="fnref268"><sup>268</sup></a>’<ahref="#fn269"class="footnote-ref"id="fnref269"><sup>269</sup></a>.</p></li>
<li><p>There is no such thing as “military-grade crypto”<ahref="#fn270"class="footnote-ref"id="fnref270"><sup>270</sup></a>‘<ahref="#fn271"class="footnote-ref"id="fnref271"><sup>271</sup></a>’<ahref="#fn272"class="footnote-ref"id="fnref272"><sup>272</sup></a>.</p></li>
<li><p>You should be wary of Apps/Services using a “modified” or proprietary cryptographic method<ahref="#fn263"class="footnote-ref"id="fnref263"><sup>263</sup></a>.</p></li>
<li><p>By default, you should not trust any “Roll your own crypto” until it was audited, peer-reviewed, vetted, and accepted by the cryptography community<ahref="#fn264"class="footnote-ref"id="fnref264"><sup>264</sup></a>’<ahref="#fn265"class="footnote-ref"id="fnref265"><sup>265</sup></a>.</p></li>
<li><p>There is no such thing as “military-grade crypto”<ahref="#fn266"class="footnote-ref"id="fnref266"><sup>266</sup></a>‘<ahref="#fn267"class="footnote-ref"id="fnref267"><sup>267</sup></a>’<ahref="#fn268"class="footnote-ref"id="fnref268"><sup>268</sup></a>.</p></li>
</ul>
<p>Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization.</p>
<p>In the context of this guide,we recommend sticking to Apps/Services using well-established, published, and peer-reviewed methods.</p>
@@ -1171,58 +1157,50 @@
<ul>
<li><p>Hashes:</p>
<ul>
<li><p>Prefer: SHA3-224, SHA-384 or BLAKE2<ahref="#fn273"class="footnote-ref"id="fnref273"><sup>273</sup></a> (these are considered very Quantum Resistant based on an instance of the KECCAK algorithm), SHAKE128 and SHAKE256 (referred to as <ahref="https://csrc.nist.gov/publications/detail/fips/202/final">extendable-output functions</a> (XOFs) via FIPS 202);</p>
<ul>
<li><p><strong>Most digital signature algorithms are quantum-broken</strong>;</p></li>
<li><p><strong>Highly suspicious RBGs such as MS_DRBG still exist in standards such as ISO 18031</strong>;</p></li>
<li><p><strong>The AES and SHA2 based DRBGs in current NIST standards are fine</strong></p></li>
</ul></li>
<li><p>Still relatively safe to use: SHA-2 (e.g., SHA-256 or SHA-512, which are still considered mostly quantum-safe)</p></li>
<li><p>Avoid: SHA-0, SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used); i.e., anything with known collisions, and/or a history of extensive, not one-off, cryptographic failures</p></li>
<li><p>Prefer: SHA-3 or BLAKE2<ahref="#fn269"class="footnote-ref"id="fnref269"><sup>269</sup></a></p></li>
<li><p>Still relatively ok to use: SHA-2 (such as the widely used SHA-256 or SHA-512)</p></li>
<li><p>Hardware Accelerated<ahref="#fn274"class="footnote-ref"id="fnref274"><sup>274</sup></a>: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.</p></li>
<li><p>Hardware Accelerated<ahref="#fn270"class="footnote-ref"id="fnref270"><sup>270</sup></a>: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.</p></li>
<li><p>Non-Hardware Accelerated: Same as accelerated above or if available consider:</p>
<ul>
<li><p>ChaCha20<ahref="#fn275"class="footnote-ref"id="fnref275"><sup>275</sup></a> or XChaCha20 (You can use ChaCha20 with Kryptor <ahref="https://www.kryptor.co.uk"class="uri">https://www.kryptor.co.uk</a>, unfortunately, it is not available with Veracrypt).</p></li>
<li><p>ChaCha20<ahref="#fn271"class="footnote-ref"id="fnref271"><sup>271</sup></a> or XChaCha20 (You can use ChaCha20 with Kryptor <ahref="https://www.kryptor.co.uk"class="uri">https://www.kryptor.co.uk</a>, unfortunately, it is not available with Veracrypt).</p></li>
<li><p>Prefer ECDSA (ed25519)+ECDH (ec25519) or RSA 4096 Bits*</p>
<ul>
<li><strong>Consider a more modern</strong><ahref="#fn278"class="footnote-ref"id="fnref278"><sup>278</sup></a><strong>alternative to PGP/GPG: Minisign <ahref="https://jedisct1.github.io/minisign/"class="uri">https://jedisct1.github.io/minisign/</a></strong><sup><ahref="https://web.archive.org/web/https://jedisct1.github.io/minisign/">[Archive.org]</a></sup></li>
<li><strong>Consider a more modern</strong><ahref="#fn274"class="footnote-ref"id="fnref274"><sup>274</sup></a><strong>alternative to PGP/GPG: Minisign <ahref="https://jedisct1.github.io/minisign/"class="uri">https://jedisct1.github.io/minisign/</a></strong><sup><ahref="https://web.archive.org/web/https://jedisct1.github.io/minisign/">[Archive.org]</a></sup></li>
</ul></li>
<li><p>Avoid: RSA 2048 bits</p></li>
</ul></li>
<li><p>SSH keys:</p>
<ul>
<li><p>ED25519 (preferred) or RSA 4096 Bits*</p>
<ul>
<li>But refer to <ahref="https://eprint.iacr.org/2017/1014.pdf">Attacking Deterministic Signature algorithms</a>, which details fault injections “(varying the voltage supply) - mainly a threat to tamper-proof hardware and hardware security modules” such as Rowhammer, or templating attacks, etc.</li>
</ul></li>
<li><p>ED25519 (preferred) or RSA 4096 Bits*</p></li>
<li><p>Avoid: RSA 2048 bits</p></li>
</ul></li>
<li><p><strong>Warning: RSA and ED25519 are unfortunately not seen as “Quantum Resistant”</strong><ahref="#fn279"class="footnote-ref"id="fnref279"><sup>279</sup></a><strong>and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.</strong></p></li>
<li><p><strong>Warning: RSA and ED25519 are unfortunately not seen as “Quantum Resistant”</strong><ahref="#fn275"class="footnote-ref"id="fnref275"><sup>275</sup></a><strong>and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.</strong></p></li>
</ul>
<p>Here are some real cases of issues bad cryptography:</p>
<ul>
@@ -1234,20 +1212,20 @@
<p>Later this guide will not recommend “bad cryptography” and that should hopefully be enough to protect you?</p>
<h2id="no-logging-but-logging-anyway-policies">No logging but logging anyway policies:</h2>
<p>Many people have the idea that privacy-oriented services such as VPN or E-Mail providers are safe due to their no-logging policies or their encryption schemes. Unfortunately, many of those same people forget that all those providers are legal commercial entities subject to the laws of the countries in which they operate.</p>
<p>Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order<ahref="#fn280"class="footnote-ref"id="fnref280"><sup>280</sup></a> or a national security letter<ahref="#fn281"class="footnote-ref"id="fnref281"><sup>281</sup></a>) log your activity to de-anonymize you. There have been several recent examples of those:</p>
<p>Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order<ahref="#fn276"class="footnote-ref"id="fnref276"><sup>276</sup></a> or a national security letter<ahref="#fn277"class="footnote-ref"id="fnref277"><sup>277</sup></a>) log your activity to de-anonymize you. There have been several recent examples of those:</p>
<ul>
<li><p>2021, Proton, Proton logged IP address of French activist after an order by Swiss authorities (source link unavailable).</p></li>
<li><p>2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities<ahref="#fn282"class="footnote-ref"id="fnref282"><sup>282</sup></a>.</p></li>
<li><p>2021, DoubleVPN servers, logs, and account info seized by law enforcement<ahref="#fn283"class="footnote-ref"id="fnref283"><sup>283</sup></a>.</p></li>
<li><p>2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months<ahref="#fn284"class="footnote-ref"id="fnref284"><sup>284</sup></a>.</p></li>
<li><p>2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user<ahref="#fn285"class="footnote-ref"id="fnref285"><sup>285</sup></a> (they did not decrypt the stored e-mail).</p></li>
<li><p>2017, PureVPN was forced to disclose information of one user to the FBI<ahref="#fn286"class="footnote-ref"id="fnref286"><sup>286</sup></a>.</p></li>
<li><p>2014, an EarthVPN user was arrested based on logs provider to the Dutch Police<ahref="#fn287"class="footnote-ref"id="fnref287"><sup>287</sup></a>.</p></li>
<li><p>2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order<ahref="#fn288"class="footnote-ref"id="fnref288"><sup>288</sup></a>.</p></li>
<li><p>2011, HideMyAss user was de-anonymized, and logs were provided to the FBI<ahref="#fn289"class="footnote-ref"id="fnref289"><sup>289</sup></a>.</p></li>
<li><p>2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities<ahref="#fn278"class="footnote-ref"id="fnref278"><sup>278</sup></a>.</p></li>
<li><p>2021, DoubleVPN servers, logs, and account info seized by law enforcement<ahref="#fn279"class="footnote-ref"id="fnref279"><sup>279</sup></a>.</p></li>
<li><p>2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months<ahref="#fn280"class="footnote-ref"id="fnref280"><sup>280</sup></a>.</p></li>
<li><p>2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user<ahref="#fn281"class="footnote-ref"id="fnref281"><sup>281</sup></a> (they did not decrypt the stored e-mail).</p></li>
<li><p>2017, PureVPN was forced to disclose information of one user to the FBI<ahref="#fn282"class="footnote-ref"id="fnref282"><sup>282</sup></a>.</p></li>
<li><p>2014, an EarthVPN user was arrested based on logs provider to the Dutch Police<ahref="#fn283"class="footnote-ref"id="fnref283"><sup>283</sup></a>.</p></li>
<li><p>2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order<ahref="#fn284"class="footnote-ref"id="fnref284"><sup>284</sup></a>.</p></li>
<li><p>2011, HideMyAss user was de-anonymized, and logs were provided to the FBI<ahref="#fn285"class="footnote-ref"id="fnref285"><sup>285</sup></a>.</p></li>
</ul>
<p>Some providers have implemented the use of a Warrant Canary<ahref="#fn290"class="footnote-ref"id="fnref290"><sup>290</sup></a> that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.</p>
<p>Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story<ahref="#fn291"class="footnote-ref"id="fnref291"><sup>291</sup></a> and Omnisec story<ahref="#fn292"class="footnote-ref"id="fnref292"><sup>292</sup></a>).</p>
<p>Some providers have implemented the use of a Warrant Canary<ahref="#fn286"class="footnote-ref"id="fnref286"><sup>286</sup></a> that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.</p>
<p>Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story<ahref="#fn287"class="footnote-ref"id="fnref287"><sup>287</sup></a> and Omnisec story<ahref="#fn288"class="footnote-ref"id="fnref288"><sup>288</sup></a>).</p>
<p>For these reasons, you mustn’t trust such providers for your privacy despite all their claims. In most cases, you will be the last person to know if any of your accounts were targeted by such orders and you might never know at all.</p>
<p>To mitigate this, in cases where you want to use a VPN, we will recommend the use of a cash/Monero-paid VPN provider over Tor to prevent the VPN service from knowing any identifiable information about you.</p>
<p>If the VPN provider knows nothing about you, it should mitigate any issue due to them not logging but logging anyway.</p>
<p>(Illustration: an excellent movie we highly recommend: Das Leben der Anderen<ahref="#fn293"class="footnote-ref"id="fnref293"><sup>293</sup></a>)</p>
<p>Many advanced techniques can be used by skilled adversaries<ahref="#fn294"class="footnote-ref"id="fnref294"><sup>294</sup></a> to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here <ahref="https://cyber.bgu.ac.il/advanced-cyber/airgap"class="uri">https://cyber.bgu.ac.il/advanced-cyber/airgap</a><sup><ahref="https://web.archive.org/web/https://cyber.bgu.ac.il/advanced-cyber/airgap">[Archive.org]</a></sup> (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report <ahref="https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf"class="uri">https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf</a><sup><ahref="https://web.archive.org/web/https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf">[Archive.org]</a></sup> (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include:</p>
<p>(Illustration: an excellent movie we highly recommend: Das Leben der Anderen<ahref="#fn289"class="footnote-ref"id="fnref289"><sup>289</sup></a>)</p>
<p>Many advanced techniques can be used by skilled adversaries<ahref="#fn290"class="footnote-ref"id="fnref290"><sup>290</sup></a> to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here <ahref="https://cyber.bgu.ac.il/advanced-cyber/airgap"class="uri">https://cyber.bgu.ac.il/advanced-cyber/airgap</a><sup><ahref="https://web.archive.org/web/https://cyber.bgu.ac.il/advanced-cyber/airgap">[Archive.org]</a></sup> (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report <ahref="https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf"class="uri">https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf</a><sup><ahref="https://web.archive.org/web/https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf">[Archive.org]</a></sup> (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include:</p>
<ul>
<li><p>Attacks requiring malware implants:</p>
<ul>
@@ -1282,14 +1260,14 @@
</ul></li>
<li><p><strong>Attacks not requiring malware:</strong></p>
<ul>
<li><p>Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing<ahref="#fn295"class="footnote-ref"id="fnref295"><sup>295</sup></a>. Publication with demonstration: <ahref="http://wallcamera.csail.mit.edu/"class="uri">http://wallcamera.csail.mit.edu/</a><sup><ahref="https://web.archive.org/web/http://wallcamera.csail.mit.edu/">[Archive.org]</a></sup></p></li>
<li><p>Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room<ahref="#fn296"class="footnote-ref"id="fnref296"><sup>296</sup></a>. Publication with photographic examples: <ahref="https://arxiv.org/pdf/2001.04642.pdf"class="uri">https://arxiv.org/pdf/2001.04642.pdf</a><sup><ahref="https://web.archive.org/web/https://arxiv.org/pdf/2001.04642.pdf">[Archive.org]</a></sup></p></li>
<li><p>Measuring floor vibrations to identify individuals and determine their health condition and mood<ahref="#fn297"class="footnote-ref"id="fnref297"><sup>297</sup></a>. Publication with demonstration: <ahref="https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html"class="uri">https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html</a><sup><ahref="https://web.archive.org/web/https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html">[Archive.org]</a></sup></p></li>
<li><p>Observing a light bulb from a distance to listen to the sound in the room<ahref="#fn298"class="footnote-ref"id="fnref298"><sup>298</sup></a><strong>without any malware</strong>: Demonstration: <ahref="https://www.youtube.com/watch?v=t32QvpfOHqw"class="uri">https://www.youtube.com/watch?v=t32QvpfOHqw</a><sup><ahref="https://yewtu.be/watch?v=t32QvpfOHqw">[Invidious]</a></sup>. It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013<ahref="#fn299"class="footnote-ref"id="fnref299"><sup>299</sup></a> and that you can even buy devices to perform this yourself such as here: <ahref="http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html"class="uri">http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html</a><sup><ahref="https://web.archive.org/web/http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html">[Archive.org]</a></sup></p></li>
<li><p>Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing<ahref="#fn291"class="footnote-ref"id="fnref291"><sup>291</sup></a>. Publication with demonstration: <ahref="http://wallcamera.csail.mit.edu/"class="uri">http://wallcamera.csail.mit.edu/</a><sup><ahref="https://web.archive.org/web/http://wallcamera.csail.mit.edu/">[Archive.org]</a></sup></p></li>
<li><p>Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room<ahref="#fn292"class="footnote-ref"id="fnref292"><sup>292</sup></a>. Publication with photographic examples: <ahref="https://arxiv.org/pdf/2001.04642.pdf"class="uri">https://arxiv.org/pdf/2001.04642.pdf</a><sup><ahref="https://web.archive.org/web/https://arxiv.org/pdf/2001.04642.pdf">[Archive.org]</a></sup></p></li>
<li><p>Measuring floor vibrations to identify individuals and determine their health condition and mood<ahref="#fn293"class="footnote-ref"id="fnref293"><sup>293</sup></a>. Publication with demonstration: <ahref="https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html"class="uri">https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html</a><sup><ahref="https://web.archive.org/web/https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html">[Archive.org]</a></sup></p></li>
<li><p>Observing a light bulb from a distance to listen to the sound in the room<ahref="#fn294"class="footnote-ref"id="fnref294"><sup>294</sup></a><strong>without any malware</strong>: Demonstration: <ahref="https://www.youtube.com/watch?v=t32QvpfOHqw"class="uri">https://www.youtube.com/watch?v=t32QvpfOHqw</a><sup><ahref="https://yewtu.be/watch?v=t32QvpfOHqw">[Invidious]</a></sup>. It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013<ahref="#fn295"class="footnote-ref"id="fnref295"><sup>295</sup></a> and that you can even buy devices to perform this yourself such as here: <ahref="http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html"class="uri">http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html</a><sup><ahref="https://web.archive.org/web/http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html">[Archive.org]</a></sup></p></li>
</ul></li>
</ul>
<p>Here is also a good video from the same authors to explain those topics: Black Hat, The Air-Gap Jumpers <ahref="https://www.youtube.com/watch?v=YKRtFgunyj4"class="uri">https://www.youtube.com/watch?v=YKRtFgunyj4</a><sup><ahref="https://yewtu.be/watch?v=YKRtFgunyj4">[Invidious]</a></sup></p>
<p><strong>Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle</strong><ahref="#fn300"class="footnote-ref"id="fnref300"><sup>300</sup></a><strong>, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:</strong></p>
<p><strong>Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle</strong><ahref="#fn296"class="footnote-ref"id="fnref296"><sup>296</sup></a><strong>, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:</strong></p>
<ul>
<li><p>Do not conduct sensitive activity while connected to an untrusted/unsecured power line to prevent power line leaks.</p></li>
<li><p>Do not use your devices in front of a camera that could be compromised.</p></li>
<p>Personally, in the context of this guide, it is also interesting to have a look at your security model. And in this context,we only have one to recommend:</p>
<p>Here are some various resources about what Zero-Trust Security is:</p>
<ul>
<li><p>DEFCON, Zero Trust a Vision for Securing Cloud, <ahref="https://www.youtube.com/watch?v=euSsqXO53GY"class="uri">https://www.youtube.com/watch?v=euSsqXO53GY</a><sup><ahref="https://yewtu.be/watch?v=euSsqXO53GY">[Invidious]</a></sup></p></li>
@@ -1378,7 +1356,7 @@
</ul></li>
<li><p>It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):</p>
<ul>
<li><strong>You could go for any route, but we would recommend Qubes OS if your threat model allows it. Please see the requirements.<ahref="#fn302"class="footnote-ref"id="fnref302"><sup>302</sup></a></strong></li>
<li><strong>You could go for any route, but we would recommend Qubes OS if your threat model allows it. Please see the requirements.<ahref="#fn298"class="footnote-ref"id="fnref298"><sup>298</sup></a></strong></li>
</ul></li>
<li><p>If it is an ARM-based M1/M2 Mac:</p>
<ul>
@@ -1421,7 +1399,7 @@
<ul>
<li><p>If your main concern is a forensic examination of your devices, you should consider the Tor Browser route or the Tails route.</p></li>
<li><p>If your main concerns are remote adversaries that might uncover your online identity on various platforms, you should consider the Tails, Whonix, or Qubes OS routes (listed in order of difficulty).</p></li>
<li><p>If you want system-wide plausible deniability<ahref="#fn303"class="footnote-ref"id="fnref303"><sup>303</sup></a>‘<ahref="#fn304"class="footnote-ref"id="fnref304"><sup>304</sup></a> despite the risks<ahref="#fn305"class="footnote-ref"id="fnref305"><sup>305</sup></a>’<ahref="#fn306"class="footnote-ref"id="fnref306"><sup>306</sup></a>, consider the Tails route, including the persistent plausible deniability section (see <ahref="#persistent-plausible-deniability-using-whonix-within-tails">Persistent Plausible Deniability using Whonix within Tails</a>).**</p></li>
<li><p>If you want system-wide plausible deniability<ahref="#fn299"class="footnote-ref"id="fnref299"><sup>299</sup></a>‘<ahref="#fn300"class="footnote-ref"id="fnref300"><sup>300</sup></a> despite the risks<ahref="#fn301"class="footnote-ref"id="fnref301"><sup>301</sup></a>’<ahref="#fn302"class="footnote-ref"id="fnref302"><sup>302</sup></a>, consider the Tails route, including the persistent plausible deniability section (see <ahref="#persistent-plausible-deniability-using-whonix-within-tails">Persistent Plausible Deniability using Whonix within Tails</a>).**</p></li>
<li><p>If you are in a hostile environment where Tor/VPN usage alone is impossible/dangerous/suspicious, consider the Tails route (without actually using Tor), or more advanced routes like Whonix or Qubes OS.</p></li>
</ul>
<h4id="adversaries">Adversaries:</h4>
@@ -1486,7 +1464,7 @@
<p>You might be asking yourself: “How do I know if I’m in a hostile online environment where activities are actively monitored and blocked?”</p>
<ul>
<li><p>First read more about it at the EFF here: <ahref="https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship"class="uri">https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship</a><sup><ahref="https://web.archive.org/web/https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship">[Archive.org]</a></sup></p></li>
<li><p>Check some data yourself here on the Tor Project OONI<ahref="#fn307"class="footnote-ref"id="fnref307"><sup>307</sup></a> (Open Observatory of Network Interference) website: <ahref="https://explorer.ooni.org/"class="uri">https://explorer.ooni.org/</a></p></li>
<li><p>Check some data yourself here on the Tor Project OONI<ahref="#fn303"class="footnote-ref"id="fnref303"><sup>303</sup></a> (Open Observatory of Network Interference) website: <ahref="https://explorer.ooni.org/"class="uri">https://explorer.ooni.org/</a></p></li>
<li><p>Have a look at <ahref="https://censoredplanet.org/"class="uri">https://censoredplanet.org/</a> and see if they have data about your country.</p></li>
<li><p>Specific to China, look at <ahref="https://gfwatch.org/"class="uri">https://gfwatch.org/</a> and <ahref="https://www.usenix.org/system/files/sec21-hoang.pdf"class="uri">https://www.usenix.org/system/files/sec21-hoang.pdf</a><sup><ahref="https://web.archive.org/web/https://www.usenix.org/system/files/sec21-hoang.pdf">[Archive.org]</a></sup></p></li>
<li><p>Test for yourself using OONI (this can be risky in a hostile environment).</p></li>
@@ -1507,7 +1485,7 @@
<p>You should test that the phone is in working order before going to the next step. But we will repeat ourselves and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either.</p>
<p>When you are certain the phone is in working order, disable Bluetooth then power it off (remove the battery if you can) and go back home and resume your normal activities. Go to the next step.</p>
<h5id="getting-an-anonymous-pre-paid-sim-card">Getting an anonymous pre-paid SIM card:</h5>
<p>This is the hardest part of the whole guide. It is a SPOF (Single Point of Failure). The places where you can still buy prepaid SIM cards without ID registration are getting increasingly limited due to various KYC type regulations<ahref="#fn308"class="footnote-ref"id="fnref308"><sup>308</sup></a>.</p>
<p>This is the hardest part of the whole guide. It is a SPOF (Single Point of Failure). The places where you can still buy prepaid SIM cards without ID registration are getting increasingly limited due to various KYC type regulations<ahref="#fn304"class="footnote-ref"id="fnref304"><sup>304</sup></a>.</p>
<p>So here is a list of places where you can still get them now: <ahref="https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country"class="uri">https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country</a><sup><ahref="https://web.archive.org/web/https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country">[Archive.org]</a></sup></p>
<p>You should be able to find a place that is “not too far” and just go there physically to buy some pre-paid cards and top-up vouchers with cash. Do verify that no law was passed before going that would make registration mandatory (in case the above wiki was not updated). Try to avoid CCTV and cameras and do not forget to buy a Top-Up voucher with the SIM card (if it is not a package) as most pre-paid cards will require a top-up before use.</p>
<p>See <ahref="#appendix-n-warning-about-smartphones-and-smart-devices">Appendix N: Warning about smartphones and smart devices</a></p>
@@ -1545,7 +1523,7 @@
<p><strong>Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms, but you will want anonymous browsing; or if the platforms which you will use allow registration without a phone number.</strong></p>
<p>Get at least one or two decent size generic USB keys (at least 16GB but we would recommend 32GB).</p>
<p>Please do not buy or use gimmicky self-encrypting devices such as these: <ahref="https://syscall.eu/blog/2018/03/12/aigo_part1/"class="uri">https://syscall.eu/blog/2018/03/12/aigo_part1/</a><sup><ahref="https://web.archive.org/web/https://syscall.eu/blog/2018/03/12/aigo_part1/">[Archive.org]</a></sup></p>
<p>Some might be very efficient<ahref="#fn309"class="footnote-ref"id="fnref309"><sup>309</sup></a> but many are gimmicky gadgets that offer no real protection<ahref="#fn310"class="footnote-ref"id="fnref310"><sup>310</sup></a>.</p>
<p>Some might be very efficient<ahref="#fn305"class="footnote-ref"id="fnref305"><sup>305</sup></a> but many are gimmicky gadgets that offer no real protection<ahref="#fn306"class="footnote-ref"id="fnref306"><sup>306</sup></a>.</p>
<h3id="find-some-safe-places-with-decent-public-wi-fi">Find some safe places with decent public Wi-Fi:</h3>
<p>You need to find safe places where you will be able to do your sensitive activities using some publicly accessible Wi-Fi (without any account/ID registration, avoid CCTVs).</p>
<p>This can be anywhere that will not be tied to you directly (your home/work) and where you can use the Wi-Fi for a while without being bothered. But also, a place where you can do this without being “noticed” by anyone.</p>
@@ -1632,7 +1610,7 @@
<p><strong>Please see</strong><ahref="#appendix-b6-warning-for-using-orbot-on-android">Warning for using Orbot on Android</a>.</p>
<h3id="ios">iOS:</h3>
<p><strong>Disclaimer: Onion Browser, following a 2018 release on iOS, has had IP leaks via WebRTC. It is still the only officially endorsed browser for the Tor network for iOS. Users should exercise caution when using the browser and check for any DNS leaks.</strong></p>
<p>While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project<ahref="#fn311"class="footnote-ref"id="fnref311"><sup>311</sup></a>.</p>
<p>While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project<ahref="#fn307"class="footnote-ref"id="fnref307"><sup>307</sup></a>.</p>
<ul>
<li><p>Head over to <ahref="https://apps.apple.com/us/app/onion-browser/id519296448"class="uri">https://apps.apple.com/us/app/onion-browser/id519296448</a></p></li>
<li><p>Install</p></li>
@@ -1713,17 +1691,17 @@
<li><p>You have very low IT skills</p></li>
<li><p>You decide to go with Tails anyway</p></li>
</ul>
<p>Tails<ahref="#fn312"class="footnote-ref"id="fnref312"><sup>312</sup></a> stands for <strong>The Amnesic Incognito Live System</strong>. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network.</p>
<p>Tails<ahref="#fn308"class="footnote-ref"id="fnref308"><sup>308</sup></a> stands for <strong>The Amnesic Incognito Live System</strong>. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network.</p>
<p>You insert the Tails USB key into your laptop, boot from it and you have a full operating system running with privacy and anonymity in mind. As soon as you shut down the computer, everything will be gone unless you saved it somewhere.</p>
<p>Tails is an amazingly straightforward way to get going in no time with what you have and without much learning. It has extensive documentation and tutorials.</p>
<p><strong>WARNING: Tails is not always up to date with their bundled software. And not always up to date with the Tor Browser updates either. You should always make sure you are using the latest version of Tails and you should use extreme caution when using bundled apps within Tails that might be vulnerable to exploits and reveal your location</strong><ahref="#fn313"class="footnote-ref"id="fnref313"><sup>313</sup></a><strong>.</strong></p>
<p><strong>WARNING: Tails is not always up to date with their bundled software. And not always up to date with the Tor Browser updates either. You should always make sure you are using the latest version of Tails and you should use extreme caution when using bundled apps within Tails that might be vulnerable to exploits and reveal your location</strong><ahref="#fn309"class="footnote-ref"id="fnref309"><sup>309</sup></a><strong>.</strong></p>
<p>It does however have some drawbacks:</p>
<ul>
<li><p>Tails uses Tor and therefore you will be using Tor to access any resource on the internet. This alone will make you suspicious to most platforms where you want to create anonymous accounts (this will be explained in more detail later).</p></li>
<li><p>Your ISP (whether it is yours or some public Wi-Fi) will also see that you are using Tor, and this could make you suspicious in itself.</p></li>
<li><p>Tails does not include (natively) some of the software you might want to use later which will complicate things quite a bit if you want to run some specific things (Android Emulators for instance).</p></li>
<li><p>Tails uses Tor Browser which while it is very secure will be detected as well by most platforms and will hinder you in creating anonymous identities on many platforms.</p></li>
<li><p>Tails will not protect you more from the 5$ wrench<ahref="#fn314"class="footnote-ref"id="fnref314"><sup>314</sup></a>.</p></li>
<li><p>Tails will not protect you more from the 5$ wrench<ahref="#fn310"class="footnote-ref"id="fnref310"><sup>310</sup></a>.</p></li>
<li><p>Tor in itself might not be enough to protect you from an adversary with enough resources as explained earlier.</p></li>
</ul>
<p><strong>Important Note: If your laptop is monitored/supervised and some local restrictions are in place, please read</strong><ahref="#appendix-u-how-to-bypass-some-local-restrictions-on-supervised-computers">Appendix U: How to bypass (some) local restrictions on supervised computers</a><strong>.</strong></p>
@@ -1758,7 +1736,7 @@
<p>When you are done and have a working Tails on your laptop, go to the <ahref="#creating-your-anonymous-online-identities">Creating your anonymous online identities</a> step much further in this guide or if you want persistence and plausible deniability, continue with the next section.</p>
<h3id="persistent-plausible-deniability-using-whonix-within-tails">Persistent Plausible Deniability using Whonix within Tails:</h3>
<p>Consider checking the <ahref="https://github.com/aforensics/HiddenVM"class="uri">https://github.com/aforensics/HiddenVM</a><sup><ahref="https://web.archive.org/web/https://github.com/aforensics/HiddenVM">[Archive.org]</a></sup> project for Tails.</p>
<p>This project is a clever idea of a one-click self-contained VM solution that you could store on an encrypted disk using plausible deniability<ahref="#fn315"class="footnote-ref"id="fnref315"><sup>315</sup></a> (see <ahref="#the-whonix-route">The Whonix route:</a> first chapters and also for some explanations about Plausible deniability, as well as the <ahref="#how-to-securely-delete-specific-filesfoldersdata-on-your-hddssd-and-thumb-drives">How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives:</a> section at the end of this guide for more understanding).</p>
<p>This project is a clever idea of a one-click self-contained VM solution that you could store on an encrypted disk using plausible deniability<ahref="#fn311"class="footnote-ref"id="fnref311"><sup>311</sup></a> (see <ahref="#the-whonix-route">The Whonix route:</a> first chapters and also for some explanations about Plausible deniability, as well as the <ahref="#how-to-securely-delete-specific-filesfoldersdata-on-your-hddssd-and-thumb-drives">How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives:</a> section at the end of this guide for more understanding).</p>
<p>This would allow the creation of a hybrid system mixing Tails with the Virtualization options of the Whonix route in this guide.</p>
<p>CAUTION: Please see <ahref="#appendix-k-considerations-for-using-external-ssd-drives"><strong>Appendix K: Considerations for using external SSD drives</strong></a> and <ahref="#understanding-hdd-vs-ssd"><strong>Understanding HDD vs SSD</strong></a> sections if you consider storing such hidden VMs on an external SSD drive:</p>
<ul>
<li><p><strong>Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt</strong><ahref="#fn316"class="footnote-ref"id="fnref316"><sup>316</sup></a><strong>.</strong></p></li>
<li><p><strong>Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt</strong><ahref="#fn312"class="footnote-ref"id="fnref312"><sup>312</sup></a><strong>.</strong></p></li>
<li><p><strong>Use instead file containers instead of encrypted volumes.</strong></p></li>
<li><p><strong>Make sure you do know how to clean data from an external SSD drive properly.</strong></p></li>
</ul>
@@ -1831,7 +1809,7 @@
<ul>
<li><p>Better custom Secure Boot <strong>settings (where you can selectively manage all the keys and not just use the Standard ones)</strong></p></li>
<li><p>HDD/SSD passwords in addition to just BIOS/UEFI passwords.</p></li>
<li><p>AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any “evil” functionalities<ahref="#fn317"class="footnote-ref"id="fnref317"><sup>317</sup></a>. However, if you are going for the Qubes OS Route consider Intel CPUs as Qubes OS does not support AMD with their anti-evil-maid system<ahref="#fn318"class="footnote-ref"id="fnref318"><sup>318</sup></a>.</p></li>
<li><p>AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any “evil” functionalities<ahref="#fn313"class="footnote-ref"id="fnref313"><sup>313</sup></a>. However, if you are going for the Qubes OS Route consider Intel CPUs as Qubes OS does not support AMD with their anti-evil-maid system<ahref="#fn314"class="footnote-ref"id="fnref314"><sup>314</sup></a>.</p></li>
<li><p>Secure Wipe tools from the BIOS (especially useful for SSD/NVMe drives, see <ahref="#appendix-m-biosuefi-options-to-wipe-disks-in-various-brands">Appendix M: BIOS/UEFI options to wipe disks in various Brands</a>).</p></li>
<li><p>Better control over the disabling/enabling of select peripherals (USB ports, Wi-Fis, Bluetooth, Camera, Microphone …).</p></li>
<li><p>Better security features with Virtualization.</p></li>
@@ -1859,13 +1837,13 @@
<li><p>Disable USB/HDMI or any other port (Ethernet, Firewire, SD card …) if you can.</p></li>
<li><p>Disable Intel ME if you can (odds are very high you can’t).</p></li>
<li><p>Disable AMD PSP if you can (AMD’s equivalent to IME, see <ahref="#your-cpu">Your CPU</a>)</p></li>
<li><p>Disable Secure Boot if you intend to use Qubes OS as they do not support it out of the box<ahref="#fn319"class="footnote-ref"id="fnref319"><sup>319</sup></a>. Keep it on if you intend to use Linux/Windows.</p></li>
<li><p>Disable Secure Boot if you intend to use Qubes OS as they do not support it out of the box<ahref="#fn315"class="footnote-ref"id="fnref315"><sup>315</sup></a>. Keep it on if you intend to use Linux/Windows.</p></li>
<li><p>Check if your laptop BIOS has a secure erase option for your HDD/SSD that could be convenient in case of need.</p></li>
</ul>
<p>Only enable those on a “need to use” basis and disable them again after use. This can help mitigate some attacks in case your laptop is seized while locked but still on OR if you had to shut it down rather quickly and someone took possession of it (this topic will be explained later in this guide).</p>
<h5id="about-secure-boot">About Secure boot:</h5>
<p>So, what is Secure Boot<ahref="#fn320"class="footnote-ref"id="fnref320"><sup>320</sup></a>? In short, it is a UEFI security feature designed to prevent your computer from booting an operating system from which the bootloader was not signed by specific keys stored in the UEFI firmware of your laptop.</p>
<p>When the operating system (or the Bootloader<ahref="#fn321"class="footnote-ref"id="fnref321"><sup>321</sup></a>) supports it, you can store the keys of your bootloader in your UEFI firmware, and this will prevent booting up any unauthorized Operating System (such as a live OS USB or anything similar).</p>
<p>So, what is Secure Boot<ahref="#fn316"class="footnote-ref"id="fnref316"><sup>316</sup></a>? In short, it is a UEFI security feature designed to prevent your computer from booting an operating system from which the bootloader was not signed by specific keys stored in the UEFI firmware of your laptop.</p>
<p>When the operating system (or the Bootloader<ahref="#fn317"class="footnote-ref"id="fnref317"><sup>317</sup></a>) supports it, you can store the keys of your bootloader in your UEFI firmware, and this will prevent booting up any unauthorized Operating System (such as a live OS USB or anything similar).</p>
<p>Secure Boot settings are protected by the password you set up to access the BIOS/UEFI settings. If you have that password, you can disable Secure Boot and allow unsigned OSes to boot on your system. This can help mitigate some Evil-Maid attacks (explained later in this guide).</p>
<p>In most cases, Secure Boot is disabled by default or is enabled but in “setup” mode which will allow any system to boot. For Secure Boot to work, your Operating System will have to support it and then sign its bootloader and push those signing keys to your UEFI firmware. After that, you will have to go to your BIOS/UEFI settings and save those pushed keys from your OS and change the Secure Boot from setup to user mode (or custom mode in some cases).</p>
<p>After doing that step, only the Operating Systems from which your UEFI firmware can verify the integrity of the bootloader will be able to boot.</p>
@@ -1890,9 +1868,9 @@
<p>You should also enable firmware password reset protection (available from Catalina) according to the documentation here: <ahref="https://support.apple.com/en-gb/guide/security/sec28382c9ca/web"class="uri">https://support.apple.com/en-gb/guide/security/sec28382c9ca/web</a><sup><ahref="https://web.archive.org/web/https://support.apple.com/en-gb/guide/security/sec28382c9ca/web">[Archive.org]</a></sup></p>
<p>This feature will mitigate the possibility for some adversaries to use hardware hacks to disable/bypass your firmware password. Note that this will also prevent Apple themselves from accessing the firmware in case of repair.</p>
<h3id="physically-tamper-protect-your-laptop">Physically Tamper protect your laptop:</h3>
<p>At some point, you will inevitably leave this laptop alone somewhere. You will not sleep with it and take it everywhere every single day. You should make it as hard as possible for anyone to tamper with it without you noticing it. This is mostly useful against some limited adversaries that will not use a 5$ wrench against you<ahref="#fn322"class="footnote-ref"id="fnref322"><sup>322</sup></a>.</p>
<p>At some point, you will inevitably leave this laptop alone somewhere. You will not sleep with it and take it everywhere every single day. You should make it as hard as possible for anyone to tamper with it without you noticing it. This is mostly useful against some limited adversaries that will not use a 5$ wrench against you<ahref="#fn318"class="footnote-ref"id="fnref318"><sup>318</sup></a>.</p>
<p>It is important to know that it is trivially easy for some specialists to install a key logger in your laptop, or to just make a clone copy of your hard drive that could later allow them to detect the presence of encrypted data in it using forensic techniques (more on that later).</p>
<p>Here is a good cheap method to make your laptop tamper-proof using Nail Polish (with glitter) <ahref="https://mullvad.net/en/help/how-tamper-protect-laptop/"class="uri">https://mullvad.net/en/help/how-tamper-protect-laptop/</a><sup><ahref="https://web.archive.org/web/https://mullvad.net/en/help/how-tamper-protect-laptop/">[Archive.org]</a></sup><ahref="#fn323"class="footnote-ref"id="fnref323"><sup>323</sup></a> (with pictures).</p>
<p>Here is a good cheap method to make your laptop tamper-proof using Nail Polish (with glitter) <ahref="https://mullvad.net/en/help/how-tamper-protect-laptop/"class="uri">https://mullvad.net/en/help/how-tamper-protect-laptop/</a><sup><ahref="https://web.archive.org/web/https://mullvad.net/en/help/how-tamper-protect-laptop/">[Archive.org]</a></sup><ahref="#fn319"class="footnote-ref"id="fnref319"><sup>319</sup></a> (with pictures).</p>
<p>While this is a good cheap method, it could also raise suspicions as it is quite “noticeable” and might just reveal that you “have something to hide”. So, there are more subtle ways of achieving the same result. You could also for instance make a close-up macro photography of the back screws of your laptop or just use a small amount of candle wax within one of the screws that could just look like usual dirt. You could then check for tampering by comparing the photographs of the screws with new ones. Their orientation might have changed a bit if your adversary was not careful enough (Tightening them exactly the same way they were before). Or the wax within the bottom of a screw head might have been damaged compared to before.</p>
<p>In riskier environments, check your laptop for tampering before using it regularly.</p>
<h2id="the-whonix-route">The Whonix route:</h2>
<h3id="picking-your-host-os-the-os-installed-on-your-laptop">Picking your Host OS (the OS installed on your laptop):</h3>
<p>This route will make extensive use of Virtual Machines<ahref="#fn324"class="footnote-ref"id="fnref324"><sup>324</sup></a>, they will require a host OS to run the Virtualization software. You have three recommended choices in this part of the guide:</p>
<p>This route will make extensive use of Virtual Machines<ahref="#fn320"class="footnote-ref"id="fnref320"><sup>320</sup></a>, they will require a host OS to run the Virtualization software. You have three recommended choices in this part of the guide:</p>
<ul>
<li><p>Your Linux distribution of choice (excluding Qubes OS)</p></li>
<li><p>Windows 10/11 (preferably Home edition due to the absence of Bitlocker)</p></li>
<li><p>macOS (Catalina or higher up to Monterey)</p></li>
</ul>
<p>In addition, chances are high that your Mac is or has been tied to an Apple account (at the time of purchase or after signing-in) and therefore its unique hardware identifiers could lead back to you in case of hardware identifiers leak.</p>
<p>Linux is also not necessarily the best choice for anonymity depending on your threat model. This is because using Windows will allow us to <strong>conveniently</strong> use Plausible Deniability<ahref="#fn325"class="footnote-ref"id="fnref325"><sup>325</sup></a> (aka Deniable Encryption<ahref="#fn326"class="footnote-ref"id="fnref326"><sup>326</sup></a>) easily at the OS level. Windows is also unfortunately at the same time a privacy nightmare<ahref="#fn327"class="footnote-ref"id="fnref327"><sup>327</sup></a> but is the only easy to set up option for using OS-wide plausible deniability. Windows telemetry and telemetry blocking are also widely documented which should mitigate many issues.</p>
<p><strong>So, what is Plausible Deniability?</strong> You can cooperate with an adversary requesting access to your device/data without revealing your true secret. All this using Deniable Encryption<ahref="#fn328"class="footnote-ref"id="fnref328"><sup>328</sup></a>.</p>
<p>A soft lawful adversary could ask for your encrypted laptop password. At first, you could refuse to give out any password (using your “right to remain silent”, “right not to incriminate yourself”) but some countries are implementing laws<ahref="#fn329"class="footnote-ref"id="fnref329"><sup>329</sup></a>’<ahref="#fn330"class="footnote-ref"id="fnref330"><sup>330</sup></a> to exempt this from such rights (because terrorists and “think of the children”). In that case, you might have to reveal the password or face jail time in contempt of court. This is where plausible deniability will come into play.</p>
<p>Linux is also not necessarily the best choice for anonymity depending on your threat model. This is because using Windows will allow us to <strong>conveniently</strong> use Plausible Deniability<ahref="#fn321"class="footnote-ref"id="fnref321"><sup>321</sup></a> (aka Deniable Encryption<ahref="#fn322"class="footnote-ref"id="fnref322"><sup>322</sup></a>) easily at the OS level. Windows is also unfortunately at the same time a privacy nightmare<ahref="#fn323"class="footnote-ref"id="fnref323"><sup>323</sup></a> but is the only easy to set up option for using OS-wide plausible deniability. Windows telemetry and telemetry blocking are also widely documented which should mitigate many issues.</p>
<p><strong>So, what is Plausible Deniability?</strong> You can cooperate with an adversary requesting access to your device/data without revealing your true secret. All this using Deniable Encryption<ahref="#fn324"class="footnote-ref"id="fnref324"><sup>324</sup></a>.</p>
<p>A soft lawful adversary could ask for your encrypted laptop password. At first, you could refuse to give out any password (using your “right to remain silent”, “right not to incriminate yourself”) but some countries are implementing laws<ahref="#fn325"class="footnote-ref"id="fnref325"><sup>325</sup></a>’<ahref="#fn326"class="footnote-ref"id="fnref326"><sup>326</sup></a> to exempt this from such rights (because terrorists and “think of the children”). In that case, you might have to reveal the password or face jail time in contempt of court. This is where plausible deniability will come into play.</p>
<p>You could then reveal a password, but that password will only give access to “plausible data” (a decoy OS). The forensics will be well aware that it is possible for you to have hidden data but should not be able to prove this <strong>(if you do this right)</strong>. You will have cooperated, and the investigators will have access to something but not what you actually want to hide. Since the burden of proof should lie on their side, they will have no options but to believe you unless they have proof that you have hidden data.</p>
<p>This feature can be used at the OS level (a plausible OS and a hidden OS) or at the files level where you will have an encrypted file container (similar to a zip file) where different files will be shown depending on the encryption password you use.</p>
<p>This also means you could set up your own advanced “plausible deniability” setup using any Host OS by storing for instance Virtual Machines on a Veracrypt hidden volume container (be careful of traces in the Host OS tho that would need to be cleaned if the host OS is persistent, see <ahref="#some-additional-measures-against-forensics">Some additional measures against forensics</a> section later). There is a project for achieving this within Tails (<ahref="https://github.com/aforensics/HiddenVM"class="uri">https://github.com/aforensics/HiddenVM</a><sup><ahref="https://web.archive.org/web/https://github.com/aforensics/HiddenVM">[Archive.org]</a></sup>) which would make your Host OS non-persistent and use plausible deniability within Tails.</p>
<p>In the case of Windows, plausible deniability is also the reason you should ideally have Windows 10/11 Home (and not Pro). This is because Windows 10/11 Pro natively offers a full-disk encryption system (Bitlocker<ahref="#fn331"class="footnote-ref"id="fnref331"><sup>331</sup></a>) where Windows 10/11 Home offers no full-disk encryption at all. You will later use third-party open-source software for encryption that will allow full-disk encryption on Windows 10/11 Home. This will give you a good (plausible) excuse to use this software. While using this software on Windows 10/11 Pro would be suspicious.</p>
<p>In the case of Windows, plausible deniability is also the reason you should ideally have Windows 10/11 Home (and not Pro). This is because Windows 10/11 Pro natively offers a full-disk encryption system (Bitlocker<ahref="#fn327"class="footnote-ref"id="fnref327"><sup>327</sup></a>) where Windows 10/11 Home offers no full-disk encryption at all. You will later use third-party open-source software for encryption that will allow full-disk encryption on Windows 10/11 Home. This will give you a good (plausible) excuse to use this software. While using this software on Windows 10/11 Pro would be suspicious.</p>
<p><strong>Note about Linux:</strong> So, what about Linux and plausible deniability? Yes, it is possible to achieve plausible deniability with Linux too. More information within the Linux Host OS section later.</p>
<p>Unfortunately, encryption is not magic and there are some risks involved:</p>
<h4id="threats-with-encryption">Threats with encryption:</h4>
@@ -1926,7 +1904,7 @@
<p>Plausible deniability is only effective against soft lawful adversaries that will not resort to physical means. <strong>Avoid, if possible, the use of plausible deniability-capable software (such as Veracrypt) if your threat model includes hard adversaries. So, Windows users should in that case install Windows Pro as a Host OS and use Bitlocker instead.</strong></p>
<p>Evil Maid Attacks<ahref="#fn332"class="footnote-ref"id="fnref332"><sup>332</sup></a> are conducted when someone tampers with your laptop while you are away. To install to clone your hard drive, install malware or a key logger. If they can clone your hard drive, they can compare one image of your hard drive at the time they took it while you were away with the hard drive when they seize it from you. If you used the laptop again in between, forensics examiners might be able to prove the existence of the hidden data by looking at the variations between the two images in what should be an empty/unused space. This could lead to compelling evidence of the existence of hidden data. If they install a key logger or malware within your laptop (software or hardware), they will be able to simply get the password from you for later use when they seize it. Such attacks can be done at your home, your hotel, a border crossing, or anywhere you leave your devices unattended.</p>
<p>Evil Maid Attacks<ahref="#fn328"class="footnote-ref"id="fnref328"><sup>328</sup></a> are conducted when someone tampers with your laptop while you are away. To install to clone your hard drive, install malware or a key logger. If they can clone your hard drive, they can compare one image of your hard drive at the time they took it while you were away with the hard drive when they seize it from you. If you used the laptop again in between, forensics examiners might be able to prove the existence of the hidden data by looking at the variations between the two images in what should be an empty/unused space. This could lead to compelling evidence of the existence of hidden data. If they install a key logger or malware within your laptop (software or hardware), they will be able to simply get the password from you for later use when they seize it. Such attacks can be done at your home, your hotel, a border crossing, or anywhere you leave your devices unattended.</p>
<p>You can mitigate this attack by doing the following (as recommended earlier):</p>
<ul>
<li><p>Have basic tamper protection (as explained previously) to prevent physical access to the internals of the laptop without your knowing. This will prevent them from cloning your disks and installing a physical key logger without your knowledge.</p></li>
@@ -1935,14 +1913,14 @@
<li><p>Some OSes and Encryption software have the <ahref="#anti-evil-maid-aem">Anti Evil Maid (AEM)</a> protection that can be enabled. This is the case with Windows/Veracrypt and QubeOS (only on Intel CPUs).</p></li>
</ul>
<h5id="cold-boot-attack">Cold-Boot Attack:</h5>
<p>Cold Boot attacks<ahref="#fn333"class="footnote-ref"id="fnref333"><sup>333</sup></a> are trickier than the Evil Maid Attack but can be part of an Evil Maid attack as it requires an adversary to come into possession of your laptop while you are actively using your device or shortly afterward.</p>
<p>The idea is rather simple, as shown in this video<ahref="#fn334"class="footnote-ref"id="fnref334"><sup>334</sup></a>, an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and “cool down” the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.</p>
<p>In the case of Plausible Deniability, there have been some forensics studies<ahref="#fn335"class="footnote-ref"id="fnref335"><sup>335</sup></a> about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies<ahref="#fn336"class="footnote-ref"id="fnref336"><sup>336</sup></a> and by the maintainer of Veracrypt<ahref="#fn337"class="footnote-ref"id="fnref337"><sup>337</sup></a> so we would not worry too much about those yet.</p>
<p>Cold Boot attacks<ahref="#fn329"class="footnote-ref"id="fnref329"><sup>329</sup></a> are trickier than the Evil Maid Attack but can be part of an Evil Maid attack as it requires an adversary to come into possession of your laptop while you are actively using your device or shortly afterward.</p>
<p>The idea is rather simple, as shown in this video<ahref="#fn330"class="footnote-ref"id="fnref330"><sup>330</sup></a>, an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and “cool down” the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.</p>
<p>In the case of Plausible Deniability, there have been some forensics studies<ahref="#fn331"class="footnote-ref"id="fnref331"><sup>331</sup></a> about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies<ahref="#fn332"class="footnote-ref"id="fnref332"><sup>332</sup></a> and by the maintainer of Veracrypt<ahref="#fn333"class="footnote-ref"id="fnref333"><sup>333</sup></a> so we would not worry too much about those yet.</p>
<p>The same measures used to mitigate Evil Maid attacks should be in place for Cold Boot attacks with some added ones:</p>
<ul>
<li><p>If your OS or Encryption software allows it, you should consider encrypting the keys within RAM too (this is possible with Windows/Veracrypt and will be explained later). Again see <ahref="https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/"class="uri">https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/</a><sup><ahref="https://web.archive.org/web/https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/">[Archive.org]</a></sup></p></li>
<li><p>Do enable the option to Wipe keys from memory if a device is inserted in Veracrypt.</p></li>
<li><p>You should limit the use of Sleep stand-by and instead use Shutdown or Hibernate to prevent the encryption keys from staying in RAM when your computer goes to sleep. This is because sleep will maintain power in your memory for resuming your activity faster. Only hibernation and shutdown will actually clear the key from the memory<ahref="#fn338"class="footnote-ref"id="fnref338"><sup>338</sup></a>.</p></li>
<li><p>You should limit the use of Sleep stand-by and instead use Shutdown or Hibernate to prevent the encryption keys from staying in RAM when your computer goes to sleep. This is because sleep will maintain power in your memory for resuming your activity faster. Only hibernation and shutdown will actually clear the key from the memory<ahref="#fn334"class="footnote-ref"id="fnref334"><sup>334</sup></a>.</p></li>
</ul>
<p>See also <ahref="https://www.whonix.org/wiki/Cold_Boot_Attack_Defense"class="uri">https://www.whonix.org/wiki/Cold_Boot_Attack_Defense</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Cold_Boot_Attack_Defense">[Archive.org]</a></sup> and <ahref="https://www.whonix.org/wiki/Protection_Against_Physical_Attacks"class="uri">https://www.whonix.org/wiki/Protection_Against_Physical_Attacks</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Protection_Against_Physical_Attacks">[Archive.org]</a></sup></p>
<p>Here are also some interesting tools to consider for Linux users to defend against these:</p>
@@ -1964,14 +1942,14 @@
<p>Here are some examples of such leaks:</p>
<h6id="windows">Windows:</h6>
<ul>
<li><p>Windows ShellBags that are stored within the Windows Registry silently storing various histories of accessed volumes/files/folders<ahref="#fn339"class="footnote-ref"id="fnref339"><sup>339</sup></a>.</p></li>
<li><p>Windows Indexing keeping traces of the files present in your user folder by default<ahref="#fn340"class="footnote-ref"id="fnref340"><sup>340</sup></a>.</p></li>
<li><p>Recent lists (aka Jump Lists) in Windows and various apps keeping traces of recently accessed documents<ahref="#fn341"class="footnote-ref"id="fnref341"><sup>341</sup></a>.</p></li>
<li><p>Windows ShellBags that are stored within the Windows Registry silently storing various histories of accessed volumes/files/folders<ahref="#fn335"class="footnote-ref"id="fnref335"><sup>335</sup></a>.</p></li>
<li><p>Windows Indexing keeping traces of the files present in your user folder by default<ahref="#fn336"class="footnote-ref"id="fnref336"><sup>336</sup></a>.</p></li>
<li><p>Recent lists (aka Jump Lists) in Windows and various apps keeping traces of recently accessed documents<ahref="#fn337"class="footnote-ref"id="fnref337"><sup>337</sup></a>.</p></li>
<li><p>Many more traces in various logs, please see this convenient interesting poster for more insight: <ahref="https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download"class="uri">https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download</a><sup><ahref="https://web.archive.org/web/https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download">[Archive.org]</a></sup></p></li>
</ul>
<h6id="macos">macOS:</h6>
<ul>
<li><p>Gatekeeper<ahref="#fn342"class="footnote-ref"id="fnref342"><sup>342</sup></a> and XProtect keeping track of your download history in a local database and file attributes.</p></li>
<li><p>Gatekeeper<ahref="#fn338"class="footnote-ref"id="fnref338"><sup>338</sup></a> and XProtect keeping track of your download history in a local database and file attributes.</p></li>
<li><p>Spotlight Indexing</p></li>
<li><p>Recent lists in various apps keeping traces of recently accessed documents.</p></li>
<li><p>Temporary folders keeping various traces of App usage and Document usage.</p></li>
@@ -2028,7 +2006,7 @@
</ul>
<p>For other distros, you will have to document yourself, but it will likely be similar. Encryption during install is just much easier in the context of this guide.</p>
<h4id="note-about-plausible-deniability-on-linux">Note about plausible deniability on Linux:</h4>
<p>There are several ways to achieve plausible deniability on Linux<ahref="#fn343"class="footnote-ref"id="fnref343"><sup>343</sup></a> and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux.</p>
<p>There are several ways to achieve plausible deniability on Linux<ahref="#fn339"class="footnote-ref"id="fnref339"><sup>339</sup></a> and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux.</p>
<p>While not supported yet by this guide, it is possible to achieve a form of deniability on Linux using LUKS by using detached LUKS headers. For now, we will redirect you toward this page for more information: <ahref="https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header"class="uri">https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header</a><sup><ahref="https://web.archive.org/web/https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header">[Archive.org]</a></sup></p>
<h5id="the-veracrypt-way">The Veracrypt Way:</h5>
@@ -2169,20 +2147,20 @@
<p>See <ahref="#appendix-b-windows-additional-privacy-settings">Appendix B: Windows Additional Privacy Settings</a></p>
<h5id="windows-host-os-encryption">Windows Host OS encryption:</h5>
<h6id="if-you-intend-to-use-system-wide-plausible-deniability">If you intend to use system-wide plausible deniability:</h6>
<p>Veracrypt<ahref="#fn344"class="footnote-ref"id="fnref344"><sup>344</sup></a> is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:</p>
<p>Veracrypt<ahref="#fn340"class="footnote-ref"id="fnref340"><sup>340</sup></a> is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:</p>
<ul>
<li><p>Full Disk simple encryption (your hard drive is encrypted with one passphrase).</p></li>
<li><p>Full Disk encryption with plausible deniability (this means that depending on the passphrase entered at boot, you will either boot a decoy OS or a hidden OS).</p></li>
<li><p>File container simple encryption (it is a large file that you will be able to mount within Veracrypt as if it were an external drive to store encrypted files within).</p></li>
<li><p>File container with plausible deniability (it is the same large file but depending on the passphrase you use when mounting it, you will either mount a “hidden volume” or the “decoy volume”).</p></li>
</ul>
<p>It is to my knowledge the only (convenient and usable by anyone) free, open-source, and openly audited<ahref="#fn345"class="footnote-ref"id="fnref345"><sup>345</sup></a> encryption software that also provides plausible deniability for widespread use and it works with Windows Home Edition.</p>
<p>It is to my knowledge the only (convenient and usable by anyone) free, open-source, and openly audited<ahref="#fn341"class="footnote-ref"id="fnref341"><sup>341</sup></a> encryption software that also provides plausible deniability for widespread use and it works with Windows Home Edition.</p>
<p>Go ahead and download and install Veracrypt from: <ahref="https://www.veracrypt.fr/en/Downloads.html"class="uri">https://www.veracrypt.fr/en/Downloads.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Downloads.html">[Archive.org]</a></sup></p>
<p>After installation, please take a moment to review the following options that will help mitigate some attacks:</p>
<ul>
<li><p>Encrypt the memory with a Veracrypt option<ahref="#fn346"class="footnote-ref"id="fnref346"><sup>346</sup></a> (settings > performance/driver options > encrypt RAM) at a cost of 5-15% performance. This setting will also disable hibernation (which does not actively clear the key when hibernating) and instead encrypt the memory altogether to mitigate some cold-boot attacks. More details about this feature here: <ahref="https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/"class="uri">https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/</a><sup><ahref="https://web.archive.org/web/https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/">[Archive.org]</a></sup></p></li>
<li><p>Encrypt the memory with a Veracrypt option<ahref="#fn342"class="footnote-ref"id="fnref342"><sup>342</sup></a> (settings > performance/driver options > encrypt RAM) at a cost of 5-15% performance. This setting will also disable hibernation (which does not actively clear the key when hibernating) and instead encrypt the memory altogether to mitigate some cold-boot attacks. More details about this feature here: <ahref="https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/"class="uri">https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/</a><sup><ahref="https://web.archive.org/web/https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/">[Archive.org]</a></sup></p></li>
<li><p>Enable the Veracrypt option to wipe the keys from memory if a new device is inserted (system > settings > security > clear keys from memory if a new device is inserted). This could help in case your system is seized while still on (but locked).</p></li>
<li><p>Enable the Veracrypt option to mount volumes as removable volumes (Settings > Preferences > Mount volume as removable media). This will prevent Windows from writing some logs about your mounts in the Event logs<ahref="#fn347"class="footnote-ref"id="fnref347"><sup>347</sup></a> and prevent some local data leaks.</p></li>
<li><p>Enable the Veracrypt option to mount volumes as removable volumes (Settings > Preferences > Mount volume as removable media). This will prevent Windows from writing some logs about your mounts in the Event logs<ahref="#fn343"class="footnote-ref"id="fnref343"><sup>343</sup></a> and prevent some local data leaks.</p></li>
<li><p>Be careful and have a good situational awareness if you sense something weird. Shut your laptop down as fast as possible.</p></li>
</ul>
<p>If you do not want to use encrypted memory (because performance might be an issue), you should at least enable hibernation instead of sleep. This will not clear the keys from memory (you are still vulnerable to cold boot attacks) but at least should mitigate them if your memory has enough time to decay.</p>
@@ -2208,8 +2186,8 @@
</ul></li>
<li><p>Encryption should now be started in the background (you can check by clicking the Bitlocker icon on the lower right side of the taskbar).</p></li>
</ul>
<p>Unfortunately, this is not enough. With this setup, your Bitlocker key can just be stored as-is in the TPM chip of your computer. This is rather problematic as the key can be extracted in some cases with ease<ahref="#fn348"class="footnote-ref"id="fnref348"><sup>348</sup></a>‘<ahref="#fn349"class="footnote-ref"id="fnref349"><sup>349</sup></a>’<ahref="#fn350"class="footnote-ref"id="fnref350"><sup>350</sup></a>’<ahref="#fn351"class="footnote-ref"id="fnref351"><sup>351</sup></a>.</p>
<p>To mitigate this, you will have to enable a few more options as per the recommendations of Microsoft<ahref="#fn352"class="footnote-ref"id="fnref352"><sup>352</sup></a>:</p>
<p>Unfortunately, this is not enough. With this setup, your Bitlocker key can just be stored as-is in the TPM chip of your computer. This is rather problematic as the key can be extracted in some cases with ease<ahref="#fn344"class="footnote-ref"id="fnref344"><sup>344</sup></a>‘<ahref="#fn345"class="footnote-ref"id="fnref345"><sup>345</sup></a>’<ahref="#fn346"class="footnote-ref"id="fnref346"><sup>346</sup></a>’<ahref="#fn347"class="footnote-ref"id="fnref347"><sup>347</sup></a>.</p>
<p>To mitigate this, you will have to enable a few more options as per the recommendations of Microsoft<ahref="#fn348"class="footnote-ref"id="fnref348"><sup>348</sup></a>:</p>
<ul>
<li><p>Click the Windows icon</p></li>
<li><p>Type Run</p></li>
@@ -2321,7 +2299,7 @@
<li><p>Requires Windows (this feature is not “easily” supported on Linux).</p></li>
<li><p>The danger of online Data leaks</p></li>
<li><p>Requires full wipe of your laptop</p></li>
<li><p>No use with an SSD drive due to the requirement of disabling Trim<ahref="#fn353"class="footnote-ref"id="fnref353"><sup>353</sup></a> Operations<ahref="#fn354"class="footnote-ref"id="fnref354"><sup>354</sup></a>. This will severely degrade the performance/health of your SSD drive over time.</p></li>
<li><p>No use with an SSD drive due to the requirement of disabling Trim<ahref="#fn349"class="footnote-ref"id="fnref349"><sup>349</sup></a> Operations<ahref="#fn350"class="footnote-ref"id="fnref350"><sup>350</sup></a>. This will severely degrade the performance/health of your SSD drive over time.</p></li>
</ul></li>
</ul></li>
</ul>
@@ -2350,11 +2328,11 @@
<li><p>Enter a strong passphrase (longer the better, remember <ahref="#appendix-a2-guidelines-for-passwords-and-passphrases">Appendix A2: Guidelines for passwords and passphrases</a>)</p></li>
<li><p>Collect some entropy by randomly moving your cursor around until the bar is full</p></li>
<li><p>Click Next as the Generated Keys screen</p></li>
<li><p>To rescue disk<ahref="#fn355"class="footnote-ref"id="fnref355"><sup>355</sup></a> or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it.</p></li>
<li><p>To rescue disk<ahref="#fn351"class="footnote-ref"id="fnref351"><sup>351</sup></a> or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it.</p></li>
<li><p>Wipe mode:</p>
<ul>
<li><p>If you have no sensitive data yet on this laptop, select None</p></li>
<li><p>If you have sensitive data on an SSD, Trim alone should take care of it<ahref="#fn356"class="footnote-ref"id="fnref356"><sup>356</sup></a> but we would recommend one pass (random data) just to be sure.</p></li>
<li><p>If you have sensitive data on an SSD, Trim alone should take care of it<ahref="#fn352"class="footnote-ref"id="fnref352"><sup>352</sup></a> but we would recommend one pass (random data) just to be sure.</p></li>
<li><p>If you have sensitive data on an HDD, there is no Trim, and we Swould recommend at least 1-pass.</p></li>
</ul></li>
<li><p>Test your setup. Veracrypt will now reboot your system to test the bootloader before encryption. This test must pass for encryption to go forward.</p></li>
@@ -2386,7 +2364,7 @@
<li><p>Wipe your currently running Windows 10/11.</p></li>
<li><p>This means that your current Windows 10/11 will become the hidden Windows 10/11 and that you will need to reinstall a fresh decoy Windows 10/11 OS.</p></li>
</ul>
<p><strong>Mandatory if you have an SSD drive and you still want to do this against the recommendation: Disable SSD Trim in Windows</strong><ahref="#fn357"class="footnote-ref"id="fnref357"><sup>357</sup></a><strong>(again this is NOT recommended at all as</strong><strong>disabling Trim in itself is highly suspicious</strong>). <strong>Also</strong><strong>as mentioned earlier, disabling Trim will reduce the lifetime of your SSD drive and will significantly impact its performance over time (your laptop will become slower and slower over several months of use until it becomes almost unusable, you will then have to clean the drive and re-install everything). But you must do it to prevent data leaks</strong><ahref="#fn358"class="footnote-ref"id="fnref358"><sup>358</sup></a><strong>that could allow forensics to defeat your plausible deniability</strong><ahref="#fn359"class="footnote-ref"id="fnref359"><sup>359</sup></a><ahref="#fn360"class="footnote-ref"id="fnref360"><sup>360</sup></a><strong>. The only way around this at the moment is to have a laptop with a classic HDD drive instead.</strong></p>
<p><strong>Mandatory if you have an SSD drive and you still want to do this against the recommendation: Disable SSD Trim in Windows</strong><ahref="#fn353"class="footnote-ref"id="fnref353"><sup>353</sup></a><strong>(again this is NOT recommended at all as</strong><strong>disabling Trim in itself is highly suspicious</strong>). <strong>Also</strong><strong>as mentioned earlier, disabling Trim will reduce the lifetime of your SSD drive and will significantly impact its performance over time (your laptop will become slower and slower over several months of use until it becomes almost unusable, you will then have to clean the drive and re-install everything). But you must do it to prevent data leaks</strong><ahref="#fn354"class="footnote-ref"id="fnref354"><sup>354</sup></a><strong>that could allow forensics to defeat your plausible deniability</strong><ahref="#fn355"class="footnote-ref"id="fnref355"><sup>355</sup></a><ahref="#fn356"class="footnote-ref"id="fnref356"><sup>356</sup></a><strong>. The only way around this at the moment is to have a laptop with a classic HDD drive instead.</strong></p>
<h6id="step-1-create-a-windows-1011-install-usb-key">Step 1: Create a Windows 10/11 install USB key</h6>
<p>See [Appendix C: Windows Installation Media Creation][306] and go with the USB key route.</p>
<h6id="step-2-boot-the-usb-key-and-start-the-windows-1011-install-process-hidden-os">Step 2: Boot the USB key and start the Windows 10/11 install process (Hidden OS)</h6>
@@ -2455,7 +2433,7 @@
<li><p>Enter a short weak password (yes this is serious, do it, it will be explained later).</p></li>
<li><p>Collect some entropy by randomly moving your cursor around until the bar is full</p></li>
<li><p>Click Next as the Generated Keys screen</p></li>
<li><p>To rescue disk<ahref="#fn361"class="footnote-ref"id="fnref361"><sup>361</sup></a> or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it.</p></li>
<li><p>To rescue disk<ahref="#fn357"class="footnote-ref"id="fnref357"><sup>357</sup></a> or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it.</p></li>
<li><p>Wipe mode: Select 1-Pass just to be safe</p></li>
<li><p>Pre-Test your setup. Veracrypt will now reboot your system to test the bootloader before encryption. This test must pass for encryption to go forward.</p></li>
<li><p>After your computer rebooted and the test is passed. You will be prompted by Veracrypt to start the encryption process.</p></li>
@@ -2529,8 +2507,8 @@
<h3id="virtualbox-on-your-host-os">Virtualbox on your Host OS:</h3>
<p>This step and the following steps should be done from within the Host OS. This can either be your Host OS with simple encryption (Windows/Linux/macOS) or your Hidden OS with plausible deniability (Windows only).</p>
<p>In this route, you will make extensive use of the free Oracle Virtualbox<ahref="#fn362"class="footnote-ref"id="fnref362"><sup>362</sup></a> software. This is a virtualization software in which you can create Virtual Machines that emulate a computer running a specific OS (if you want to use something else like Xen, Qemu, KVM, or VMWARE, feel free to do so but this part of the guide covers Virtualbox only for convenience).</p>
<p>So, you should be aware that Virtualbox is not the virtualization software with the best track record in terms of security. Some of the reported issues<ahref="#fn363"class="footnote-ref"id="fnref363"><sup>363</sup></a> have not been completely fixed to date<ahref="#fn364"class="footnote-ref"id="fnref364"><sup>364</sup></a>. If you are using Linux, and you possess a bit more technical skill, you should consider using KVM instead by following the guide available at Whonix here <ahref="https://www.whonix.org/wiki/KVM"class="uri">https://www.whonix.org/wiki/KVM</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/KVM">[Archive.org]</a></sup> and here <ahref="https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F"class="uri">https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F">[Archive.org]</a></sup></p>
<p>In this route, you will make extensive use of the free Oracle Virtualbox<ahref="#fn358"class="footnote-ref"id="fnref358"><sup>358</sup></a> software. This is a virtualization software in which you can create Virtual Machines that emulate a computer running a specific OS (if you want to use something else like Xen, Qemu, KVM, or VMWARE, feel free to do so but this part of the guide covers Virtualbox only for convenience).</p>
<p>So, you should be aware that Virtualbox is not the virtualization software with the best track record in terms of security. Some of the reported issues<ahref="#fn359"class="footnote-ref"id="fnref359"><sup>359</sup></a> have not been completely fixed to date<ahref="#fn360"class="footnote-ref"id="fnref360"><sup>360</sup></a>. If you are using Linux, and you possess a bit more technical skill, you should consider using KVM instead by following the guide available at Whonix here <ahref="https://www.whonix.org/wiki/KVM"class="uri">https://www.whonix.org/wiki/KVM</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/KVM">[Archive.org]</a></sup> and here <ahref="https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F"class="uri">https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/KVM#Why_Use_KVM_Over_VirtualBox.3F">[Archive.org]</a></sup></p>
<p>Some steps should be taken in all cases:</p>
<p><strong>All your sensitive activities will be done from within a guest Virtual Machine running Windows 10/11 Pro (not Home this time), Linux, or macOS.</strong></p>
<p>This has a few advantages that will help you remain anonymous:</p>
@@ -2588,13 +2566,13 @@
</figure>
<p>If an adversary somehow manages to compromise the Tor network too, they will only reveal the IP of a random public Wi-Fi that is not tied to your identity.</p>
<p>If an adversary somehow compromises your VM OS (with malware or an exploit for instance), they will be trapped within the internal Network of Whonix and should be unable to reveal the IP of the public Wi-Fi.</p>
<p><strong>This solution however has one main drawback to consider: Interference with Tor Stream Isolation</strong><ahref="#fn365"class="footnote-ref"id="fnref365"><sup>365</sup></a>.</p>
<p><strong>This solution however has one main drawback to consider: Interference with Tor Stream Isolation</strong><ahref="#fn361"class="footnote-ref"id="fnref361"><sup>361</sup></a>.</p>
<p>Stream isolation is a mitigation technique used to prevent some correlation attacks by having different Tor Circuits for each application. Here is an illustration to show what stream isolation is:</p>
<p>(Illustration from Marcelo Martins, <ahref="https://stakey.club/en/decred-via-tor-network/"class="uri">https://stakey.club/en/decred-via-tor-network/</a><sup><ahref="https://web.archive.org/web/https://stakey.club/en/decred-via-tor-network/">[Archive.org]</a></sup>)</p>
<p>VPN/Proxy over Tor falls on the right-side<ahref="#fn366"class="footnote-ref"id="fnref366"><sup>366</sup></a> meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases:</p>
<p>VPN/Proxy over Tor falls on the right-side<ahref="#fn362"class="footnote-ref"id="fnref362"><sup>362</sup></a> meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases:</p>
<ul>
<li><p>When your destination service does not allow Tor Exit nodes.</p></li>
<li><p>When you do not mind using a shared Tor circuit for various services. For instance, when using various authenticated services.</p></li>
@@ -2787,7 +2765,7 @@
<p>See <ahref="#appendix-o-getting-an-anonymous-vpnproxy">Appendix O: Getting an anonymous VPN/Proxy</a></p>
<h3id="whonix">Whonix:</h3>
<p><strong>Skip this step if you cannot use Tor.</strong></p>
<p>This route will use Virtualization and Whonix<ahref="#fn367"class="footnote-ref"id="fnref367"><sup>367</sup></a> as part of the anonymization process. Whonix is a Linux distribution composed of two Virtual Machines:</p>
<p>This route will use Virtualization and Whonix<ahref="#fn363"class="footnote-ref"id="fnref363"><sup>363</sup></a> as part of the anonymization process. Whonix is a Linux distribution composed of two Virtual Machines:</p>
<ul>
<li><p>The Whonix Workstation (this is a VM where you can conduct sensitive activities)</p></li>
<li><p>The Whonix Gateway (this VM will establish a connection to the Tor network and route all the network traffic from the Workstation through the Tor network).</p></li>
@@ -2808,9 +2786,9 @@
<p>You will be able to decide which flavor to use based on my recommendations. We recommend the second one as explained before.</p>
<p>Whonix is well maintained and has extensive and incredibly detailed documentation.</p>
<h4id="a-note-on-virtualbox-snapshots">A note on Virtualbox Snapshots:</h4>
<p>Later, you will create and run several Virtual Machines within Virtualbox for your sensitive activities. Virtualbox provides a feature called “Snapshots”<ahref="#fn368"class="footnote-ref"id="fnref368"><sup>368</sup></a> that allow for saving the state of a VM at any point in time. If for any reason later you want to go back to that state, you can restore that snapshot at any moment.</p>
<p>Later, you will create and run several Virtual Machines within Virtualbox for your sensitive activities. Virtualbox provides a feature called “Snapshots”<ahref="#fn364"class="footnote-ref"id="fnref364"><sup>364</sup></a> that allow for saving the state of a VM at any point in time. If for any reason later you want to go back to that state, you can restore that snapshot at any moment.</p>
<p><strong>I strongly recommend that you do make use of this feature by creating a snapshot after the initial installation/update of each VM. This snapshot should be done before its use for any sensitive/anonymous activity.</strong></p>
<p>This will allow you to turn your VMs into a kind of disposable “Live Operating Systems” (like Tails discussed earlier). Meaning that you will be able to erase all the traces of your activities within a VM by restoring a Snapshot to an earlier state. Of course, this will not be “as good” as Tails (where everything is stored in memory) as there might be traces of this activity left on your hard disk. Forensics studies have shown the ability to recover data from a reverted VM<ahref="#fn369"class="footnote-ref"id="fnref369"><sup>369</sup></a>. Fortunately, there will be ways to remove those traces after the deletion or reverting to an earlier snapshot. Such techniques will be discussed in the <ahref="#some-additional-measures-against-forensics">Some additional measures against forensics</a> section of this guide.</p>
<p>This will allow you to turn your VMs into a kind of disposable “Live Operating Systems” (like Tails discussed earlier). Meaning that you will be able to erase all the traces of your activities within a VM by restoring a Snapshot to an earlier state. Of course, this will not be “as good” as Tails (where everything is stored in memory) as there might be traces of this activity left on your hard disk. Forensics studies have shown the ability to recover data from a reverted VM<ahref="#fn365"class="footnote-ref"id="fnref365"><sup>365</sup></a>. Fortunately, there will be ways to remove those traces after the deletion or reverting to an earlier snapshot. Such techniques will be discussed in the <ahref="#some-additional-measures-against-forensics">Some additional measures against forensics</a> section of this guide.</p>
<h4id="download-virtualbox-and-whonix-utilities">Download Virtualbox and Whonix utilities:</h4>
<p>You should download a few things within the host OS:</p>
<p>Also, consider applying these mitigations from VirtualBox to mitigate Spectre<ahref="#fn370"class="footnote-ref"id="fnref370"><sup>370</sup></a>/Meltdown<ahref="#fn371"class="footnote-ref"id="fnref371"><sup>371</sup></a> vulnerabilities by running this command from the VirtualBox Program Directory. All of these are described here: <ahref="https://www.whonix.org/wiki/Spectre_Meltdown"class="uri">https://www.whonix.org/wiki/Spectre_Meltdown</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Spectre_Meltdown">[Archive.org]</a></sup> (be aware these can impact severely the performance of your VMs but should be done for best security).</p>
<p>Also, consider applying these mitigations from VirtualBox to mitigate Spectre<ahref="#fn366"class="footnote-ref"id="fnref366"><sup>366</sup></a>/Meltdown<ahref="#fn367"class="footnote-ref"id="fnref367"><sup>367</sup></a> vulnerabilities by running this command from the VirtualBox Program Directory. All of these are described here: <ahref="https://www.whonix.org/wiki/Spectre_Meltdown"class="uri">https://www.whonix.org/wiki/Spectre_Meltdown</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Spectre_Meltdown">[Archive.org]</a></sup> (be aware these can impact severely the performance of your VMs but should be done for best security).</p>
<p>Finally, consider the security advice from Virtualbox themselves here <ahref="https://www.virtualbox.org/manual/ch13.html"class="uri">https://www.virtualbox.org/manual/ch13.html</a><sup><ahref="https://web.archive.org/web/https://www.virtualbox.org/manual/ch13.html">[Archive.org]</a></sup></p>
<h3id="tor-over-vpn-1">Tor over VPN:</h3>
<p><strong>Skip this step if you do not intend to use Tor over VPN and only intend to use Tor or cannot.</strong></p>
@@ -2875,7 +2853,7 @@
<h4id="whonix-workstation-recommended-and-preferred">Whonix Workstation <strong>(recommended and preferred)</strong>:</h4>
<p><strong>Skip this step if you cannot use Tor.</strong></p>
<p>Just use the provided Whonix Workstation VM. <strong>It is the safest and most secure way to go on this route.</strong></p>
<p><strong>It is also the only VM that will provide Stream Isolation pre-configured for most apps by default</strong><ahref="#fn372"class="footnote-ref"id="fnref372"><sup>372</sup></a><strong>.</strong></p>
<p><strong>It is also the only VM that will provide Stream Isolation pre-configured for most apps by default</strong><ahref="#fn368"class="footnote-ref"id="fnref368"><sup>368</sup></a><strong>.</strong></p>
<p>If you want additional software on the Workstation (such as another Browser), follow their guide here <ahref="https://www.whonix.org/wiki/Install_Software"class="uri">https://www.whonix.org/wiki/Install_Software</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Install_Software">[Archive.org]</a></sup></p>
<p>Consider running Whonix in Live Mode if for extra malware protection, See <ahref="https://www.whonix.org/wiki/Anti-Forensics_Precautions"class="uri">https://www.whonix.org/wiki/Anti-Forensics_Precautions</a><sup><ahref="https://web.archive.org/web/https://www.whonix.org/wiki/Anti-Forensics_Precautions">[Archive.org]</a></sup></p>
<p>Do not forget to apply the VM hardening recommendations here: <ahref="#virtualbox-hardening-recommendations">Virtualbox Hardening recommendations</a>.</p>
@@ -3063,8 +3041,8 @@
<p>See why here: <ahref="#appendix-v-what-browser-to-use-in-your-guest-vmdisposable-vm">Appendix V: What browser to use in your Guest VM/Disposable VM</a></p>
<p>See <ahref="#appendix-v1-hardening-your-browsers">Appendix V1: Hardening your Browsers</a> as well.</p>
<h3id="keepassxc">KeepassXC:</h3>
<p>You will need something to store your data (logins/passwords, identities, and TOTP<ahref="#fn373"class="footnote-ref"id="fnref373"><sup>373</sup></a> information).</p>
<p>For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA<ahref="#fn374"class="footnote-ref"id="fnref374"><sup>374</sup></a> authentication with the authenticator feature.</p>
<p>You will need something to store your data (logins/passwords, identities, and TOTP<ahref="#fn369"class="footnote-ref"id="fnref369"><sup>369</sup></a> information).</p>
<p>For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA<ahref="#fn370"class="footnote-ref"id="fnref370"><sup>370</sup></a> authentication with the authenticator feature.</p>
<p>Remember this should ideally be installed on your Guest VM and not on your Host OS. You should never do any sensitive activities from your Host OS.</p>
<p>Here are the tutorials:</p>
<ul>
@@ -3109,7 +3087,7 @@
<li><p>The Best Way: Using an external USB Wi-Fi dongle and just disabling Wi-Fi on the Host OS/Computer.</p></li>
</ul>
<h4id="the-lazy-way-not-supported-by-whonix-but-it-will-work-if-you-are-in-a-hurry-see-further-for-the-better-way">The Lazy Way (<strong>not supported by Whonix</strong> but it will work if you are in a hurry, see further for the better way):</h4>
<p><strong>This way is not supported by the Whonix project</strong><ahref="#fn375"class="footnote-ref"id="fnref375"><sup>375</sup></a> but I will go ahead and give this option anyway. This is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.</p>
<p><strong>This way is not supported by the Whonix project</strong><ahref="#fn371"class="footnote-ref"id="fnref371"><sup>371</sup></a> but I will go ahead and give this option anyway. This is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.</p>
<p><strong>Note that this option as-is will only work on Wi-Fis without a captive portal (where you must enter some information to unlock access).</strong></p>
<p>The illustration below shows the result of this step:</p>
<figure>
@@ -3421,7 +3399,7 @@
<h2id="the-qubes-route">The Qubes Route:</h2>
<p><strong>Note that the guide has been updated to Qubes OS 4.1</strong></p>
<p>As they say on their website, Qubes OS is a reasonably secure, free, open-source, and security-oriented operating system for single-user desktop computing. Qubes OS leverages and extensively uses Xen-based virtualization to allow for the creation and management of isolated compartments called Qubes.</p>
<p>Qubes OS is not a Linux distribution<ahref="#fn376"class="footnote-ref"id="fnref376"><sup>376</sup></a> but a Xen distribution. It is different from Linux distributions because it will make extensive use of Virtualization and Compartmentalization so that any app will run in a different VM (Qube). As a bonus, Qubes OS integrates Whonix by default and allows for increased privacy and anonymity. It is highly recommended that you document yourself over Qubes OS principles before going this route. Here are some recommended resources:</p>
<p>Qubes OS is not a Linux distribution<ahref="#fn372"class="footnote-ref"id="fnref372"><sup>372</sup></a> but a Xen distribution. It is different from Linux distributions because it will make extensive use of Virtualization and Compartmentalization so that any app will run in a different VM (Qube). As a bonus, Qubes OS integrates Whonix by default and allows for increased privacy and anonymity. It is highly recommended that you document yourself over Qubes OS principles before going this route. Here are some recommended resources:</p>
<ul>
<li><p>Qubes OS Introduction, <ahref="https://www.qubes-os.org/intro/"class="uri">https://www.qubes-os.org/intro/</a><sup><ahref="https://web.archive.org/web/https://www.qubes-os.org/intro/">[Archive.org]</a></sup></p></li>
<li><p>Qubes OS Video Tours, <ahref="https://www.qubes-os.org/video-tours/"class="uri">https://www.qubes-os.org/video-tours/</a><sup><ahref="https://web.archive.org/web/https://www.qubes-os.org/video-tours/">[Archive.org]</a></sup></p></li>
@@ -3483,13 +3461,13 @@
</figure>
<p>If an adversary somehow manages to compromise the Tor network too, they will only reveal the IP of a random public Wi-Fi that is not tied to your identity.</p>
<p>If an adversary somehow compromises your VM OS (with malware or an exploit for instance), they will be trapped within the internal Network of Whonix and should be unable to reveal the IP of the public Wi-Fi.</p>
<p><strong>This solution however has one main drawback to consider: Interference with Tor Stream Isolation</strong><ahref="#fn377"class="footnote-ref"id="fnref377"><sup>377</sup></a>.</p>
<p><strong>This solution however has one main drawback to consider: Interference with Tor Stream Isolation</strong><ahref="#fn373"class="footnote-ref"id="fnref373"><sup>373</sup></a>.</p>
<p>Stream isolation is a mitigation technique used to prevent some correlation attacks by having different Tor Circuits for each application. Here is an illustration to show what stream isolation is:</p>
<p>(Illustration from Marcelo Martins, <ahref="https://stakey.club/en/decred-via-tor-network/"class="uri">https://stakey.club/en/decred-via-tor-network/</a><sup><ahref="https://web.archive.org/web/https://stakey.club/en/decred-via-tor-network/">[Archive.org]</a></sup>)</p>
<p>VPN/Proxy over Tor falls on the right-side<ahref="#fn378"class="footnote-ref"id="fnref378"><sup>378</sup></a> meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases:</p>
<p>VPN/Proxy over Tor falls on the right-side<ahref="#fn374"class="footnote-ref"id="fnref374"><sup>374</sup></a> meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases:</p>
<ul>
<li><p>When your destination service does not allow Tor Exit nodes.</p></li>
<li><p>When you do not mind using a shared Tor circuit for various services. For instance for using various authenticated services.</p></li>
@@ -3698,7 +3676,7 @@
<p>The Qubes master signing key fingerprint should match <code>427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494</code>.</p>
<p><em>Remember to read the guide to verifying signatures on the Qubes website: <ahref="https://www.qubes-os.org/security/verifying-signatures/"class="uri">https://www.qubes-os.org/security/verifying-signatures/</a><sup><ahref="https://web.archive.org/web/20220511015546/https://www.qubes-os.org/security/verifying-signatures/">[Archive.org]</a></sup>.</em></p>
<p>Unfortunately, Qubes OS does not support hibernation<ahref="#fn379"class="footnote-ref"id="fnref379"><sup>379</sup></a> which is an issue regarding cold-boot attacks. To mitigate those, I highly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.</p>
<p>Unfortunately, Qubes OS does not support hibernation<ahref="#fn375"class="footnote-ref"id="fnref375"><sup>375</sup></a> which is an issue regarding cold-boot attacks. To mitigate those, I highly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.</p>
<p><strong>Warning</strong>, this step only works with Intel CPUs, a legacy BIOS, TPM 1.2. If you do not meet those requirements, skip this step.</p>
<p>Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks. Installing and using AEM requires attaching a USB drive directly to dom0. So the user must make a choice between protecting dom0 from a potentially malicious USB drive, and protecting the system from Evil Maid attacks. Note that AEM is only compatible with Intel CPUs and Legacy boot options.</p>
@@ -3756,7 +3734,7 @@
<p>While Qubes OS is already sandboxing everything by design, it is also useful to consider sandboxing apps themselves using AppArmor or SELinux.</p>
<h5id="apparmor">AppArmor:</h5>
<p>“AppArmor is a Mandatory Access Control framework. When enabled, AppArmor confines programs according to a set of rules that specify what files a given program can access. This initiative-taking approach helps protect the system against both known and unknown vulnerabilities” (Debian.org).</p>
<p>Basically, AppArmor<ahref="#fn380"class="footnote-ref"id="fnref380"><sup>380</sup></a> is an application sandboxing system. By default, it is not enabled but supported by Qubes OS.</p>
<p>Basically, AppArmor<ahref="#fn376"class="footnote-ref"id="fnref376"><sup>376</sup></a> is an application sandboxing system. By default, it is not enabled but supported by Qubes OS.</p>
<ul>
<li><p>About the Fedora VMs:</p>
<ul>
@@ -3781,7 +3759,7 @@
</ul></li>
</ul>
<h5id="selinux">SELinux:</h5>
<p>SELinux<ahref="#fn381"class="footnote-ref"id="fnref381"><sup>381</sup></a> is similar to AppArmor. The differences between SELinux and AppArmor are technical details into which we will not get.</p>
<p>SELinux<ahref="#fn377"class="footnote-ref"id="fnref377"><sup>377</sup></a> is similar to AppArmor. The differences between SELinux and AppArmor are technical details into which we will not get.</p>
<p>Here is a good explanation of what it is: <ahref="https://www.youtube.com/watch?v=_WOKRaM-HI4"class="uri">https://www.youtube.com/watch?v=_WOKRaM-HI4</a><sup><ahref="https://yewtu.be/watch?v=_WOKRaM-HI4">[Invidious]</a></sup></p>
<p>In this guide and the context of Qubes OS, it is important to mention it as it is the recommended method by Fedora which is one of the default systems on Qubes OS.</p>
<p>So, head out and read <ahref="https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/"class="uri">https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/</a><sup><ahref="https://web.archive.org/web/https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/">[Archive.org]</a></sup></p>
@@ -4055,8 +4033,8 @@
</ul>
<p>That’s it, you should now have an Android Qube over Tor (or anything else) capable of running pretty much any App you can sideload with ADB. This is, for now, the easiest way to get Android emulation on Qubes OS.</p>
<h3id="keepassxc-1">KeePassXC:</h3>
<p>You will need somewhere to store your data (logins/passwords, identities, and TOTP<ahref="#fn382"class="footnote-ref"id="fnref382"><sup>382</sup></a> information).</p>
<p>For this purpose, KeePassXC is recommended because of its integrated TOTP feature. This is the ability to create entries for 2FA<ahref="#fn383"class="footnote-ref"id="fnref383"><sup>383</sup></a> authentication with the authenticator feature.</p>
<p>You will need somewhere to store your data (logins/passwords, identities, and TOTP<ahref="#fn378"class="footnote-ref"id="fnref378"><sup>378</sup></a> information).</p>
<p>For this purpose, KeePassXC is recommended because of its integrated TOTP feature. This is the ability to create entries for 2FA<ahref="#fn379"class="footnote-ref"id="fnref379"><sup>379</sup></a> authentication with the authenticator feature.</p>
<p>In the context of Qubes OS you should store your sensitive information within the vault Qube:</p>
<ul>
<li><p>First, click the Applications icon (upper left) and select the vault Qube.</p></li>
@@ -4069,7 +4047,7 @@
<p>See their tutorial here: <ahref="https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md"class="uri">https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md</a><sup><ahref="https://web.archive.org/web/https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md">[Archive.org]</a></sup></p>
<h1id="quick-note-correlation-vs-attribution">Quick note: Correlation vs Attribution</h1>
<p><strong>Correlation</strong> is a relationship between two or more variables or <strong><ahref="https://www.digitalshadows.com/blog-and-research/cyber-attacks-the-challenge-of-attribution-and-response/">attributes</a></strong>. How are attributions determined? During digital forensic and incident response (DFIR), analysts typically look for indicators of compromise (IoCs) following events that call them to act. These indicators usually consist of IP addresses, names, databases; all of which can prescribe a certain behavioral “tag” to an individual or group. This is called attribution. A principal in statistics is that “correlation does not infer causality”. What this means is that, while you may leave certain traces on certain areas of a device or network, that only shows presence of action, i.e., not explicitly your presence. It doesn’t show who you are, it only resolves that something occurred and <em>someone</em> has done <em>something</em>.</p>
<p>Attribution is required to prove fault or guilt, and is the prime reason why people using the Tor network to access the dark web have been compromised: they left traces that were shown to be connected to their real identities. Your IP can be — but is usually not — a large enough indicator to attribute guilt. This is shown in the infamous NotPetya cyber attacks against the U.S., which were later also released upon Ukraine. Though the White House never <em>said</em> it was Russia’s doing, they attributed the attack to Russia’s <ahref="https://www.reuters.com/article/us-britain-russia-gru-factbox/what-is-russias-gru-military-intelligence-agency-idUSKCN1MF1VK">(GRU)</a> which is a direct office housing the Russian deniable warfare<ahref="#fn384"class="footnote-ref"id="fnref384"><sup>384</sup></a> cyber divisions, uncommonly referred to as “spy makers” in the intelligence community (IC).</p>
<p>Attribution is required to prove fault or guilt, and is the prime reason why people using the Tor network to access the dark web have been compromised: they left traces that were shown to be connected to their real identities. Your IP can be — but is usually not — a large enough indicator to attribute guilt. This is shown in the infamous NotPetya cyber attacks against the U.S., which were later also released upon Ukraine. Though the White House never <em>said</em> it was Russia’s doing, they attributed the attack to Russia’s <ahref="https://www.reuters.com/article/us-britain-russia-gru-factbox/what-is-russias-gru-military-intelligence-agency-idUSKCN1MF1VK">(GRU)</a> which is a direct office housing the Russian deniable warfare<ahref="#fn380"class="footnote-ref"id="fnref380"><sup>380</sup></a> cyber divisions, uncommonly referred to as “spy makers” in the intelligence community (IC).</p>
<p><em>What is the point</em>, you may ask? Well, bluntly speaking, this a perfect example because NotPetya, which is now undoubtedly the work of Russian cyber operations against foreign countries and governments, has still never been formally attributed to Russia, only to a known group within Russia (colloquially dubbed <ahref="https://wikiless.org/wiki/Cozy_Bear">Cozy Bear</a>) which can not be confirmed nor denied given that it is highly compartmentalized within the structure of Russia’s military. And it’s also in part because of the efforts used to disguise itself as a common Ransomware, and because it routinely used the servers of hacked foreign assets not linked to Russia or to its internal networks.</p>
<p>It’s all to show you the lengths that state actors will go to. You may not be aware of it, but foreign governments use concealment techniques such as the ones discussed in the sections of this guide. They routinely use Tor, VPNs to conceal traffic; they use hacked devices and access to stolen equipment to perform cyber espionage every day and it makes attribution incredibly difficult, if not improbable, from a forensic examiner’s point of view. The problem of correlation is trivial, and you can solve it by simply using IP hiding tools such as a VPN and the Tor network, but still be connected to your IRL name and IP through data leaks or other factors. You can not easily be attributed to your activities if you carefully follow and adopt the given techniques and skills discussed below.</p>
<h1id="creating-your-anonymous-online-identities">Creating your anonymous online identities:</h1>
<p>(Illustrations by Randall Munroe, xkcd.com, licensed under CC BY-NC 2.5)</p>
<p>Captcha<ahref="#fn385"class="footnote-ref"id="fnref385"><sup>385</sup></a> stands for “Completely Automated Public Turing test to tell Computers and Humans Apart” are Turing tests<ahref="#fn386"class="footnote-ref"id="fnref386"><sup>386</sup></a> puzzles you need to complete before accessing a form/website. You will mostly encounter those provided by Google (reCAPTCHA service<ahref="#fn387"class="footnote-ref"id="fnref387"><sup>387</sup></a>) and Cloudflare (hCaptcha<ahref="#fn388"class="footnote-ref"id="fnref388"><sup>388</sup></a>). hCaptcha is used on 15% of the internet by their own metrics<ahref="#fn389"class="footnote-ref"id="fnref389"><sup>389</sup></a>.</p>
<p>Captcha<ahref="#fn381"class="footnote-ref"id="fnref381"><sup>381</sup></a> stands for “Completely Automated Public Turing test to tell Computers and Humans Apart” are Turing tests<ahref="#fn382"class="footnote-ref"id="fnref382"><sup>382</sup></a> puzzles you need to complete before accessing a form/website. You will mostly encounter those provided by Google (reCAPTCHA service<ahref="#fn383"class="footnote-ref"id="fnref383"><sup>383</sup></a>) and Cloudflare (hCaptcha<ahref="#fn384"class="footnote-ref"id="fnref384"><sup>384</sup></a>). hCaptcha is used on 15% of the internet by their own metrics<ahref="#fn385"class="footnote-ref"id="fnref385"><sup>385</sup></a>.</p>
<p>They are designed to separate bots from humans but are also clearly used to deter anonymous and private users from accessing services.</p>
<p>If you often use VPNs or Tor, you will quickly encounter many captchas everywhere<ahref="#fn390"class="footnote-ref"id="fnref390"><sup>390</sup></a>. Quite often when using Tor, even if you succeed in solving all the puzzles (sometimes dozens in a row), you will still be denied after solving the puzzles.</p>
<p>If you often use VPNs or Tor, you will quickly encounter many captchas everywhere<ahref="#fn386"class="footnote-ref"id="fnref386"><sup>386</sup></a>. Quite often when using Tor, even if you succeed in solving all the puzzles (sometimes dozens in a row), you will still be denied after solving the puzzles.</p>
<p>While most people think those puzzles are only about solving a little puzzle, it is important to understand that it is much more complex, and that modern Captchas uses advanced machine learning and risk analysis algorithms to check if you are human<ahref="#fn391"class="footnote-ref"id="fnref391"><sup>391</sup></a>:</p>
<p>While most people think those puzzles are only about solving a little puzzle, it is important to understand that it is much more complex, and that modern Captchas uses advanced machine learning and risk analysis algorithms to check if you are human<ahref="#fn387"class="footnote-ref"id="fnref387"><sup>387</sup></a>:</p>
<ul>
<li><p>They check your browser, cookies, and browsing history using Browser fingerprinting<ahref="#fn392"class="footnote-ref"id="fnref392"><sup>392</sup></a>.</p></li>
<li><p>They check your browser, cookies, and browsing history using Browser fingerprinting<ahref="#fn388"class="footnote-ref"id="fnref388"><sup>388</sup></a>.</p></li>
<li><p>They track your cursor movements (speed, accuracy) and use algorithms to decide if it is “human/organic”.</p></li>
<li><p>They track your behavior before/during/after the tests to ensure you are “human”<ahref="#fn393"class="footnote-ref"id="fnref393"><sup>393</sup></a>.</p></li>
<li><p>They track your behavior before/during/after the tests to ensure you are “human”<ahref="#fn389"class="footnote-ref"id="fnref389"><sup>389</sup></a>.</p></li>
</ul>
<p>It is also highly likely that those platforms could already reliably identify you based on the unique way you interact with those puzzles. This could work despite obfuscation of your IP address / Browser and clearing all cookies.</p>
<p>Watch for example this DEF CON 25 presentation: <ahref="https://www.youtube.com/watch?v=1nvYGi7-Lxo">DEF CON 25 - Svea Eckert, Andreas Dewes - Dark Data</a><sup><ahref="https://yewtu.be/watch?v=1nvYGi7-Lxo">[Invidious]</a></sup></p>
<p>You will often experience several in a row (sometimes endlessly) and sometimes exceedingly difficult ones involving reading undecipherable characters or identifying various objects on endless pictures sets. You will also have more captchas if you use an ad-blocking system (uBlock for example) or if your account was flagged for any reason for using VPNs or Tor previously.</p>
<p>You will also have (in my experience) more Captchas (Google’s reCAPTCHA) if you do not use a Chromium-based browser. But this can be mitigated by using a Chromium-based browsers such as Brave. There is also a Browser extension called Buster that could help you those <ahref="https://github.com/dessant/buster"class="uri">https://github.com/dessant/buster</a><sup><ahref="https://web.archive.org/web/https://github.com/dessant/buster">[Archive.org]</a></sup>.</p>
<p>As for Cloudflare (hCaptcha), you could also use their Accessibility solution here (<ahref="https://www.hcaptcha.com/accessibility"class="uri">https://www.hcaptcha.com/accessibility</a><sup><ahref="https://web.archive.org/web/https://www.hcaptcha.com/accessibility">[Archive.org]</a></sup>) which would allow you to sign-up (with your anonymous identity created later) and set a cookie within your Browser that would allow you to bypass their captchas. Another solution to mitigate hCaptcha would be to use their own solution called “Privacy Pass”<ahref="#fn394"class="footnote-ref"id="fnref394"><sup>394</sup></a><ahref="https://privacypass.github.io/"class="uri">https://privacypass.github.io/</a><sup><ahref="https://web.archive.org/web/https://privacypass.github.io/">[Archive.org]</a></sup> in the form of a Browser extension you could install in your VM Browser.</p>
<p>As for Cloudflare (hCaptcha), you could also use their Accessibility solution here (<ahref="https://www.hcaptcha.com/accessibility"class="uri">https://www.hcaptcha.com/accessibility</a><sup><ahref="https://web.archive.org/web/https://www.hcaptcha.com/accessibility">[Archive.org]</a></sup>) which would allow you to sign-up (with your anonymous identity created later) and set a cookie within your Browser that would allow you to bypass their captchas. Another solution to mitigate hCaptcha would be to use their own solution called “Privacy Pass”<ahref="#fn390"class="footnote-ref"id="fnref390"><sup>390</sup></a><ahref="https://privacypass.github.io/"class="uri">https://privacypass.github.io/</a><sup><ahref="https://web.archive.org/web/https://privacypass.github.io/">[Archive.org]</a></sup> in the form of a Browser extension you could install in your VM Browser.</p>
<p>You should therefore deal with those carefully and force yourself to alter the way you are solving them (speed/movement/accuracy/…) to prevent “Captcha Fingerprinting”.</p>
<p>Fortunately, as far as we are aware, these are not yet officially/publicly used to de-anonymize users for third parties.</p>
<p>To not have those issues, you should consider using a VPN over Tor. And the best option to avoid those is likely to use a self-hosted VPN/Proxy over Tor on a cash/Monero paid VPS server.</p>
<p>Phone verification is advertised by most platforms to verify you are human. But do not be fooled, the main reason for phone verification is not only to check if you are human but also to be able to de-anonymize you if needed.</p>
<p>Most platforms (including the privacy-oriented ones such as Signal/Telegram/Proton will require a phone number to register, and most countries now make it mandatory to submit a proof of ID to register<ahref="#fn395"class="footnote-ref"id="fnref395"><sup>395</sup></a>.</p>
<p>Most platforms (including the privacy-oriented ones such as Signal/Telegram/Proton will require a phone number to register, and most countries now make it mandatory to submit a proof of ID to register<ahref="#fn391"class="footnote-ref"id="fnref391"><sup>391</sup></a>.</p>
<p>Fortunately, this guide explained earlier how to get a number for these cases: <ahref="#getting-an-anonymous-phone-number">Getting an anonymous Phone number</a>.</p>
<p>E-Mail verification is what used to be enough but is not anymore in most cases. What is important to know is that open e-mail providers (disposable e-mail providers for instance) are flagged as much as open proxies (like Tor).</p>
@@ -4154,7 +4132,16 @@
<p>The tolerance is much higher with VPNs as they are not considered “open proxies”, but that will not stop many platforms from making them hard to use by forcing increasingly difficult CAPTCHAs on most VPN users.</p>
<p>For this reason, this guide does recommend the use of VPN over Tor (and not Tor over VPN) in certain use cases. <strong>Remember that the best option to avoid those is to use a self-hosted VPN/Proxy over Tor on a cash/Monero paid VPS</strong>.</p>
<h3id="browser-and-device-fingerprinting">Browser and Device Fingerprinting:</h3>
<p>Your Browser and Device Fingerprints<ahref="#fn392"class="footnote-ref"id="fnref392"><sup>392</sup></a> are a set of properties/capabilities of your System/Browser. These are used on most websites for invisible user tracking but also to adapt the website user experience depending on their browser. For instance, websites will be able to provide a “mobile experience” if you are using a mobile browser or propose a specific language/geographic version depending on your fingerprint. Most of those techniques work with recent Browsers like Chromium-based<ahref="#fn393"class="footnote-ref"id="fnref393"><sup>393</sup></a> browsers (such as Chrome/Edge) or Firefox<ahref="#fn394"class="footnote-ref"id="fnref394"><sup>394</sup></a> unless taking specific measures. Browser and Device<ahref="#fn395"class="footnote-ref"id="fnref395"><sup>395</sup></a> Fingerprinting are usually integrated into the Captcha services but also in other various services.</p>
<p>Many platforms (like Google<ahref="#fn396"class="footnote-ref"id="fnref396"><sup>396</sup></a>) will check your browser for various capabilities and settings and block browsers they do not like. This is one of the reasons we recommend using Chromium-based browsers such as Brave Browser over Tor Browser within this VM.</p>
<p>It should also be noted that while some browsers and extensions will offer some fingerprint resistance, this resistance in itself can also be used to fingerprint you as explained here <ahref="https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/"class="uri">https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/</a><sup><ahref="https://web.archive.org/web/https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/">[Archive.org]</a></sup></p>
<p>This guide will mitigate these issues by randomizing or hiding many of those fingerprinting identifiers by:</p>
<ul>
<li><p>Using Virtualization (See <ahref="#appendix-w-virtualization">Appendix W: Virtualization</a>);</p></li>
<li><p>Using specific recommendations (See <ahref="#appendix-a5-additional-browser-precautions-with-javascript-enabled">Appendix A5: Additional browser precautions with JavaScript enabled</a>;</p></li>
<li><p>Using hardening <ahref="#appendix-v1-hardening-your-browsers">Appendix V1: Hardening your Browsers</a>);</p></li>
<li><p>and by using fingerprint-resistant browsers (like Brave or Tor Browser).</p></li>
</ul>
<p>Here are some of the things they check within recent browsers:</p>
<ul>
<li><p>User-Agent: This is your Browser name and Version.</p></li>
<li><p>Archive.today over Tor: <ahref="http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/anonymousplanet.org"class="uri">http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/anonymousplanet.org</a></p></li>
<li><p>OpenDocument Text (ODT) version at: <ahref="https://anonymousplanet.org/export/guide.odt"class="uri">https://anonymousplanet.org/export/guide.odt</a><sup><ahref="https://web.archive.org/web/https://anonymousplanet.org/export/guide.odt">[Archive.org]</a></sup><sup><ahref="http://thgtoa7imksbg7rit4grgijl2ef6kc7b56bp56pmtta4g354lydlzkqd.onion/guide.odt">[Tor Mirror]</a></sup></p></li>
<li><p>OpenDocument Text (ODT) version at: <ahref="https://anonymousplanet.org/export/guide.odt"class="uri">https://anonymousplanet.org/export/guide.odt</a><sup><ahref="https://web.archive.org/web/https://anonymousplanet.org/export/guide.odt">[Archive.org]</a></sup><sup><ahref="http://thgtoa27ujspeqxasrfvcf5aozqdczvgmwgorrmblh6jn4nino3spcqd.onion/export/guide.odt">[Tor Mirror]</a></sup></p></li>
<p>If you want to compare an older version of the PDF with a newer version, consider these online tools (note that we do not endorse those tools in relation to their privacy policies, but it should not matter since these PDFs are public):</p>
<liid="fn255"><p>Cellebrite, Unlock cloud-based evidence to solve the case sooner <ahref="https://www.cellebrite.com/en/ufed-cloud/"class="uri">https://www.cellebrite.com/en/ufed-cloud/</a><sup><ahref="https://web.archive.org/web/https://www.cellebrite.com/en/ufed-cloud/">[Archive.org]</a></sup><ahref="#fnref255"class="footnote-back">↩</a></p></li>
<liid="fn256"><p>Property of the People, Lawful Access to Secure Messaging Apps Data, <ahref="https://propertyofthepeople.org/document-detail/?doc-id=21114562"class="uri">https://propertyofthepeople.org/document-detail/?doc-id=21114562</a><sup><ahref="https://web.archive.org/web/https://propertyofthepeople.org/document-detail/?doc-id=21114562">[Archive.org]</a></sup><ahref="#fnref256"class="footnote-back">↩</a></p></li>
<liid="fn262"><p>Securephones.io, Data Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed Solutions <ahref="https://securephones.io/main.pdf"class="uri">https://securephones.io/main.pdf</a><sup><ahref="https://web.archive.org/web/https://securephones.io/main.pdf">[Archive.org]</a></sup><ahref="#fnref262"class="footnote-back">↩</a></p></li>
<liid="fn263"><p>Loup-Vaillant.fr, Rolling Your Own Crypto <ahref="https://loup-vaillant.fr/articles/rolling-your-own-crypto"class="uri">https://loup-vaillant.fr/articles/rolling-your-own-crypto</a><sup><ahref="https://web.archive.org/web/https://loup-vaillant.fr/articles/rolling-your-own-crypto">[Archive.org]</a></sup><ahref="#fnref263"class="footnote-back">↩</a></p></li>
<liid="fn264"><p>Dhole Moments, Crackpot Cryptography and Security Theater <ahref="https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/"class="uri">https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/</a><sup><ahref="https://web.archive.org/web/https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/">[Archive.org]</a></sup><ahref="#fnref264"class="footnote-back">↩</a></p></li>
<liid="fn265"><p>Vice.com, Why You Don’t Roll Your Own Crypto <ahref="https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto"class="uri">https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto</a><sup><ahref="https://web.archive.org/web/https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto">[Archive.org]</a></sup><ahref="#fnref265"class="footnote-back">↩</a></p></li>
<liid="fn266"><p>arXiv, MIT, You Really Shouldn’t Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries <ahref="https://arxiv.org/pdf/2107.04940.pdf"class="uri">https://arxiv.org/pdf/2107.04940.pdf</a><sup><ahref="https://web.archive.org/web/https://arxiv.org/pdf/2107.04940.pdf">[Archive.org]</a></sup><ahref="#fnref266"class="footnote-back">↩</a></p></li>
<liid="fn267"><p>YouTube, Great Crypto Failures <ahref="https://www.youtube.com/watch?v=loy84K3AJ5Q"class="uri">https://www.youtube.com/watch?v=loy84K3AJ5Q</a><sup><ahref="https://yewtu.be/watch?v=loy84K3AJ5Q">[Invidious]</a></sup><ahref="#fnref267"class="footnote-back">↩</a></p></li>
<liid="fn268"><p>Cryptography Dispatches, The Most Backdoor-Looking Bug I’ve Ever Seen <ahref="https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/"class="uri">https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/</a><sup><ahref="https://web.archive.org/web/https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/">[Archive.org]</a></sup><ahref="#fnref268"class="footnote-back">↩</a></p></li>
<liid="fn269"><p>Citizenlab.ca, Move Fast and Roll Your Own Crypto <ahref="https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/"class="uri">https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/</a><sup><ahref="https://web.archive.org/web/https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/">[Archive.org]</a></sup><ahref="#fnref269"class="footnote-back">↩</a></p></li>
<liid="fn270"><p>Jack Poon, The myth of military grade encryption <ahref="https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369"class="uri">https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369</a><sup><ahref="https://scribe.rip/@atcipher/the-myth-of-military-grade-encryption-292313ae6369">[Scribe.rip]</a></sup><sup><ahref="https://web.archive.org/web/https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369">[Archive.org]</a></sup><ahref="#fnref270"class="footnote-back">↩</a></p></li>
<liid="fn271"><p>Congruent Labs, Stop calling it “Military-Grade Encryption” <ahref="https://blog.congruentlabs.co/military-grade-encryption/"class="uri">https://blog.congruentlabs.co/military-grade-encryption/</a><sup><ahref="https://web.archive.org/web/https://blog.congruentlabs.co/military-grade-encryption/">[Archive.org]</a></sup><ahref="#fnref271"class="footnote-back">↩</a></p></li>
<liid="fn278"><p>Lacatora, The PGP Problem <ahref="https://latacora.singles/2019/07/16/the-pgp-problem.html"class="uri">https://latacora.singles/2019/07/16/the-pgp-problem.html</a><sup><ahref="https://web.archive.org/web/https://latacora.singles/2019/07/16/the-pgp-problem.html">[Archive.org]</a></sup><ahref="#fnref278"class="footnote-back">↩</a></p></li>
<liid="fn281"><p>Wikipedia, National Security Letter <ahref="https://en.wikipedia.org/wiki/National_security_letter"class="uri">https://en.wikipedia.org/wiki/National_security_letter</a><sup><ahref="https://wikiless.org/wiki/National_security_letter">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/National_security_letter">[Archive.org]</a></sup><ahref="#fnref281"class="footnote-back">↩</a></p></li>
<liid="fn282"><p>ArsTechnica, VPN servers seized by Ukrainian authorities weren’t encrypted <ahref="https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/"class="uri">https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/">[Archive.org]</a></sup><ahref="#fnref282"class="footnote-back">↩</a></p></li>
<liid="fn283"><p>BleepingComputer, DoubleVPN servers, logs, and account info seized by law enforcement <ahref="https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/"class="uri">https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/</a><sup><ahref="https://web.archive.org/web/https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/">[Archive.org]</a></sup><ahref="#fnref283"class="footnote-back">↩</a></p></li>
<liid="fn284"><p>CyberScoop, Court rules encrypted email provider Tutanota must monitor messages in blackmail case <ahref="https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/"class="uri">https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/</a><sup><ahref="https://web.archive.org/web/https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/">[Archive.org]</a></sup><ahref="#fnref284"class="footnote-back">↩</a></p></li>
<liid="fn286"><p>PCMag, Did PureVPN Cross a Line When It Disclosed User Information? <ahref="https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information"class="uri">https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information</a><sup><ahref="https://web.archive.org/web/https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information">[Archive.org]</a></sup><ahref="#fnref286"class="footnote-back">↩</a></p></li>
<liid="fn287"><p>Internet Archive, Wipeyourdata, “No logs” EarthVPN user arrested after police finds logs <ahref="https://archive.is/XNuVw#selection-230.0-230.1"class="uri">https://archive.is/XNuVw#selection-230.0-230.1</a><sup><ahref="https://web.archive.org/web/https://archive.is/XNuVw">[Archive.org]</a></sup><ahref="#fnref287"class="footnote-back">↩</a></p></li>
<liid="fn288"><p>Wikipedia, Lavabit Suspension and Gag order, <ahref="https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order"class="uri">https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order</a><sup><ahref="https://wikiless.org/wiki/Lavabit">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Lavabit">[Archive.org]</a></sup><ahref="#fnref288"class="footnote-back">↩</a></p></li>
<liid="fn289"><p>Internet Archive, Invisibler, What Everybody Ought to Know About HideMyAss <ahref="https://archive.is/ag9w4#selection-136.0-136.1"class="uri">https://archive.is/ag9w4#selection-136.0-136.1</a><ahref="#fnref289"class="footnote-back">↩</a></p></li>
<liid="fn291"><p>Washington Post, The intelligence coup of the century <ahref="https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/"class="uri">https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/</a><sup><ahref="https://web.archive.org/web/https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/">[Archive.org]</a></sup><ahref="#fnref291"class="footnote-back">↩</a></p></li>
<liid="fn292"><p>Swissinfo.ch, Second Swiss firm allegedly sold encrypted spying devices <ahref="https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432"class="uri">https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432</a><sup><ahref="https://web.archive.org/web/https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432">[Archive.org]</a></sup><ahref="#fnref292"class="footnote-back">↩</a></p></li>
<liid="fn293"><p>Wikipedia, Das Leben der Anderen <ahref="https://en.wikipedia.org/wiki/The_Lives_of_Others"class="uri">https://en.wikipedia.org/wiki/The_Lives_of_Others</a><sup><ahref="https://wikiless.org/wiki/The_Lives_of_Others">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/The_Lives_of_Others">[Archive.org]</a></sup><ahref="#fnref293"class="footnote-back">↩</a></p></li>
<liid="fn294"><p>Wired, Mind the Gap: This Researcher Steals Data With Noise, Light, and Magnets <ahref="https://www.wired.com/story/air-gap-researcher-mordechai-guri/"class="uri">https://www.wired.com/story/air-gap-researcher-mordechai-guri/</a><sup><ahref="https://web.archive.org/web/https://www.wired.com/story/air-gap-researcher-mordechai-guri/">[Archive.org]</a></sup><ahref="#fnref294"class="footnote-back">↩</a></p></li>
<liid="fn295"><p>Scientific American, A Blank Wall Can Show How Many People Are in a Room and What They’re Doing <ahref="https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/"class="uri">https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/">[Archive.org]</a></sup><ahref="#fnref295"class="footnote-back">↩</a></p></li>
<liid="fn296"><p>Scientific American, A Shiny Snack Bag’s Reflections Can Reconstruct the Room around It <ahref="https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/"class="uri">https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/">[Archive.org]</a></sup><ahref="#fnref296"class="footnote-back">↩</a></p></li>
<liid="fn297"><p>Scientific American, Footstep Sensors Identify People by Gait <ahref="https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/"class="uri">https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/">[Archive.org]</a></sup><ahref="#fnref297"class="footnote-back">↩</a></p></li>
<liid="fn299"><p>The Guardian, Laser spying: is it really practical? <ahref="https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices"class="uri">https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices</a><sup><ahref="https://web.archive.org/web/https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices">[Archive.org]</a></sup><ahref="#fnref299"class="footnote-back">↩</a></p></li>
<liid="fn300"><p>ArsTechnica, Photos of an NSA “upgrade” factory show Cisco router getting implant <ahref="https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/"class="uri">https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/">[Archive.org]</a></sup><ahref="#fnref300"class="footnote-back">↩</a></p></li>
<liid="fn301"><p>Wikipedia, Zero-trust Security Model <ahref="https://en.wikipedia.org/wiki/Zero_trust_security_model"class="uri">https://en.wikipedia.org/wiki/Zero_trust_security_model</a><sup><ahref="https://wikiless.org/wiki/Zero_trust_security_model">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Zero_trust_security_model">[Archive.org]</a></sup><ahref="#fnref301"class="footnote-back">↩</a></p></li>
<liid="fn302"><p>Qubes OS, System Requirements <ahref="https://www.qubes-os.org/doc/system-requirements/"class="uri">https://www.qubes-os.org/doc/system-requirements/</a><sup><ahref="https://web.archive.org/web/https://www.qubes-os.org/doc/system-requirements/">[Archive.org]</a></sup><ahref="#fnref302"class="footnote-back">↩</a></p></li>
<liid="fn308"><p>Privacy International, Timeline of SIM Card Registration Laws <ahref="https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws"class="uri">https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws</a><sup><ahref="https://web.archive.org/web/https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws">[Archive.org]</a></sup><ahref="#fnref308"class="footnote-back">↩</a></p></li>
<liid="fn309"><p>NYTimes, Lost Passwords Lock Millionaires Out of Their Bitcoin Fortunes <ahref="https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html"class="uri">https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html</a><sup><ahref="https://web.archive.org/web/https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html">[Archive.org]</a></sup><ahref="#fnref309"class="footnote-back">↩</a></p></li>
<liid="fn310"><p>Usenix.org, Shedding too much Light on a Microcontroller’s Firmware Protection <ahref="https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf"class="uri">https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf</a><sup><ahref="https://web.archive.org/web/https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf">[Archive.org]</a></sup><ahref="#fnref310"class="footnote-back">↩</a></p></li>
<liid="fn311"><p>TorProject.org, Can I run Tor Browser on an iOS device? <ahref="https://support.torproject.org/tormobile/tormobile-3/"class="uri">https://support.torproject.org/tormobile/tormobile-3/</a><sup><ahref="https://web.archive.org/web/https://support.torproject.org/tormobile/tormobile-3/">[Archive.org]</a></sup><ahref="#fnref311"class="footnote-back">↩</a></p></li>
<liid="fn313"><p>Vice.com, Facebook Helped the FBI Hack a Child Predator <ahref="https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez"class="uri">https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez</a><sup><ahref="https://web.archive.org/web/https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez">[Archive.org]</a></sup><ahref="#fnref313"class="footnote-back">↩</a></p></li>
<liid="fn316"><p>Veracrypt Documentation, Trim Operations <ahref="https://www.veracrypt.fr/en/Trim%20Operation.html"class="uri">https://www.veracrypt.fr/en/Trim%20Operation.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Trim%20Operation.html">[Archive.org]</a></sup><ahref="#fnref316"class="footnote-back">↩</a></p></li>
<liid="fn317"><p>YouTube, 36C3 - Uncover, Understand, Own - Regaining Control Over Your AMD CPU <ahref="https://www.youtube.com/watch?v=bKH5nGLgi08&t=2834s"class="uri">https://www.youtube.com/watch?v=bKH5nGLgi08&t=2834s</a><sup><ahref="https://yewtu.be/watch?v=bKH5nGLgi08&t=2834s">[Invidious]</a></sup><ahref="#fnref317"class="footnote-back">↩</a></p></li>
<liid="fn323"><p>Wired, Don’t Want Your Laptop Tampered With? Just Add Glitter Nail Polish <ahref="https://www.wired.com/2013/12/better-data-security-nail-polish/"class="uri">https://www.wired.com/2013/12/better-data-security-nail-polish/</a><sup><ahref="https://web.archive.org/web/https://www.wired.com/2013/12/better-data-security-nail-polish/">[Archive.org]</a></sup><ahref="#fnref323"class="footnote-back">↩</a></p></li>
<liid="fn327"><p>PrivacyGuides.org, Don’t use Windows 10 - It’s a privacy nightmare <ahref="https://web.archive.org/web/20220313023015/https://www.privacyguides.org/tools/#operating-systems#win10"class="uri">https://web.archive.org/web/20220313023015/https://www.privacyguides.org/tools/#operating-systems#win10</a><sup><ahref="https://web.archive.org/web/https://www.privacyguides.org/tools/#operating-systems">[Archive.org]</a></sup><ahref="#fnref327"class="footnote-back">↩</a></p></li>
<liid="fn330"><p>GP Digital, World map of encryption laws and policies <ahref="https://www.gp-digital.org/world-map-of-encryption/"class="uri">https://www.gp-digital.org/world-map-of-encryption/</a><sup><ahref="https://web.archive.org/web/https://www.gp-digital.org/world-map-of-encryption/">[Archive.org]</a></sup><ahref="#fnref330"class="footnote-back">↩</a></p></li>
<liid="fn335"><p>ResearchGate, Defeating Plausible Deniability of VeraCrypt Hidden Operating Systems <ahref="https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems"class="uri">https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems</a><sup><ahref="https://web.archive.org/web/https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems">[Archive.org]</a></sup><ahref="#fnref335"class="footnote-back">↩</a></p></li>
<liid="fn336"><p>SANS.org, Mission Implausible: Defeating Plausible Deniability with Digital Forensics <ahref="https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500"class="uri">https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500</a><sup><ahref="https://web.archive.org/web/https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500">[Archive.org]</a></sup><ahref="#fnref336"class="footnote-back">↩</a></p></li>
<liid="fn337"><p>SourceForge, Veracrypt Forum <ahref="https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/"class="uri">https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/</a><sup><ahref="https://web.archive.org/web/https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/">[Archive.org]</a></sup><ahref="#fnref337"class="footnote-back">↩</a></p></li>
<liid="fn339"><p>SANS, Windows ShellBag Forensics in-depth <ahref="https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545"class="uri">https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545</a><sup><ahref="https://web.archive.org/web/https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545">[Archive.org]</a></sup><ahref="#fnref339"class="footnote-back">↩</a></p></li>
<liid="fn340"><p>University of York, Forensic data recovery from the Windows Search Database <ahref="https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf"class="uri">https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf</a><sup><ahref="https://web.archive.org/web/https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf">[Archive.org]</a></sup><ahref="#fnref340"class="footnote-back">↩</a></p></li>
<liid="fn341"><p>A forensic insight into Windows 10 Jump Lists<ahref="https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf"class="uri">https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf</a><sup><ahref="https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf">[Archive.org]</a></sup><ahref="#fnref341"class="footnote-back">↩</a></p></li>
<liid="fn343"><p>Alpine Linux Wiki, Setting up a laptop <ahref="https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop"class="uri">https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop</a><sup><ahref="https://web.archive.org/web/https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop">[Archive.org]</a></sup><ahref="#fnref343"class="footnote-back">↩</a></p></li>
<liid="fn346"><p>Veracrypt Documentation, Unencrypted Data in RAM <ahref="https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html"class="uri">https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html">[Archive.org]</a></sup><ahref="#fnref346"class="footnote-back">↩</a></p></li>
<liid="fn347"><p>Veracrypt Documentation, Data Leaks <ahref="https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html"class="uri">https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html">[Archive.org]</a></sup><ahref="#fnref347"class="footnote-back">↩</a></p></li>
<liid="fn348"><p>Dolos Group, From Stolen Laptop to Inside the Company Network <ahref="https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network"class="uri">https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network</a><sup><ahref="https://web.archive.org/web/https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network">[Archive.org]</a></sup><ahref="#fnref348"class="footnote-back">↩</a></p></li>
<liid="fn350"><p>Jon Aubrey, attacking laptops that are protected by Microsoft Bitlocker drive encryption <ahref="https://twitter.com/SecurityJon/status/1445020885472235524"class="uri">https://twitter.com/SecurityJon/status/1445020885472235524</a><sup><ahref="https://nitter.net/SecurityJon/status/1445020885472235524">[Nitter]</a></sup><ahref="#fnref350"class="footnote-back">↩</a></p></li>
<liid="fn351"><p>F-Secure Labs, Sniff, there leaks my BitLocker key <ahref="https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/"class="uri">https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/</a><sup><ahref="https://web.archive.org/web/https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/">[Archive.org]</a></sup><ahref="#fnref351"class="footnote-back">↩</a></p></li>
<liid="fn353"><p>Wikipedia, Trim <ahref="https://en.wikipedia.org/wiki/Trim_(computing)"class="uri">https://en.wikipedia.org/wiki/Trim_(computing)</a><sup><ahref="https://wikiless.org/wiki/Trim_(computing)">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Trim_(computing)">[Archive.org]</a></sup><ahref="#fnref353"class="footnote-back">↩</a></p></li>
<liid="fn354"><p>Veracrypt Documentation, Trim Operations<ahref="https://www.veracrypt.fr/en/Trim%20Operation.html"class="uri">https://www.veracrypt.fr/en/Trim%20Operation.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Trim%20Operation.html">[Archive.org]</a></sup><ahref="#fnref354"class="footnote-back">↩</a></p></li>
<liid="fn355"><p>Veracrypt Documentation, Rescue Disk <ahref="https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html"class="uri">https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html">[Archive.org]</a></sup><ahref="#fnref355"class="footnote-back">↩</a></p></li>
<liid="fn356"><p>St Cloud State University, Forensic Research on Solid State Drives using Trim Analysis<ahref="https://web.archive.org//web/20220612095503/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds"class="uri">https://web.archive.org//web/20220612095503/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds</a><sup><ahref="https://web.archive.org/web/20211009021236/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds">[Archive.org]</a></sup><ahref="#fnref356"class="footnote-back">↩</a></p></li>
<liid="fn357"><p>WindowsCentral, Trim Tutorial <ahref="https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance"class="uri">https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance</a><sup><ahref="https://web.archive.org/web/https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance">[Archive.org]</a></sup><ahref="#fnref357"class="footnote-back">↩</a></p></li>
<liid="fn358"><p>Veracrypt Documentation, Trim Operation <ahref="https://veracrypt.eu/en/docs/trim-operation/"class="uri">https://veracrypt.eu/en/docs/trim-operation/</a><sup><ahref="https://web.archive.org/web/https://veracrypt.eu/en/docs/trim-operation/">[Archive.org]</a></sup><ahref="#fnref358"class="footnote-back">↩</a></p></li>
<liid="fn359"><p>Black Hat 2018, Perfectly Deniable Steganographic Disk Encryption <ahref="https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf"class="uri">https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf</a><sup><ahref="https://web.archive.org/web/https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf">[Archive.org]</a></sup><ahref="#fnref359"class="footnote-back">↩</a></p></li>
<liid="fn360"><p>Milan Broz’s Blog, TRIM & dm-crypt … problems?<ahref="http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html"class="uri">http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html</a><sup><ahref="https://web.archive.org/web/http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html">[Archive.org]</a></sup><ahref="#fnref360"class="footnote-back">↩</a></p></li>
<liid="fn386"><p>Wikipedia, Turing Test <ahref="https://en.wikipedia.org/wiki/Turing_test"class="uri">https://en.wikipedia.org/wiki/Turing_test</a><sup><ahref="https://wikiless.org/wiki/Turing_test">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Turing_test">[Archive.org]</a></sup><ahref="#fnref386"class="footnote-back">↩</a></p></li>
<liid="fn389"><p>hCaptcha, hCaptcha Is Now the Largest Independent CAPTCHA Service, Runs on 15% Of The Internet <ahref="https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service"class="uri">https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service</a><sup><ahref="https://web.archive.org/web/https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service">[Archive.org]</a></sup><ahref="#fnref389"class="footnote-back">↩</a></p></li>
<liid="fn390"><p>Nearcyan.com, You (probably) don’t need ReCAPTCHA <ahref="https://nearcyan.com/you-probably-dont-need-recaptcha/"class="uri">https://nearcyan.com/you-probably-dont-need-recaptcha/</a><sup><ahref="https://web.archive.org/web/https://nearcyan.com/you-probably-dont-need-recaptcha/">[Archive.org]</a></sup><ahref="#fnref390"class="footnote-back">↩</a></p></li>
<liid="fn391"><p>ArsTechnica, “Google’s reCAPTCHA turns”invisible," will separate bots from people without challenges"<ahref="https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/"class="uri">https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/">[Archive.org]</a></sup><ahref="#fnref391"class="footnote-back">↩</a></p></li>
<liid="fn392"><p>BlackHat Asia 2016, “I’m not a human: Breaking the Google reCAPTCHA” <ahref="https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf"class="uri">https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf</a><sup><ahref="https://web.archive.org/web/https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf">[Archive.org]</a></sup><ahref="#fnref392"class="footnote-back">↩</a></p></li>
<liid="fn258"><p>Securephones.io, Data Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed Solutions <ahref="https://securephones.io/main.pdf"class="uri">https://securephones.io/main.pdf</a><sup><ahref="https://web.archive.org/web/https://securephones.io/main.pdf">[Archive.org]</a></sup><ahref="#fnref258"class="footnote-back">↩</a></p></li>
<liid="fn259"><p>Loup-Vaillant.fr, Rolling Your Own Crypto <ahref="https://loup-vaillant.fr/articles/rolling-your-own-crypto"class="uri">https://loup-vaillant.fr/articles/rolling-your-own-crypto</a><sup><ahref="https://web.archive.org/web/https://loup-vaillant.fr/articles/rolling-your-own-crypto">[Archive.org]</a></sup><ahref="#fnref259"class="footnote-back">↩</a></p></li>
<liid="fn260"><p>Dhole Moments, Crackpot Cryptography and Security Theater <ahref="https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/"class="uri">https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/</a><sup><ahref="https://web.archive.org/web/https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/">[Archive.org]</a></sup><ahref="#fnref260"class="footnote-back">↩</a></p></li>
<liid="fn261"><p>Vice.com, Why You Don’t Roll Your Own Crypto <ahref="https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto"class="uri">https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto</a><sup><ahref="https://web.archive.org/web/https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-your-own-crypto">[Archive.org]</a></sup><ahref="#fnref261"class="footnote-back">↩</a></p></li>
<liid="fn262"><p>arXiv, MIT, You Really Shouldn’t Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries <ahref="https://arxiv.org/pdf/2107.04940.pdf"class="uri">https://arxiv.org/pdf/2107.04940.pdf</a><sup><ahref="https://web.archive.org/web/https://arxiv.org/pdf/2107.04940.pdf">[Archive.org]</a></sup><ahref="#fnref262"class="footnote-back">↩</a></p></li>
<liid="fn263"><p>YouTube, Great Crypto Failures <ahref="https://www.youtube.com/watch?v=loy84K3AJ5Q"class="uri">https://www.youtube.com/watch?v=loy84K3AJ5Q</a><sup><ahref="https://yewtu.be/watch?v=loy84K3AJ5Q">[Invidious]</a></sup><ahref="#fnref263"class="footnote-back">↩</a></p></li>
<liid="fn264"><p>Cryptography Dispatches, The Most Backdoor-Looking Bug I’ve Ever Seen <ahref="https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/"class="uri">https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/</a><sup><ahref="https://web.archive.org/web/https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/">[Archive.org]</a></sup><ahref="#fnref264"class="footnote-back">↩</a></p></li>
<liid="fn265"><p>Citizenlab.ca, Move Fast and Roll Your Own Crypto <ahref="https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/"class="uri">https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/</a><sup><ahref="https://web.archive.org/web/https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/">[Archive.org]</a></sup><ahref="#fnref265"class="footnote-back">↩</a></p></li>
<liid="fn266"><p>Jack Poon, The myth of military grade encryption <ahref="https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369"class="uri">https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369</a><sup><ahref="https://scribe.rip/@atcipher/the-myth-of-military-grade-encryption-292313ae6369">[Scribe.rip]</a></sup><sup><ahref="https://web.archive.org/web/https://medium.com/@atcipher/the-myth-of-military-grade-encryption-292313ae6369">[Archive.org]</a></sup><ahref="#fnref266"class="footnote-back">↩</a></p></li>
<liid="fn267"><p>Congruent Labs, Stop calling it “Military-Grade Encryption” <ahref="https://blog.congruentlabs.co/military-grade-encryption/"class="uri">https://blog.congruentlabs.co/military-grade-encryption/</a><sup><ahref="https://web.archive.org/web/https://blog.congruentlabs.co/military-grade-encryption/">[Archive.org]</a></sup><ahref="#fnref267"class="footnote-back">↩</a></p></li>
<liid="fn274"><p>Lacatora, The PGP Problem <ahref="https://latacora.singles/2019/07/16/the-pgp-problem.html"class="uri">https://latacora.singles/2019/07/16/the-pgp-problem.html</a><sup><ahref="https://web.archive.org/web/https://latacora.singles/2019/07/16/the-pgp-problem.html">[Archive.org]</a></sup><ahref="#fnref274"class="footnote-back">↩</a></p></li>
<liid="fn277"><p>Wikipedia, National Security Letter<ahref="https://en.wikipedia.org/wiki/National_security_letter"class="uri">https://en.wikipedia.org/wiki/National_security_letter</a><sup><ahref="https://wikiless.org/wiki/National_security_letter">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/National_security_letter">[Archive.org]</a></sup><ahref="#fnref277"class="footnote-back">↩</a></p></li>
<liid="fn278"><p>ArsTechnica, VPN servers seized by Ukrainian authorities weren’t encrypted <ahref="https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/"class="uri">https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/">[Archive.org]</a></sup><ahref="#fnref278"class="footnote-back">↩</a></p></li>
<liid="fn279"><p>BleepingComputer, DoubleVPN servers, logs, and account info seized by law enforcement <ahref="https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/"class="uri">https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/</a><sup><ahref="https://web.archive.org/web/https://www.bleepingcomputer.com/news/security/doublevpn-servers-logs-and-account-info-seized-by-law-enforcement/">[Archive.org]</a></sup><ahref="#fnref279"class="footnote-back">↩</a></p></li>
<liid="fn280"><p>CyberScoop, Court rules encrypted email provider Tutanota must monitor messages in blackmail case <ahref="https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/"class="uri">https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/</a><sup><ahref="https://web.archive.org/web/https://www.cyberscoop.com/court-rules-encrypted-email-tutanota-monitor-messages/">[Archive.org]</a></sup><ahref="#fnref280"class="footnote-back">↩</a></p></li>
<liid="fn282"><p>PCMag, Did PureVPN Cross a Line When It Disclosed User Information? <ahref="https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information"class="uri">https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information</a><sup><ahref="https://web.archive.org/web/https://www.pcmag.com/opinions/did-purevpn-cross-a-line-when-it-disclosed-user-information">[Archive.org]</a></sup><ahref="#fnref282"class="footnote-back">↩</a></p></li>
<liid="fn283"><p>Internet Archive, Wipeyourdata, “No logs” EarthVPN user arrested after police finds logs <ahref="https://archive.is/XNuVw#selection-230.0-230.1"class="uri">https://archive.is/XNuVw#selection-230.0-230.1</a><sup><ahref="https://web.archive.org/web/https://archive.is/XNuVw">[Archive.org]</a></sup><ahref="#fnref283"class="footnote-back">↩</a></p></li>
<liid="fn284"><p>Wikipedia, Lavabit Suspension and Gag order, <ahref="https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order"class="uri">https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order</a><sup><ahref="https://wikiless.org/wiki/Lavabit">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Lavabit">[Archive.org]</a></sup><ahref="#fnref284"class="footnote-back">↩</a></p></li>
<liid="fn285"><p>Internet Archive, Invisibler, What Everybody Ought to Know About HideMyAss <ahref="https://archive.is/ag9w4#selection-136.0-136.1"class="uri">https://archive.is/ag9w4#selection-136.0-136.1</a><ahref="#fnref285"class="footnote-back">↩</a></p></li>
<liid="fn287"><p>Washington Post, The intelligence coup of the century <ahref="https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/"class="uri">https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/</a><sup><ahref="https://web.archive.org/web/https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/">[Archive.org]</a></sup><ahref="#fnref287"class="footnote-back">↩</a></p></li>
<liid="fn288"><p>Swissinfo.ch, Second Swiss firm allegedly sold encrypted spying devices <ahref="https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432"class="uri">https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432</a><sup><ahref="https://web.archive.org/web/https://www.swissinfo.ch/eng/second-swiss-firm-allegedly-sold-encrypted-spying-devices/46186432">[Archive.org]</a></sup><ahref="#fnref288"class="footnote-back">↩</a></p></li>
<liid="fn289"><p>Wikipedia, Das Leben der Anderen <ahref="https://en.wikipedia.org/wiki/The_Lives_of_Others"class="uri">https://en.wikipedia.org/wiki/The_Lives_of_Others</a><sup><ahref="https://wikiless.org/wiki/The_Lives_of_Others">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/The_Lives_of_Others">[Archive.org]</a></sup><ahref="#fnref289"class="footnote-back">↩</a></p></li>
<liid="fn290"><p>Wired, Mind the Gap: This Researcher Steals Data With Noise, Light, and Magnets <ahref="https://www.wired.com/story/air-gap-researcher-mordechai-guri/"class="uri">https://www.wired.com/story/air-gap-researcher-mordechai-guri/</a><sup><ahref="https://web.archive.org/web/https://www.wired.com/story/air-gap-researcher-mordechai-guri/">[Archive.org]</a></sup><ahref="#fnref290"class="footnote-back">↩</a></p></li>
<liid="fn291"><p>Scientific American, A Blank Wall Can Show How Many People Are in a Room and What They’re Doing <ahref="https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/"class="uri">https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/a-blank-wall-can-show-how-many-people-are-in-a-room-and-what-theyre-doing/">[Archive.org]</a></sup><ahref="#fnref291"class="footnote-back">↩</a></p></li>
<liid="fn292"><p>Scientific American, A Shiny Snack Bag’s Reflections Can Reconstruct the Room around It <ahref="https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/"class="uri">https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/a-shiny-snack-bags-reflections-can-reconstruct-the-room-around-it/">[Archive.org]</a></sup><ahref="#fnref292"class="footnote-back">↩</a></p></li>
<liid="fn293"><p>Scientific American, Footstep Sensors Identify People by Gait <ahref="https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/"class="uri">https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/</a><sup><ahref="https://web.archive.org/web/https://www.scientificamerican.com/article/footstep-sensors-identify-people-by-gait/">[Archive.org]</a></sup><ahref="#fnref293"class="footnote-back">↩</a></p></li>
<liid="fn295"><p>The Guardian, Laser spying: is it really practical? <ahref="https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices"class="uri">https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices</a><sup><ahref="https://web.archive.org/web/https://www.theguardian.com/world/2013/aug/22/gchq-warned-laser-spying-guardian-offices">[Archive.org]</a></sup><ahref="#fnref295"class="footnote-back">↩</a></p></li>
<liid="fn296"><p>ArsTechnica, Photos of an NSA “upgrade” factory show Cisco router getting implant <ahref="https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/"class="uri">https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/">[Archive.org]</a></sup><ahref="#fnref296"class="footnote-back">↩</a></p></li>
<liid="fn297"><p>Wikipedia, Zero-trust Security Model <ahref="https://en.wikipedia.org/wiki/Zero_trust_security_model"class="uri">https://en.wikipedia.org/wiki/Zero_trust_security_model</a><sup><ahref="https://wikiless.org/wiki/Zero_trust_security_model">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Zero_trust_security_model">[Archive.org]</a></sup><ahref="#fnref297"class="footnote-back">↩</a></p></li>
<liid="fn298"><p>Qubes OS, System Requirements <ahref="https://www.qubes-os.org/doc/system-requirements/"class="uri">https://www.qubes-os.org/doc/system-requirements/</a><sup><ahref="https://web.archive.org/web/https://www.qubes-os.org/doc/system-requirements/">[Archive.org]</a></sup><ahref="#fnref298"class="footnote-back">↩</a></p></li>
<liid="fn304"><p>Privacy International, Timeline of SIM Card Registration Laws <ahref="https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws"class="uri">https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws</a><sup><ahref="https://web.archive.org/web/https://privacyinternational.org/long-read/3018/timeline-sim-card-registration-laws">[Archive.org]</a></sup><ahref="#fnref304"class="footnote-back">↩</a></p></li>
<liid="fn305"><p>NYTimes, Lost Passwords Lock Millionaires Out of Their Bitcoin Fortunes <ahref="https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html"class="uri">https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html</a><sup><ahref="https://web.archive.org/web/https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html">[Archive.org]</a></sup><ahref="#fnref305"class="footnote-back">↩</a></p></li>
<liid="fn306"><p>Usenix.org, Shedding too much Light on a Microcontroller’s Firmware Protection <ahref="https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf"class="uri">https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf</a><sup><ahref="https://web.archive.org/web/https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf">[Archive.org]</a></sup><ahref="#fnref306"class="footnote-back">↩</a></p></li>
<liid="fn307"><p>TorProject.org, Can I run Tor Browser on an iOS device? <ahref="https://support.torproject.org/tormobile/tormobile-3/"class="uri">https://support.torproject.org/tormobile/tormobile-3/</a><sup><ahref="https://web.archive.org/web/https://support.torproject.org/tormobile/tormobile-3/">[Archive.org]</a></sup><ahref="#fnref307"class="footnote-back">↩</a></p></li>
<liid="fn309"><p>Vice.com, Facebook Helped the FBI Hack a Child Predator <ahref="https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez"class="uri">https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez</a><sup><ahref="https://web.archive.org/web/https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez">[Archive.org]</a></sup><ahref="#fnref309"class="footnote-back">↩</a></p></li>
<liid="fn312"><p>Veracrypt Documentation, Trim Operations <ahref="https://www.veracrypt.fr/en/Trim%20Operation.html"class="uri">https://www.veracrypt.fr/en/Trim%20Operation.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Trim%20Operation.html">[Archive.org]</a></sup><ahref="#fnref312"class="footnote-back">↩</a></p></li>
<liid="fn313"><p>YouTube, 36C3 - Uncover, Understand, Own - Regaining Control Over Your AMD CPU <ahref="https://www.youtube.com/watch?v=bKH5nGLgi08&t=2834s"class="uri">https://www.youtube.com/watch?v=bKH5nGLgi08&t=2834s</a><sup><ahref="https://yewtu.be/watch?v=bKH5nGLgi08&t=2834s">[Invidious]</a></sup><ahref="#fnref313"class="footnote-back">↩</a></p></li>
<liid="fn319"><p>Wired, Don’t Want Your Laptop Tampered With? Just Add Glitter Nail Polish <ahref="https://www.wired.com/2013/12/better-data-security-nail-polish/"class="uri">https://www.wired.com/2013/12/better-data-security-nail-polish/</a><sup><ahref="https://web.archive.org/web/https://www.wired.com/2013/12/better-data-security-nail-polish/">[Archive.org]</a></sup><ahref="#fnref319"class="footnote-back">↩</a></p></li>
<liid="fn323"><p>PrivacyGuides.org, Don’t use Windows 10 - It’s a privacy nightmare <ahref="https://web.archive.org/web/20220313023015/https://www.privacyguides.org/tools/#operating-systems#win10"class="uri">https://web.archive.org/web/20220313023015/https://www.privacyguides.org/tools/#operating-systems#win10</a><sup><ahref="https://web.archive.org/web/https://www.privacyguides.org/tools/#operating-systems">[Archive.org]</a></sup><ahref="#fnref323"class="footnote-back">↩</a></p></li>
<liid="fn326"><p>GP Digital, World map of encryption laws and policies <ahref="https://www.gp-digital.org/world-map-of-encryption/"class="uri">https://www.gp-digital.org/world-map-of-encryption/</a><sup><ahref="https://web.archive.org/web/https://www.gp-digital.org/world-map-of-encryption/">[Archive.org]</a></sup><ahref="#fnref326"class="footnote-back">↩</a></p></li>
<liid="fn331"><p>ResearchGate, Defeating Plausible Deniability of VeraCrypt Hidden Operating Systems <ahref="https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems"class="uri">https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems</a><sup><ahref="https://web.archive.org/web/https://www.researchgate.net/publication/318155607_Defeating_Plausible_Deniability_of_VeraCrypt_Hidden_Operating_Systems">[Archive.org]</a></sup><ahref="#fnref331"class="footnote-back">↩</a></p></li>
<liid="fn332"><p>SANS.org, Mission Implausible: Defeating Plausible Deniability with Digital Forensics <ahref="https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500"class="uri">https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500</a><sup><ahref="https://web.archive.org/web/https://www.sans.org/reading-room/whitepapers/forensics/mission-implausible-defeating-plausible-deniability-digital-forensics-39500">[Archive.org]</a></sup><ahref="#fnref332"class="footnote-back">↩</a></p></li>
<liid="fn333"><p>SourceForge, Veracrypt Forum <ahref="https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/"class="uri">https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/</a><sup><ahref="https://web.archive.org/web/https://sourceforge.net/p/veracrypt/discussion/technical/thread/53f33faf/">[Archive.org]</a></sup><ahref="#fnref333"class="footnote-back">↩</a></p></li>
<liid="fn335"><p>SANS, Windows ShellBag Forensics in-depth <ahref="https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545"class="uri">https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545</a><sup><ahref="https://web.archive.org/web/https://www.sans.org/reading-room/whitepapers/forensics/windows-shellbag-forensics-in-depth-34545">[Archive.org]</a></sup><ahref="#fnref335"class="footnote-back">↩</a></p></li>
<liid="fn336"><p>University of York, Forensic data recovery from the Windows Search Database <ahref="https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf"class="uri">https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf</a><sup><ahref="https://web.archive.org/web/https://eprints.whiterose.ac.uk/75046/1/Forensic_Data_Recovery_From_The_Windows_Search_Database_preprint_DIIN328.pdf">[Archive.org]</a></sup><ahref="#fnref336"class="footnote-back">↩</a></p></li>
<liid="fn337"><p>A forensic insight into Windows 10 Jump Lists <ahref="https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf"class="uri">https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf</a><sup><ahref="https://web.archive.org/web/https://cyberforensicator.com/wp-content/uploads/2017/01/1-s2.0-S1742287616300202-main.2-14.pdf">[Archive.org]</a></sup><ahref="#fnref337"class="footnote-back">↩</a></p></li>
<liid="fn339"><p>Alpine Linux Wiki, Setting up a laptop <ahref="https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop"class="uri">https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop</a><sup><ahref="https://web.archive.org/web/https://wiki.alpinelinux.org/wiki/Setting_up_a_laptop">[Archive.org]</a></sup><ahref="#fnref339"class="footnote-back">↩</a></p></li>
<liid="fn342"><p>Veracrypt Documentation, Unencrypted Data in RAM <ahref="https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html"class="uri">https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Unencrypted%20Data%20in%20RAM.html">[Archive.org]</a></sup><ahref="#fnref342"class="footnote-back">↩</a></p></li>
<liid="fn343"><p>Veracrypt Documentation, Data Leaks <ahref="https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html"class="uri">https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/code/VeraCrypt/plain/doc/html/Data%20Leaks.html">[Archive.org]</a></sup><ahref="#fnref343"class="footnote-back">↩</a></p></li>
<liid="fn344"><p>Dolos Group, From Stolen Laptop to Inside the Company Network <ahref="https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network"class="uri">https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network</a><sup><ahref="https://web.archive.org/web/https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network">[Archive.org]</a></sup><ahref="#fnref344"class="footnote-back">↩</a></p></li>
<liid="fn346"><p>Jon Aubrey, attacking laptops that are protected by Microsoft Bitlocker drive encryption <ahref="https://twitter.com/SecurityJon/status/1445020885472235524"class="uri">https://twitter.com/SecurityJon/status/1445020885472235524</a><sup><ahref="https://nitter.net/SecurityJon/status/1445020885472235524">[Nitter]</a></sup><ahref="#fnref346"class="footnote-back">↩</a></p></li>
<liid="fn347"><p>F-Secure Labs, Sniff, there leaks my BitLocker key <ahref="https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/"class="uri">https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/</a><sup><ahref="https://web.archive.org/web/https://labs.f-secure.com/blog/sniff-there-leaks-my-bitlocker-key/">[Archive.org]</a></sup><ahref="#fnref347"class="footnote-back">↩</a></p></li>
<liid="fn349"><p>Wikipedia, Trim <ahref="https://en.wikipedia.org/wiki/Trim_(computing)"class="uri">https://en.wikipedia.org/wiki/Trim_(computing)</a><sup><ahref="https://wikiless.org/wiki/Trim_(computing)">[Wikiless]</a></sup><sup><ahref="https://web.archive.org/web/https://en.wikipedia.org/wiki/Trim_(computing)">[Archive.org]</a></sup><ahref="#fnref349"class="footnote-back">↩</a></p></li>
<liid="fn350"><p>Veracrypt Documentation, Trim Operations<ahref="https://www.veracrypt.fr/en/Trim%20Operation.html"class="uri">https://www.veracrypt.fr/en/Trim%20Operation.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/Trim%20Operation.html">[Archive.org]</a></sup><ahref="#fnref350"class="footnote-back">↩</a></p></li>
<liid="fn351"><p>Veracrypt Documentation, Rescue Disk <ahref="https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html"class="uri">https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html">[Archive.org]</a></sup><ahref="#fnref351"class="footnote-back">↩</a></p></li>
<liid="fn352"><p>St Cloud State University, Forensic Research on Solid State Drives using Trim Analysis <ahref="https://web.archive.org//web/20220612095503/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds"class="uri">https://web.archive.org//web/20220612095503/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds</a><sup><ahref="https://web.archive.org/web/20211009021236/https://repository.stcloudstate.edu/cgi/viewcontent.cgi?article=1141&context=msia_etds">[Archive.org]</a></sup><ahref="#fnref352"class="footnote-back">↩</a></p></li>
<liid="fn353"><p>WindowsCentral, Trim Tutorial <ahref="https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance"class="uri">https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance</a><sup><ahref="https://web.archive.org/web/https://www.windowscentral.com/how-ensure-trim-enabled-windows-10-speed-ssd-performance">[Archive.org]</a></sup><ahref="#fnref353"class="footnote-back">↩</a></p></li>
<liid="fn354"><p>Veracrypt Documentation, Trim Operation <ahref="https://veracrypt.eu/en/docs/trim-operation/"class="uri">https://veracrypt.eu/en/docs/trim-operation/</a><sup><ahref="https://web.archive.org/web/https://veracrypt.eu/en/docs/trim-operation/">[Archive.org]</a></sup><ahref="#fnref354"class="footnote-back">↩</a></p></li>
<liid="fn355"><p>Black Hat 2018, Perfectly Deniable Steganographic Disk Encryption <ahref="https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf"class="uri">https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf</a><sup><ahref="https://web.archive.org/web/https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectly-Deniable-Steganographic-Disk-Encryption.pdf">[Archive.org]</a></sup><ahref="#fnref355"class="footnote-back">↩</a></p></li>
<liid="fn356"><p>Milan Broz’s Blog, TRIM & dm-crypt … problems?<ahref="http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html"class="uri">http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html</a><sup><ahref="https://web.archive.org/web/http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html">[Archive.org]</a></sup><ahref="#fnref356"class="footnote-back">↩</a></p></li>
<liid="fn357"><p>Veracrypt Documentation, Rescue Disk <ahref="https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html"class="uri">https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html</a><sup><ahref="https://web.archive.org/web/https://www.veracrypt.fr/en/VeraCrypt%20Rescue%20Disk.html">[Archive.org]</a></sup><ahref="#fnref357"class="footnote-back">↩</a></p></li>
<liid="fn385"><p>hCaptcha, hCaptcha Is Now the Largest Independent CAPTCHA Service, Runs on 15% Of The Internet <ahref="https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service"class="uri">https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service</a><sup><ahref="https://web.archive.org/web/https://www.hcaptcha.com/post/hcaptcha-now-the-largest-independent-captcha-service">[Archive.org]</a></sup><ahref="#fnref385"class="footnote-back">↩</a></p></li>
<liid="fn386"><p>Nearcyan.com, You (probably) don’t need ReCAPTCHA <ahref="https://nearcyan.com/you-probably-dont-need-recaptcha/"class="uri">https://nearcyan.com/you-probably-dont-need-recaptcha/</a><sup><ahref="https://web.archive.org/web/https://nearcyan.com/you-probably-dont-need-recaptcha/">[Archive.org]</a></sup><ahref="#fnref386"class="footnote-back">↩</a></p></li>
<liid="fn387"><p>ArsTechnica, “Google’s reCAPTCHA turns”invisible," will separate bots from people without challenges"<ahref="https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/"class="uri">https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/</a><sup><ahref="https://web.archive.org/web/https://arstechnica.com/gadgets/2017/03/googles-recaptcha-announces-invisible-background-captchas/">[Archive.org]</a></sup><ahref="#fnref387"class="footnote-back">↩</a></p></li>
<liid="fn388"><p>BlackHat Asia 2016, “I’m not a human: Breaking the Google reCAPTCHA”<ahref="https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf"class="uri">https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf</a><sup><ahref="https://web.archive.org/web/https://www.blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf">[Archive.org]</a></sup><ahref="#fnref388"class="footnote-back">↩</a></p></li>
<liid="fn389"><p>Google Blog <ahref="https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html"class="uri">https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html</a><sup><ahref="https://web.archive.org/web/https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html">[Archive.org]</a></sup><ahref="#fnref389"class="footnote-back">↩</a></p></li>
<liid="fn396"><p>Developers Google Blog, Guidance to developers affected by our effort to block less secure browsers and applications <ahref="https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html"class="uri">https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html</a><sup><ahref="https://web.archive.org/web/https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html">[Archive.org]</a></sup><ahref="#fnref396"class="footnote-back">↩</a></p></li>
<liid="fn398"><p>Google Help, Access age-restricted content & features <ahref="https://support.google.com/accounts/answer/10071085"class="uri">https://support.google.com/accounts/answer/10071085</a><sup><ahref="https://web.archive.org/web/https://support.google.com/accounts/answer/10071085">[Archive.org]</a></sup><ahref="#fnref398"class="footnote-back">↩</a></p></li>
Loaded 100 of 180 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
