mirror of
https://github.com/Anon-Planet/thgtoa.git
synced 2026-03-23 13:13:25 +01:00
Fixed all the "we" and reverted some
Fixed the collated "we" Reverted some that should have stayed "I" in references Fixed grammar "I am" > "We are" and so son...
This commit is contained in:
246
guide.md
246
guide.md
@@ -592,7 +592,7 @@ Unfortunately, the TLS protocol used in most HTTPS connections in most Browsers
|
|||||||
|
|
||||||
![][50]
|
![][50]
|
||||||
|
|
||||||
In addition to limited browser support, only Web Services and CDNs[^43] behind Cloudflare CDN support ECH/eSNI at this stage[^44]. This means that ECH and eSNI are not supported (as of the writing of this guide) by most mainstream platforms such as:
|
In addition to limited browser support, only web Services and CDNs[^43] behind Cloudflare CDN support ECH/eSNI at this stage[^44]. This means that ECH and eSNI are not supported (as of the writing of this guide) by most mainstream platforms such as:
|
||||||
|
|
||||||
- Amazon (including AWS, Twitch...)
|
- Amazon (including AWS, Twitch...)
|
||||||
|
|
||||||
@@ -1464,7 +1464,7 @@ Yet, this is not stopping some from doing it anyway and publishing various produ
|
|||||||
|
|
||||||
Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization.
|
Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization.
|
||||||
|
|
||||||
In the context of this guide,Werecommend sticking to Apps/Services using well-established, published, and peer-reviewed methods.
|
In the context of this guide,we recommend sticking to Apps/Services using well-established, published, and peer-reviewed methods.
|
||||||
|
|
||||||
So, what to prefer and what to avoid as of 2021? You will have to look up for yourself to get the technical details of each app and see if they are using "bad crypto" or "good crypto". Once you get the technical details, you could check this page for seeing what it is worth: <https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html> <sup>[[Archive.org]][166]</sup>
|
So, what to prefer and what to avoid as of 2021? You will have to look up for yourself to get the technical details of each app and see if they are using "bad crypto" or "good crypto". Once you get the technical details, you could check this page for seeing what it is worth: <https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html> <sup>[[Archive.org]][166]</sup>
|
||||||
|
|
||||||
@@ -1561,13 +1561,13 @@ Any of those providers can be forced to silently (without your knowing (using fo
|
|||||||
|
|
||||||
- 2011, HideMyAss user was de-anonymized, and logs were provided to the FBI[^282].
|
- 2011, HideMyAss user was de-anonymized, and logs were provided to the FBI[^282].
|
||||||
|
|
||||||
Some providers have implemented the use of a Warrant Canary[^283] that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far asWeknow.
|
Some providers have implemented the use of a Warrant Canary[^283] that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.
|
||||||
|
|
||||||
Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story[^284] and Omnisec story[^285]).
|
Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story[^284] and Omnisec story[^285]).
|
||||||
|
|
||||||
For these reasons, you mustn't trust such providers for your privacy despite all their claims. In most cases, you will be the last person to know if any of your accounts were targeted by such orders and you might never know at all.
|
For these reasons, you mustn't trust such providers for your privacy despite all their claims. In most cases, you will be the last person to know if any of your accounts were targeted by such orders and you might never know at all.
|
||||||
|
|
||||||
To mitigate this, in cases where you want to use a VPN,Wewill recommend the use of a cash/Monero-paid VPN provider over Tor to prevent the VPN service from knowing any identifiable information about you.
|
To mitigate this, in cases where you want to use a VPN, we will recommend the use of a cash/Monero-paid VPN provider over Tor to prevent the VPN service from knowing any identifiable information about you.
|
||||||
|
|
||||||
If the VPN provider knows nothing about you, it should mitigate any issue due to them not logging but logging anyway.
|
If the VPN provider knows nothing about you, it should mitigate any issue due to them not logging but logging anyway.
|
||||||
|
|
||||||
@@ -1575,7 +1575,7 @@ If the VPN provider knows nothing about you, it should mitigate any issue due to
|
|||||||
|
|
||||||
![][171]
|
![][171]
|
||||||
|
|
||||||
(Illustration: an excellent movieWehighly recommend: Das Leben der Anderen[^286])
|
(Illustration: an excellent movie we highly recommend: Das Leben der Anderen[^286])
|
||||||
|
|
||||||
Many advanced techniques can be used by skilled adversaries[^287] to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here <https://cyber.bgu.ac.il/advanced-cyber/airgap> <sup>[[Archive.org]][172]</sup> (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report <https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf> <sup>[[Archive.org]][173]</sup> (ESET, JUMPING
|
Many advanced techniques can be used by skilled adversaries[^287] to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here <https://cyber.bgu.ac.il/advanced-cyber/airgap> <sup>[[Archive.org]][172]</sup> (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report <https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf> <sup>[[Archive.org]][173]</sup> (ESET, JUMPING
|
||||||
|
|
||||||
@@ -1697,7 +1697,7 @@ If you still do not think such information can be used by various actors to trac
|
|||||||
|
|
||||||
# General Preparations:
|
# General Preparations:
|
||||||
|
|
||||||
Personally, in the context of this guide, it is also interesting to have a look at your security model. And in this context,Weonly have one to recommend:
|
Personally, in the context of this guide, it is also interesting to have a look at your security model. And in this context,we only have one to recommend:
|
||||||
|
|
||||||
Zero-Trust Security[^391] ("Never trust, always verify").
|
Zero-Trust Security[^391] ("Never trust, always verify").
|
||||||
|
|
||||||
@@ -1749,7 +1749,7 @@ First, here is a small basic UML diagram showing your available options accordin
|
|||||||
|
|
||||||
- It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):
|
- It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):
|
||||||
|
|
||||||
- **You could go for any route, butWewould recommend Qubes OS if your threat model allows it.**
|
- **You could go for any route, but we would recommend Qubes OS if your threat model allows it.**
|
||||||
|
|
||||||
- If it is an ARM-based M1 Mac:
|
- If it is an ARM-based M1 Mac:
|
||||||
|
|
||||||
@@ -1765,7 +1765,7 @@ First, here is a small basic UML diagram showing your available options accordin
|
|||||||
|
|
||||||
- **Qubes OS is not supported on ARM architecture yet.**
|
- **Qubes OS is not supported on ARM architecture yet.**
|
||||||
|
|
||||||
**Your only option on M1 Macs is probably to stick with Tor Browses for now. ButWewould guess that if you can afford an M1 Mac you should probably get a dedicated x86 laptop for more sensitive activities.**
|
**Your only option on M1 Macs is probably to stick with Tor Browses for now. But we would guess that if you can afford an M1 Mac you should probably get a dedicated x86 laptop for more sensitive activities.**
|
||||||
|
|
||||||
### Skills:
|
### Skills:
|
||||||
|
|
||||||
@@ -1885,7 +1885,7 @@ In all cases, you should read these two pages from the Whonix documentation that
|
|||||||
|
|
||||||
- <https://www.whonix.org/wiki/Comparison_with_Others> <sup>[[Archive.org]][223]</sup>
|
- <https://www.whonix.org/wiki/Comparison_with_Others> <sup>[[Archive.org]][223]</sup>
|
||||||
|
|
||||||
You might be asking yourself: "How doWeknow if I'm in a hostile online environment where activities are actively monitored and blocked?"
|
You might be asking yourself: "How do I know if I'm in a hostile online environment where activities are actively monitored and blocked?"
|
||||||
|
|
||||||
- First read more about it at the EFF here: <https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship> <sup>[[Archive.org]][224]</sup>
|
- First read more about it at the EFF here: <https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship> <sup>[[Archive.org]][224]</sup>
|
||||||
|
|
||||||
@@ -1923,7 +1923,7 @@ It will also be crucial not to power on that burner phone ever (not even without
|
|||||||
|
|
||||||
See [Appendix N: Warning about smartphones and smart devices]
|
See [Appendix N: Warning about smartphones and smart devices]
|
||||||
|
|
||||||
You should test that the phone is in working order before going to the next step. ButWewill repeat myself and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either.
|
You should test that the phone is in working order before going to the next step. But we will repeat myself and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either.
|
||||||
|
|
||||||
When you are certain the phone is in working order, disable Bluetooth then power it off (remove the battery if you can) and go back home and resume your normal activities. Go to the next step.
|
When you are certain the phone is in working order, disable Bluetooth then power it off (remove the battery if you can) and go back home and resume your normal activities. Go to the next step.
|
||||||
|
|
||||||
@@ -1951,7 +1951,7 @@ There are many commercial services offering numbers to receive SMS messages onli
|
|||||||
|
|
||||||
There are some forums and subreddits (like r/phoneverification/) where users will offer the service of receiving such SMS messages for you for a small fee (using PayPal or some crypto payment). Unfortunately, these are full of scammers and very risky in terms of anonymity. **You should not use those under any circumstance.**
|
There are some forums and subreddits (like r/phoneverification/) where users will offer the service of receiving such SMS messages for you for a small fee (using PayPal or some crypto payment). Unfortunately, these are full of scammers and very risky in terms of anonymity. **You should not use those under any circumstance.**
|
||||||
|
|
||||||
To this date,Wedo not know any reputable service that would offer this service and accept cash payments (by post for instance) like some VPN providers. But a few services are providing online phone numbers and do accept Monero which could be reasonably anonymous (yet less recommended than that physical way in the earlier chapter) that you could consider:
|
To this date,we do not know any reputable service that would offer this service and accept cash payments (by post for instance) like some VPN providers. But a few services are providing online phone numbers and do accept Monero which could be reasonably anonymous (yet less recommended than that physical way in the earlier chapter) that you could consider:
|
||||||
|
|
||||||
- **Recommended**: Do not require any identification (even e-mail):
|
- **Recommended**: Do not require any identification (even e-mail):
|
||||||
|
|
||||||
@@ -1977,7 +1977,7 @@ Now, what if you have no money? Well, in that case, you will have to try your lu
|
|||||||
|
|
||||||
- <https://sms24.me>
|
- <https://sms24.me>
|
||||||
|
|
||||||
**DISCLAIMER:Wecannot vouch for any of these providers and thereforeWewill still recommend doing it yourself physically. In this case, you will have to rely on the anonymity of Monero and you should not use any service that requires any kind of identification using your real identity. Please do read [Appendix B2: Monero Disclaimer].**
|
**DISCLAIMER:We cannot vouch for any of these providers and therefore we will still recommend doing it yourself physically. In this case, you will have to rely on the anonymity of Monero and you should not use any service that requires any kind of identification using your real identity. Please do read [Appendix B2: Monero Disclaimer].**
|
||||||
|
|
||||||
Therefore IMHO, it is just more convenient, cheaper, and less risky to just get a pre-paid SIM card from one of the physical places that still sell them for cash without requiring ID registration. But at least there is an alternative if you have no other choice.
|
Therefore IMHO, it is just more convenient, cheaper, and less risky to just get a pre-paid SIM card from one of the physical places that still sell them for cash without requiring ID registration. But at least there is an alternative if you have no other choice.
|
||||||
|
|
||||||
@@ -1985,7 +1985,7 @@ Therefore IMHO, it is just more convenient, cheaper, and less risky to just get
|
|||||||
|
|
||||||
**Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms but just want anonymous browsing or if the platforms you will use allow registration without a phone number.**
|
**Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms but just want anonymous browsing or if the platforms you will use allow registration without a phone number.**
|
||||||
|
|
||||||
Get at least one or two decent size generic USB keys (at least 16GB butWewould recommend 32GB).
|
Get at least one or two decent size generic USB keys (at least 16GB but we would recommend 32GB).
|
||||||
|
|
||||||
Please do not buy or use gimmicky self-encrypting devices such as these: <https://syscall.eu/blog/2018/03/12/aigo_part1/> <sup>[[Archive.org]][235]</sup>
|
Please do not buy or use gimmicky self-encrypting devices such as these: <https://syscall.eu/blog/2018/03/12/aigo_part1/> <sup>[[Archive.org]][235]</sup>
|
||||||
|
|
||||||
@@ -2183,7 +2183,7 @@ Now, you are really done, and you can now surf the web anonymously from your iOS
|
|||||||
|
|
||||||
**This route is the easiest but is not designed to resist highly skilled adversaries. It is however usable on any device regardless of the configuration. This route is also vulnerable to correlation attacks (See [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]) and is blind to anything that might be on your device (this could be any malware, exploit, virus, remote administration software, parental controls...). Yet, if your threat model is quite low, it is probably sufficient for most people.**
|
**This route is the easiest but is not designed to resist highly skilled adversaries. It is however usable on any device regardless of the configuration. This route is also vulnerable to correlation attacks (See [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]) and is blind to anything that might be on your device (this could be any malware, exploit, virus, remote administration software, parental controls...). Yet, if your threat model is quite low, it is probably sufficient for most people.**
|
||||||
|
|
||||||
If you have time and want to learn,Werecommend going for other routes instead as they offer far better security and mitigate far more risks while lowering your attack surface considerably.
|
If you have time and want to learn, we recommend going for other routes instead as they offer far better security and mitigate far more risks while lowering your attack surface considerably.
|
||||||
|
|
||||||
## The Tails route:
|
## The Tails route:
|
||||||
|
|
||||||
@@ -2563,7 +2563,7 @@ Cold Boot attacks[^319] are trickier than the Evil Maid Attack but can be part o
|
|||||||
|
|
||||||
The idea is rather simple, as shown in this video[^320], an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and "cool down" the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.
|
The idea is rather simple, as shown in this video[^320], an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and "cool down" the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.
|
||||||
|
|
||||||
In the case of Plausible Deniability, there have been some forensics studies[^321] about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies[^322] and by the maintainer of Veracrypt[^323] soWewould not worry too much about those yet.
|
In the case of Plausible Deniability, there have been some forensics studies[^321] about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies[^322] and by the maintainer of Veracrypt[^323] so we would not worry too much about those yet.
|
||||||
|
|
||||||
The same measures used to mitigate Evil Maid attacks should be in place for Cold Boot attacks with some added ones:
|
The same measures used to mitigate Evil Maid attacks should be in place for Cold Boot attacks with some added ones:
|
||||||
|
|
||||||
@@ -2663,9 +2663,9 @@ In the case of Windows, this data could for instance be used to prove the existe
|
|||||||
|
|
||||||
You should never conduct sensitive activities from a non-encrypted system. And even if it is encrypted, you should never conduct sensitive activities from the Host OS itself. Instead, you should use a VM to be able to efficiently isolate and compartmentalize your activities and prevent local data leaks.
|
You should never conduct sensitive activities from a non-encrypted system. And even if it is encrypted, you should never conduct sensitive activities from the Host OS itself. Instead, you should use a VM to be able to efficiently isolate and compartmentalize your activities and prevent local data leaks.
|
||||||
|
|
||||||
If you have little to no knowledge of Linux or if you want to use OS-wide plausible deniability,Werecommend going for Windows (or back to the Tails route) for convenience. This guide will help you hardening it as much as possible to prevent leaks. This guide will also help you hardening macOS and Linux as much as possible to prevent similar leaks.
|
If you have little to no knowledge of Linux or if you want to use OS-wide plausible deniability, we recommend going for Windows (or back to the Tails route) for convenience. This guide will help you hardening it as much as possible to prevent leaks. This guide will also help you hardening macOS and Linux as much as possible to prevent similar leaks.
|
||||||
|
|
||||||
If you have no interest in OS-wide plausible deniability and want to learn to use Linux,Wewill strongly recommend going for Linux or the Qubes OS route if your hardware allows it.
|
If you have no interest in OS-wide plausible deniability and want to learn to use Linux, we will strongly recommend going for Linux or the Qubes OS route if your hardware allows it.
|
||||||
|
|
||||||
**In all cases, the host OS should never be used to conduct sensitive activities directly. The host OS will only be used to connect to a public Wi-Fi Access Point. It will be left unused while you conduct sensitive activities and should ideally not be used for any of your day-to-day activities.**
|
**In all cases, the host OS should never be used to conduct sensitive activities directly. The host OS will only be used to connect to a public Wi-Fi Access Point. It will be left unused while you conduct sensitive activities and should ideally not be used for any of your day-to-day activities.**
|
||||||
|
|
||||||
@@ -2673,7 +2673,7 @@ Consider also reading **<https://www.whonix.org/wiki/Full_Disk_Encryption#Encryp
|
|||||||
|
|
||||||
### Linux Host OS:
|
### Linux Host OS:
|
||||||
|
|
||||||
As mentioned earlier,Wedo not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
As mentioned earlier, wedo not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
||||||
|
|
||||||
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
||||||
|
|
||||||
@@ -2705,11 +2705,11 @@ For other distros, you will have to document yourself, but it will likely be sim
|
|||||||
|
|
||||||
#### Note about plausible deniability on Linux:
|
#### Note about plausible deniability on Linux:
|
||||||
|
|
||||||
There are several ways to achieve plausible deniability on Linux[^329] and it is possible to achieve. Here are some more details about some of the waysWewould recommend. All these options require some higher level of skills at using Linux.
|
There are several ways to achieve plausible deniability on Linux[^329] and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux.
|
||||||
|
|
||||||
##### The Detached Headers Way:
|
##### The Detached Headers Way:
|
||||||
|
|
||||||
While not supported yet by this guide, it is possible to achieve a form of deniability on Linux using LUKS by using detached LUKS headers. For now,Wewill redirect you toward this page for more information: <https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header> <sup>[[Archive.org]][275]</sup>
|
While not supported yet by this guide, it is possible to achieve a form of deniability on Linux using LUKS by using detached LUKS headers. For now, we will redirect you toward this page for more information: <https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header> <sup>[[Archive.org]][275]</sup>
|
||||||
|
|
||||||
##### The Veracrypt Way:
|
##### The Veracrypt Way:
|
||||||
|
|
||||||
@@ -2795,7 +2795,7 @@ See [Appendix G: Safe Browser on the Host OS]
|
|||||||
|
|
||||||
**Note: At this time, this guide will not support ARM M1 MacBooks (yet). Due to Virtualbox not supporting this architecture yet. It could however be possible if you use commercial tools like VMWare or Parallels but those are not covered in this guide.**
|
**Note: At this time, this guide will not support ARM M1 MacBooks (yet). Due to Virtualbox not supporting this architecture yet. It could however be possible if you use commercial tools like VMWare or Parallels but those are not covered in this guide.**
|
||||||
|
|
||||||
As mentioned earlier,Wedo not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
As mentioned earlier, we do not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
||||||
|
|
||||||
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
||||||
|
|
||||||
@@ -2815,7 +2815,7 @@ I also recommend that you do the initial installation completely offline to avoi
|
|||||||
|
|
||||||
As a light introduction for new macOS users, consider <https://www.youtube.com/watch?v=lFx5icuE6Io> <sup>[[Invidious]][293]</sup>
|
As a light introduction for new macOS users, consider <https://www.youtube.com/watch?v=lFx5icuE6Io> <sup>[[Invidious]][293]</sup>
|
||||||
|
|
||||||
Now to go more in-depth in securing and hardening your macOS,Werecommend reading this guide which covers many of the issues: <https://www.bejarano.io/hardening-macos/> <sup>[[Archive.org]][294]</sup>
|
Now to go more in-depth in securing and hardening your macOS, we recommend reading this guide which covers many of the issues: <https://www.bejarano.io/hardening-macos/> <sup>[[Archive.org]][294]</sup>
|
||||||
|
|
||||||
|
|
||||||
Here are the basic steps you should take after your offline installation:
|
Here are the basic steps you should take after your offline installation:
|
||||||
@@ -2828,7 +2828,7 @@ Unfortunately, some attacks are still possible and an adversary could disable th
|
|||||||
|
|
||||||
##### Enable Hibernation instead of sleep:
|
##### Enable Hibernation instead of sleep:
|
||||||
|
|
||||||
Again, this is to prevent some cold-boot and evil-maid attacks by powering down your RAM and cleaning the encryption key when you close the lid. You should always either hibernate or shut down. On macOS, the hibernate feature even has a special option to specifically clear the encryption key from memory when hibernating (while you might have to wait for the memory to decay on other Operating Systems). Once again there are no easy options to do this within the settings so instead,Wewill have to do this by running a few commands to enable hibernation:
|
Again, this is to prevent some cold-boot and evil-maid attacks by powering down your RAM and cleaning the encryption key when you close the lid. You should always either hibernate or shut down. On macOS, the hibernate feature even has a special option to specifically clear the encryption key from memory when hibernating (while you might have to wait for the memory to decay on other Operating Systems). Once again there are no easy options to do this within the settings so instead, we will have to do this by running a few commands to enable hibernation:
|
||||||
|
|
||||||
- Open a Terminal
|
- Open a Terminal
|
||||||
|
|
||||||
@@ -2868,7 +2868,7 @@ You could block OCSP reporting by issuing the following command in Terminal:
|
|||||||
|
|
||||||
But you should document yourself on the actual issue before acting. This page is a good place to start: <https://blog.jacopo.io/en/post/apple-ocsp/> <sup>[[Archive.org]][297]</sup>
|
But you should document yourself on the actual issue before acting. This page is a good place to start: <https://blog.jacopo.io/en/post/apple-ocsp/> <sup>[[Archive.org]][297]</sup>
|
||||||
|
|
||||||
Up to you really. We would block it becauseWedo not want any telemetry at all from my OS to the mothership without my specific consent. None.
|
Up to you really. We would block it because we do not want any telemetry at all from my OS to the mothership without my specific consent. None.
|
||||||
|
|
||||||
##### Enable Full Disk encryption (Filevault):
|
##### Enable Full Disk encryption (Filevault):
|
||||||
|
|
||||||
@@ -2894,7 +2894,7 @@ See [Appendix G: Safe Browser on the Host OS]
|
|||||||
|
|
||||||
### Windows Host OS:
|
### Windows Host OS:
|
||||||
|
|
||||||
As mentioned earlier,Wedo not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
As mentioned earlier, we do not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk.
|
||||||
|
|
||||||
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
I also recommend that you do the initial installation completely offline to avoid any data leak.
|
||||||
|
|
||||||
@@ -2924,7 +2924,7 @@ See [Appendix B: Windows Additional Privacy Settings]
|
|||||||
|
|
||||||
###### If you intend to use system-wide plausible deniability:
|
###### If you intend to use system-wide plausible deniability:
|
||||||
|
|
||||||
Veracrypt[^330] is the softwareWewill recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:
|
Veracrypt[^330] is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:
|
||||||
|
|
||||||
- Full Disk simple encryption (your hard drive is encrypted with one passphrase).
|
- Full Disk simple encryption (your hard drive is encrypted with one passphrase).
|
||||||
|
|
||||||
@@ -2954,7 +2954,7 @@ More details later in [Route A and B: Simple Encryption using Veracrypt (Windows
|
|||||||
|
|
||||||
###### If you do not intend to use system-wide plausible deniability:
|
###### If you do not intend to use system-wide plausible deniability:
|
||||||
|
|
||||||
For this case,Wewill recommend the use of BitLocker instead of Veracrypt for the full disk encryption. The reasoning is that BitLocker does not offer a plausible deniability possibility contrary to Veracrypt. A hard adversary has then no incentive in pursuing his "enhanced" interrogation if you reveal the passphrase.
|
For this case, we will recommend the use of BitLocker instead of Veracrypt for the full disk encryption. The reasoning is that BitLocker does not offer a plausible deniability possibility contrary to Veracrypt. A hard adversary has then no incentive in pursuing his "enhanced" interrogation if you reveal the passphrase.
|
||||||
|
|
||||||
Normally, you should have installed Windows Pro in this case and the BitLocker setup is quite straightforward.
|
Normally, you should have installed Windows Pro in this case and the BitLocker setup is quite straightforward.
|
||||||
|
|
||||||
@@ -3578,7 +3578,7 @@ More information at:
|
|||||||
|
|
||||||
#### Tor over VPN:
|
#### Tor over VPN:
|
||||||
|
|
||||||
You might be wondering: Well, what about using Tor over VPN instead of VPN over Tor? Well,Wewould not necessarily recommend it:
|
You might be wondering: Well, what about using Tor over VPN instead of VPN over Tor? Well, we would not necessarily recommend it:
|
||||||
|
|
||||||
- Disadvantages:
|
- Disadvantages:
|
||||||
|
|
||||||
@@ -3651,13 +3651,13 @@ If you have absolutely no other option and still want to do something, see [Appe
|
|||||||
|
|
||||||
Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor is still the best solution for anonymity and must be somewhere for anonymity.
|
Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor is still the best solution for anonymity and must be somewhere for anonymity.
|
||||||
|
|
||||||
- If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard,Werecommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity.
|
- If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard, we recommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity.
|
||||||
|
|
||||||
- **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details).
|
- **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details).
|
||||||
|
|
||||||
- If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **ThenWerecommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).**
|
- If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **Then we recommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).**
|
||||||
|
|
||||||
- If cost is an issue,Werecommend the Tor Only option if possible.
|
- If cost is an issue, we recommend the Tor Only option if possible.
|
||||||
|
|
||||||
- If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option]
|
- If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option]
|
||||||
|
|
||||||
@@ -3781,7 +3781,7 @@ Finally, consider the security advice from Virtualbox themselves here <https://w
|
|||||||
|
|
||||||
If you intend to use Tor over VPN for any reason. You first must configure a VPN service on your host OS.
|
If you intend to use Tor over VPN for any reason. You first must configure a VPN service on your host OS.
|
||||||
|
|
||||||
Remember that in this case,Werecommend having two VPN accounts. Both paid with cash/Monero (see [Appendix O: Getting an anonymous VPN/Proxy]). One will be used in the Host OS for the first VPN connection. The other could be used in the VM to achieve VPN over Tor over VPN (User > VPN > Tor > VPN).
|
Remember that in this case, we recommend having two VPN accounts. Both paid with cash/Monero (see [Appendix O: Getting an anonymous VPN/Proxy]). One will be used in the Host OS for the first VPN connection. The other could be used in the VM to achieve VPN over Tor over VPN (User > VPN > Tor > VPN).
|
||||||
|
|
||||||
If you intend to only use Tor over VPN, you only need one VPN account.
|
If you intend to only use Tor over VPN, you only need one VPN account.
|
||||||
|
|
||||||
@@ -3857,7 +3857,7 @@ Use the Linux Distro of your choice.Wewould recommend Ubuntu or Fedora for conve
|
|||||||
|
|
||||||
##### Choose a browser within the VM:
|
##### Choose a browser within the VM:
|
||||||
|
|
||||||
This time,Wewill recommend Brave browser.
|
This time, we will recommend Brave browser.
|
||||||
|
|
||||||
See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM]
|
See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM]
|
||||||
|
|
||||||
@@ -4133,7 +4133,7 @@ Refer to [Hardening macOS].
|
|||||||
|
|
||||||
#### Choose a browser within the VM:
|
#### Choose a browser within the VM:
|
||||||
|
|
||||||
This time,Wewill recommend Brave browser.
|
This time, we will recommend Brave browser.
|
||||||
|
|
||||||
See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM]
|
See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM]
|
||||||
|
|
||||||
@@ -4143,7 +4143,7 @@ See [Appendix V1: Hardening your Browsers][Appendix V1: Hardening your Browsers:
|
|||||||
|
|
||||||
You will need something to store your data (logins/passwords, identities, and TOTP[^359] information).
|
You will need something to store your data (logins/passwords, identities, and TOTP[^359] information).
|
||||||
|
|
||||||
For this purpose,Westrongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA[^360] authentication with the authenticator feature.
|
For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA[^360] authentication with the authenticator feature.
|
||||||
|
|
||||||
Remember this should ideally be installed on your Guest VM and not on your Host OS. You should never do any sensitive activities from your Host OS.
|
Remember this should ideally be installed on your Guest VM and not on your Host OS. You should never do any sensitive activities from your Host OS.
|
||||||
|
|
||||||
@@ -4209,7 +4209,7 @@ There are three ways to do this:
|
|||||||
|
|
||||||
#### The Lazy Way (**not supported by Whonix** but it will work if you are in a hurry, see further for the better way):
|
#### The Lazy Way (**not supported by Whonix** but it will work if you are in a hurry, see further for the better way):
|
||||||
|
|
||||||
**This way is not supported by the Whonix project**[^361] butWewill go ahead and give this option anyway. IMHO this is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.
|
**This way is not supported by the Whonix project**[^361] but we will go ahead and give this option anyway. IMHO this is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.
|
||||||
|
|
||||||
**Note that this option as-is will only work on Wi-Fis without a captive portal (where you must enter some information to unlock access).**
|
**Note that this option as-is will only work on Wi-Fis without a captive portal (where you must enter some information to unlock access).**
|
||||||
|
|
||||||
@@ -4219,7 +4219,7 @@ The illustration below shows the result of this step:
|
|||||||
|
|
||||||
##### Configuration of the Whonix Gateway VM:
|
##### Configuration of the Whonix Gateway VM:
|
||||||
|
|
||||||
For this to work,Wewill need to change some configurations on the Whonix Gateway VM. You will need to add a DHCP client to the Whonix Gateway to receive IP addresses from the network. To do those changes the Host OS will still have to have internet access allowed for now.
|
For this to work,Wewill need to change some configurations on the Whonix Gateway VM. we will need to add a DHCP client to the Whonix Gateway to receive IP addresses from the network. To do those changes the Host OS will still have to have internet access allowed for now.
|
||||||
|
|
||||||
So here is how:
|
So here is how:
|
||||||
|
|
||||||
@@ -4331,7 +4331,7 @@ Yet this will still not be supported by the Whonix project, but it is fine as th
|
|||||||
|
|
||||||
This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge.
|
This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge.
|
||||||
|
|
||||||
For this purpose,Wewill recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro andWewould recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.
|
For this purpose,we will recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro and we would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.
|
||||||
|
|
||||||
Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.
|
Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.
|
||||||
|
|
||||||
@@ -4543,7 +4543,7 @@ This way will not go against Whonix recommendations (as it will not expose the W
|
|||||||
|
|
||||||
This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge and to connect to the Wi-Fi network. **This option requires a working USB Wi-Fi Dongle that will be passed through to a bridge VM.**
|
This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge and to connect to the Wi-Fi network. **This option requires a working USB Wi-Fi Dongle that will be passed through to a bridge VM.**
|
||||||
|
|
||||||
For this purpose,Wewill recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro andWewould recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.
|
For this purpose,Wewill recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro and we would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.
|
||||||
|
|
||||||
Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.
|
Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.
|
||||||
|
|
||||||
@@ -4890,13 +4890,13 @@ If you have absolutely no other option and still want to do something, see [Appe
|
|||||||
|
|
||||||
Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor remains the best solution for anonymity and must be somewhere for anonymity.
|
Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor remains the best solution for anonymity and must be somewhere for anonymity.
|
||||||
|
|
||||||
- If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard,Werecommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity.
|
- If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard, we recommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity.
|
||||||
|
|
||||||
- **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details).
|
- **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details).
|
||||||
|
|
||||||
- If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **ThenWerecommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).**
|
- If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **Then we recommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).**
|
||||||
|
|
||||||
- If cost is an issue,Werecommend the Tor Only option if possible.
|
- If cost is an issue, we recommend the Tor Only option if possible.
|
||||||
|
|
||||||
- If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option]
|
- If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option]
|
||||||
|
|
||||||
@@ -4962,7 +4962,7 @@ The Qubes master signing key fingerprint should match `427F 11FD 0FAA 4B08 0123
|
|||||||
|
|
||||||
### Lid Closure Behavior:
|
### Lid Closure Behavior:
|
||||||
|
|
||||||
Unfortunately, Qubes OS does not support hibernation[^366] which is IMHO an issue regarding cold-boot attacks. To mitigate those,Wehighly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.
|
Unfortunately, Qubes OS does not support hibernation[^366] which is IMHO an issue regarding cold-boot attacks. To mitigate those, we highly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.
|
||||||
|
|
||||||
### Connect to a Public Wi-Fi:
|
### Connect to a Public Wi-Fi:
|
||||||
|
|
||||||
@@ -5000,7 +5000,7 @@ Remember this should be done from a safe place (see [Find some safe places with
|
|||||||
|
|
||||||
### Upgrading Qubes OS from 4.0.x to 4.1.x (you should do it)
|
### Upgrading Qubes OS from 4.0.x to 4.1.x (you should do it)
|
||||||
|
|
||||||
Personally,Wewouldn't do it in-place and do a fresh install.
|
Personally, we wouldn't do it in-place and do a fresh install.
|
||||||
|
|
||||||
But if you really want to, it's technically possible by following this guide: <https://www.qubes-os.org/doc/upgrade/4.1/> <sup>[[Archive.org]][1372]</sup>
|
But if you really want to, it's technically possible by following this guide: <https://www.qubes-os.org/doc/upgrade/4.1/> <sup>[[Archive.org]][1372]</sup>
|
||||||
|
|
||||||
@@ -5066,7 +5066,7 @@ Basically, AppArmor[^367] is an application sandboxing system. By default, it is
|
|||||||
|
|
||||||
##### SELinux:
|
##### SELinux:
|
||||||
|
|
||||||
SELinux[^368] is similar to AppArmor. The differences between SELinux and AppArmor are technical details into whichWewill not get.
|
SELinux[^368] is similar to AppArmor. The differences between SELinux and AppArmor are technical details into which we will not get.
|
||||||
|
|
||||||
Here is a good explanation of what it is: <https://www.youtube.com/watch?v=_WOKRaM-HI4> <sup>[[Invidious]][375]</sup>
|
Here is a good explanation of what it is: <https://www.youtube.com/watch?v=_WOKRaM-HI4> <sup>[[Invidious]][375]</sup>
|
||||||
|
|
||||||
@@ -5135,7 +5135,7 @@ When you are done downloading the configuration files within the Disposable Brow
|
|||||||
|
|
||||||
- Save and exit each file
|
- Save and exit each file
|
||||||
|
|
||||||
- Edit the OpenVPN config file (/etc/default/openvpn) by typing ```sudo nano /etc/default/openvpn``` (becauseWedo not like vi editor)
|
- Edit the OpenVPN config file (/etc/default/openvpn) by typing ```sudo nano /etc/default/openvpn```
|
||||||
|
|
||||||
- Change ```#AUTOSTART="all"``` to ```AUTOSTART="all"``` (in other words, remove the "#")
|
- Change ```#AUTOSTART="all"``` to ```AUTOSTART="all"``` (in other words, remove the "#")
|
||||||
|
|
||||||
@@ -5345,7 +5345,7 @@ Basically, follow the tutorial here:
|
|||||||
|
|
||||||
- Click Create Qubes VM
|
- Click Create Qubes VM
|
||||||
|
|
||||||
- Name and label as you wish:Wesuggest "Android"
|
- Name and label as you wish: we suggest "Android"
|
||||||
|
|
||||||
- Select Type: Standalone Qube copied from a template
|
- Select Type: Standalone Qube copied from a template
|
||||||
|
|
||||||
@@ -5415,7 +5415,7 @@ That's it, you should now have an Android Qube over Tor (or anything else) capab
|
|||||||
|
|
||||||
You will need something to store your data (logins/passwords, identities, and TOTP[^369] information).
|
You will need something to store your data (logins/passwords, identities, and TOTP[^369] information).
|
||||||
|
|
||||||
For this purpose,Westrongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA[^370] authentication with the authenticator feature.
|
For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA[^370] authentication with the authenticator feature.
|
||||||
|
|
||||||
In the context of Qubes OS you should store your sensitive information within the Domain-vault Qube:
|
In the context of Qubes OS you should store your sensitive information within the Domain-vault Qube:
|
||||||
|
|
||||||
@@ -5477,7 +5477,7 @@ As for Cloudflare (hCaptcha), you could also use their Accessibility solution he
|
|||||||
|
|
||||||
You should therefore deal with those carefully and force yourself to alter the way you are solving them (speed/movement/accuracy/...) to prevent "Captcha Fingerprinting".
|
You should therefore deal with those carefully and force yourself to alter the way you are solving them (speed/movement/accuracy/...) to prevent "Captcha Fingerprinting".
|
||||||
|
|
||||||
Fortunately, as far asWeam aware, these are not yet officially/publicly used to de-anonymize users for third parties.
|
Fortunately, as far as we are aware, these are not yet officially/publicly used to de-anonymize users for third parties.
|
||||||
|
|
||||||
To not have those issues, you should consider using a VPN over Tor. And the best option to avoid those is likely to use a self-hosted VPN/Proxy over Tor on a cash/Monero paid VPS server.
|
To not have those issues, you should consider using a VPN over Tor. And the best option to avoid those is likely to use a self-hosted VPN/Proxy over Tor on a cash/Monero paid VPS server.
|
||||||
|
|
||||||
@@ -5497,7 +5497,7 @@ Most platforms will not allow you to register using an "anonymous" or disposable
|
|||||||
|
|
||||||
The key thing to this is that it is becoming increasingly difficult to sign-up for a free e-mail account anywhere without providing (you guessed it) ... a cell phone number. That same cell phone number can be used conveniently to track you down in most places.
|
The key thing to this is that it is becoming increasingly difficult to sign-up for a free e-mail account anywhere without providing (you guessed it) ... a cell phone number. That same cell phone number can be used conveniently to track you down in most places.
|
||||||
|
|
||||||
It is possible that those services (Proton for instance) might require you to provide an e-mail address for registration. In that case,Wewould recommend you create an e-mail address from these providers:
|
It is possible that those services (Proton for instance) might require you to provide an e-mail address for registration. In that case, we would recommend you create an e-mail address from these providers:
|
||||||
|
|
||||||
- MailFence: <https://mailfence.com/>
|
- MailFence: <https://mailfence.com/>
|
||||||
|
|
||||||
@@ -5551,11 +5551,11 @@ Some examples:
|
|||||||
|
|
||||||
### Proof of ID verification:
|
### Proof of ID verification:
|
||||||
|
|
||||||
The deal-breaker in most cases. As far asWeknow, only Facebook and LinkedIn (outside of financial services) have requested such verifications which involve sending pictures of some form of identification (passport, national ID card, driver's license ...). The only way to do this would involve creating fake official documents (forgery) using some decent Photoshop skills and this might be illegal in most places.
|
The deal-breaker in most cases. As far as we know, only Facebook and LinkedIn (outside of financial services) have requested such verifications which involve sending pictures of some form of identification (passport, national ID card, driver's license ...). The only way to do this would involve creating fake official documents (forgery) using some decent Photoshop skills and this might be illegal in most places.
|
||||||
|
|
||||||
Therefore, this is a lineWeam not going to help you cross within this guide. Some services are offering such services online, butWethink they are *bad actors* and are overstepping their boundaries.
|
Therefore, this is a line we are not going to help you cross within this guide. Some services are offering such services online, but we think they are *bad actors* and are overstepping their boundaries.
|
||||||
|
|
||||||
In many countries, only law enforcement, some specific processes (such as GDPR requests), and some well-regulated financial services may request proof of identification. So, the legality of asking for such documents is debatable andWethink such platforms should not be allowed to require those.
|
In many countries, only law enforcement, some specific processes (such as GDPR requests), and some well-regulated financial services may request proof of identification. So, the legality of asking for such documents is debatable and we beieve such platforms should not be allowed to require those.
|
||||||
|
|
||||||
In few countries (like Germany), this practice is illegal and online platforms such as Facebook or LinkedIn are legally bound to allow you to use a pseudonym and remain anonymous.
|
In few countries (like Germany), this practice is illegal and online platforms such as Facebook or LinkedIn are legally bound to allow you to use a pseudonym and remain anonymous.
|
||||||
|
|
||||||
@@ -5583,7 +5583,7 @@ For this reason, this guide does recommend the use of VPN over Tor (and not Tor
|
|||||||
|
|
||||||
Browser and Device[^382] Fingerprinting are usually integrated into the Captcha services but also in other various services.
|
Browser and Device[^382] Fingerprinting are usually integrated into the Captcha services but also in other various services.
|
||||||
|
|
||||||
Many platforms (like Google[^383]) will check your browser for various capabilities and settings and block Browsers they do not like. This is one of the reasonsWerecommend using Chromium-based Browsers such as Brave Browser over Tor Browser within this VM.
|
Many platforms (like Google[^383]) will check your browser for various capabilities and settings and block Browsers they do not like. This is one of the reasons we recommend using Chromium-based Browsers such as Brave Browser over Tor Browser within this VM.
|
||||||
|
|
||||||
Here are some of the things they check within recent browsers:
|
Here are some of the things they check within recent browsers:
|
||||||
|
|
||||||
@@ -5683,7 +5683,7 @@ Some platforms/apps will require you to take a live picture of yourself either d
|
|||||||
|
|
||||||
![][395]
|
![][395]
|
||||||
|
|
||||||
This guide will not cover this one (yet) as it is mainly used on financial platforms (that will be able to identify you with other means anyway) and some dating apps like Tinder[^386]. Unfortunately, this method is now also sometimes being used on Facebook[^387] and Instagram as part of their verification methods (thoWedid not face it yet so far).
|
This guide will not cover this one (yet) as it is mainly used on financial platforms (that will be able to identify you with other means anyway) and some dating apps like Tinder[^386]. Unfortunately, this method is now also sometimes being used on Facebook[^387] and Instagram as part of their verification methods (tho we did not face it yet so far).
|
||||||
|
|
||||||
![][396]
|
![][396]
|
||||||
|
|
||||||
@@ -5733,7 +5733,7 @@ Now that you have a basic understanding of all the ways you can be de-anonymized
|
|||||||
|
|
||||||
- Above all, you cannot trust people
|
- Above all, you cannot trust people
|
||||||
|
|
||||||
So what? Well instead of not trusting anyone or anything,Wewould advise to **"Trust but verify"**[^390] (or "Never trust, always verify" if you are more hardcore about it and want to apply Zero-Trust Security[^391]) instead.
|
So what? Well instead of not trusting anyone or anything, we would advise to **"Trust but verify"**[^390] (or "Never trust, always verify" if you are more hardcore about it and want to apply Zero-Trust Security[^391]) instead.
|
||||||
|
|
||||||
**Do not start this process unless:**
|
**Do not start this process unless:**
|
||||||
|
|
||||||
@@ -5805,11 +5805,11 @@ Tools that can help with this:
|
|||||||
|
|
||||||
Now is also the moment where you could finally consider getting an online phone number as explained in the [Online Phone Number (less recommended)] section.
|
Now is also the moment where you could finally consider getting an online phone number as explained in the [Online Phone Number (less recommended)] section.
|
||||||
|
|
||||||
I will help you bit by listing a few tipsWelearned while researching over the years **(disclaimer: this is based on my individual experiences alone)**:
|
I will help you bit by listing a few tips we learned while researching over the years **(disclaimer: this is based on my individual experiences alone)**:
|
||||||
|
|
||||||
- "Some animals are more equal than others".
|
- "Some animals are more equal than others".
|
||||||
|
|
||||||
- Ethnicity is important and you will have fewer issues and attract less attention to verification algorithms if your identity is Caucasian/East-Asian than if it is Arabic/Black (yes,Wetested this extensively and it is definitely an issue).
|
- Ethnicity is important and you will have fewer issues and attract less attention to verification algorithms if your identity is Caucasian/East-Asian than if it is Arabic/Black (yes, we tested this extensively and it is definitely an issue).
|
||||||
|
|
||||||
- Age is important and you will have fewer issues if you are young (18-22) than if you are middle-aged or older. Platforms seem to be more lenient in not imposing restrictions on new younger audiences.
|
- Age is important and you will have fewer issues if you are young (18-22) than if you are middle-aged or older. Platforms seem to be more lenient in not imposing restrictions on new younger audiences.
|
||||||
|
|
||||||
@@ -5827,7 +5827,7 @@ I will help you bit by listing a few tipsWelearned while researching over the ye
|
|||||||
|
|
||||||
- Brave Browser (Chromium-based) with a Private Tor Tab has (IMHO) a better acceptance level than Tor Browser (Firefox based). You will experience fewer issues with captchas and online platforms[^383] if you use Brave than if you use Tor Browser (feel free to try this yourself).
|
- Brave Browser (Chromium-based) with a Private Tor Tab has (IMHO) a better acceptance level than Tor Browser (Firefox based). You will experience fewer issues with captchas and online platforms[^383] if you use Brave than if you use Tor Browser (feel free to try this yourself).
|
||||||
|
|
||||||
- For every identity, you should have a matching profile picture associated with it. For this purpose,Werecommend you just go to <https://thispersondoesnotexist.com/> <sup>[[Archive.org]][399]</sup> and generate a computer-generated profile picture (Do note that algorithms have been developed[^393]'[^394] to detect these and it might not work 100% of the time). You can also generate such pictures yourself from your computer if you prefer by using the open-source StyleGan project here <https://github.com/NVlabs/stylegan2> <sup>[[Archive.org]][400]</sup>. Just refresh the page until you find a picture that matches your identity in all aspects (age, sex, and ethnicity) and save that picture. It would be even better to have several pictures associated with that identity, butWedo not have an "easy way" of doing that yet.
|
- For every identity, you should have a matching profile picture associated with it. For this purpose, we recommend you just go to <https://thispersondoesnotexist.com/> <sup>[[Archive.org]][399]</sup> and generate a computer-generated profile picture (Do note that algorithms have been developed[^393]'[^394] to detect these and it might not work 100% of the time). You can also generate such pictures yourself from your computer if you prefer by using the open-source StyleGan project here <https://github.com/NVlabs/stylegan2> <sup>[[Archive.org]][400]</sup>. Just refresh the page until you find a picture that matches your identity in all aspects (age, sex, and ethnicity) and save that picture. It would be even better to have several pictures associated with that identity, butWedo not have an "easy way" of doing that yet.
|
||||||
|
|
||||||
- **Bonus**, you could also make it more real by using this service (with an anonymous identity) <https://www.myheritage.com/deep-nostalgia> <sup>[[Archive.org]][401]</sup> to make a picture more lifelike. Here is an example:
|
- **Bonus**, you could also make it more real by using this service (with an anonymous identity) <https://www.myheritage.com/deep-nostalgia> <sup>[[Archive.org]][401]</sup> to make a picture more lifelike. Here is an example:
|
||||||
|
|
||||||
@@ -5961,7 +5961,7 @@ Unfortunately, not using your real identity is against the ToS (Terms of Service
|
|||||||
|
|
||||||
This does not mean that it is illegal in other places but that it might be a breach of their Terms of Services if you do not have the law on your side. **Remember this guide only endorses this for German users residing in Germany.**
|
This does not mean that it is illegal in other places but that it might be a breach of their Terms of Services if you do not have the law on your side. **Remember this guide only endorses this for German users residing in Germany.**
|
||||||
|
|
||||||
On my side,Westrongly condemn this type of real-name policy. See for instance this Wikipedia article giving some examples: <https://en.wikipedia.org/wiki/Facebook_real-name_policy_controversy> <sup>[[Wikiless]][408]</sup> <sup>[[Archive.org]][409]</sup>
|
On my side ,we strongly condemn this type of real-name policy. See for instance this Wikipedia article giving some examples: <https://en.wikipedia.org/wiki/Facebook_real-name_policy_controversy> <sup>[[Wikiless]][408]</sup> <sup>[[Archive.org]][409]</sup>
|
||||||
|
|
||||||
Here are some more references about the German case for reference:
|
Here are some more references about the German case for reference:
|
||||||
|
|
||||||
@@ -5977,7 +5977,7 @@ Here are some more references about the German case for reference:
|
|||||||
|
|
||||||
- <https://www.reuters.com/article/us-germany-facebook/german-court-rules-facebook-use-of-personal-data-illegal-idUSKBN1FW1FI> <sup>[[Archive.org]][414]</sup>
|
- <https://www.reuters.com/article/us-germany-facebook/german-court-rules-facebook-use-of-personal-data-illegal-idUSKBN1FW1FI> <sup>[[Archive.org]][414]</sup>
|
||||||
|
|
||||||
Alternatively, you could be an adult resident of any other country where you can confirm and verify the legality of this yourself. Again, this is not legal advice, andWeam not a lawyer. **Do this at your own risk.**
|
Alternatively, you could be an adult resident of any other country where you can confirm and verify the legality of this yourself. Again, this is not legal advice, and we are not lawyers. **Do this at your own risk.**
|
||||||
|
|
||||||
Other countries where this was ruled illegal:
|
Other countries where this was ruled illegal:
|
||||||
|
|
||||||
@@ -6504,7 +6504,7 @@ While it does not technically require a real name. It does require a valid payme
|
|||||||
|
|
||||||
- Can you create accounts through Tor? Yes, but see below
|
- Can you create accounts through Tor? Yes, but see below
|
||||||
|
|
||||||
Because of this valid payment method requirement,Wecould not test this. While this is seemingly not against their ToS, it is not possible within the context of this guide unless you manage to obtain a valid KYC payment method anonymously which AFAIK is pretty much impossible or extremely difficult.
|
Because of this valid payment method requirement, we could not test this. While this is seemingly not against their ToS, it is not possible within the context of this guide unless you manage to obtain a valid KYC payment method anonymously which AFAIK is pretty much impossible or extremely difficult.
|
||||||
|
|
||||||
So, AFAIK, it is not possible to create an anonymous Amazon account.
|
So, AFAIK, it is not possible to create an anonymous Amazon account.
|
||||||
|
|
||||||
@@ -6574,7 +6574,7 @@ But this clause of their ToS is illegal in Germany (see [Requirements][Pre-requi
|
|||||||
|
|
||||||
Facebook is one of the most aggressive platforms with identity verification and is pushing hard their "real name policy". It is why this guide is only advised to German residents.
|
Facebook is one of the most aggressive platforms with identity verification and is pushing hard their "real name policy". It is why this guide is only advised to German residents.
|
||||||
|
|
||||||
Over my tests thoWewas able to pinpoint a few tips:
|
Over our tests tho we were able to pinpoint a few tips:
|
||||||
|
|
||||||
- It will be easier if you have an Instagram account first.
|
- It will be easier if you have an Instagram account first.
|
||||||
|
|
||||||
@@ -6602,7 +6602,7 @@ I also suspect strongly based on my test that the following points have an impac
|
|||||||
|
|
||||||
If your account gets suspended, you will need to appeal the decision through a quite simple form that will require you to submit a "proof of ID". However, that proof of ID verification system is more lenient than LinkedIn and will allow you to send various documents which require far less Photoshop skills.
|
If your account gets suspended, you will need to appeal the decision through a quite simple form that will require you to submit a "proof of ID". However, that proof of ID verification system is more lenient than LinkedIn and will allow you to send various documents which require far less Photoshop skills.
|
||||||
|
|
||||||
It is also possible that they ask you to take a selfie video or picture-making certain gestures to prove your identity. If that is the case,Weam afraid it is a dead-end for now unless you use a deepfake face swapping technique.
|
It is also possible that they ask you to take a selfie video or picture-making certain gestures to prove your identity. If that is the case, we are afraid it is a dead-end for now unless you use a deepfake face swapping technique.
|
||||||
|
|
||||||
If you do file an appeal, you will have to wait for Facebook to review it (I do not know whether this is automatic or human) and you will have to wait and hope for them to unsuspend your account.
|
If you do file an appeal, you will have to wait for Facebook to review it (I do not know whether this is automatic or human) and you will have to wait and hope for them to unsuspend your account.
|
||||||
|
|
||||||
@@ -6678,23 +6678,23 @@ It is also possible that Google will require an ID check through indirect financ
|
|||||||
|
|
||||||
#### Instagram:
|
#### Instagram:
|
||||||
|
|
||||||
- Is this against their ToS? **Maybe?**Weam not sure <https://help.instagram.com/581066165581870?ref=dp> <sup>[[Archive.org]][430]</sup>
|
- Is this against their ToS? **Maybe?** We are not sure <https://help.instagram.com/581066165581870?ref=dp> <sup>[[Archive.org]][430]</sup>
|
||||||
|
|
||||||
"**You can't impersonate others or provide inaccurate information. You do not have to disclose your identity on Instagram, but you must provide us with accurate and up-to-date information (including registration information)**. **Also, you may not impersonate someone you are not, and you can't create an account for someone else unless you have their express permission".**
|
"**You can't impersonate others or provide inaccurate information. You do not have to disclose your identity on Instagram, but you must provide us with accurate and up-to-date information (including registration information)**. **Also, you may not impersonate someone you are not, and you can't create an account for someone else unless you have their express permission".**
|
||||||
|
|
||||||
This one is a bit of an Oxymoron don't you think? So,Weam not sure whether it is allowed or not.
|
This one is a bit of an Oxymoron don't you think? So, we are not sure whether it is allowed or not.
|
||||||
|
|
||||||
- Will they require a phone number? Maybe but less likely over VPN and very likely over Tor
|
- Will they require a phone number? Maybe but less likely over VPN and very likely over Tor
|
||||||
|
|
||||||
- Can you create accounts through Tor? Yes, but expect some captchas and your phone number will be required
|
- Can you create accounts through Tor? Yes, but expect some captchas and your phone number will be required
|
||||||
|
|
||||||
It is also possible that they ask you to take a selfie video or picture-making certain gestures to prove your identity (within the app or through an e-mail request). If that is the case,Weam afraid it is a dead-end for now.
|
It is also possible that they ask you to take a selfie video or picture-making certain gestures to prove your identity (within the app or through an e-mail request). If that is the case, we are afraid it is a dead-end for now.
|
||||||
|
|
||||||
It is no secret that Instagram is part of Facebook however it is more lenient than Facebook when it comes to user verification. It is quite unlikely you will get suspended or banned after signing up. But it could help.
|
It is no secret that Instagram is part of Facebook however it is more lenient than Facebook when it comes to user verification. It is quite unlikely you will get suspended or banned after signing up. But it could help.
|
||||||
|
|
||||||
For instance,Wenoticed that you will face fewer issues creating a Facebook account if you already have a valid Instagram account. You should always create an Instagram account before trying Facebook.
|
For instance, we noticed that you will face fewer issues creating a Facebook account if you already have a valid Instagram account. You should always create an Instagram account before trying Facebook.
|
||||||
|
|
||||||
Unfortunately, there are some limitations when using the web version of Instagram. For instance, you will not be able to enable Authenticator 2FA from the web for a reasonWedo not understand.
|
Unfortunately, there are some limitations when using the web version of Instagram. For instance, you will not be able to enable Authenticator 2FA from the web for a reason we do not know.
|
||||||
|
|
||||||
After sign-up, do the following:
|
After sign-up, do the following:
|
||||||
|
|
||||||
@@ -6854,9 +6854,9 @@ Telegram is quite straightforward, and you can download their portable Windows a
|
|||||||
|
|
||||||
It will require a phone number (that can only be used once) and nothing else.
|
It will require a phone number (that can only be used once) and nothing else.
|
||||||
|
|
||||||
In most cases,Wehad no issues whether it was over Tor or VPN, butWehad a few cases where my telegram account was just banned for violating terms of services (not sure which one?). This again despite not using them for anything.
|
In most cases, we had no issues whether it was over Tor or VPN, butWehad a few cases where my telegram account was just banned for violating terms of services (not sure which one?). This again despite not using them for anything.
|
||||||
|
|
||||||
They provide an appeal process through e-mail, butWehad no success with getting any answer.
|
They provide an appeal process through e-mail, but we had no success with getting any answer.
|
||||||
|
|
||||||
Their appeal process is just sending an e-mail to <recover@telegram.org> <sup>[[Archive.org]][446]</sup> stating your phone number and issue and hope they answer.
|
Their appeal process is just sending an e-mail to <recover@telegram.org> <sup>[[Archive.org]][446]</sup> stating your phone number and issue and hope they answer.
|
||||||
|
|
||||||
@@ -6978,9 +6978,9 @@ Ideally, you should find a way to buy/sell crypto with cash from an unknown pers
|
|||||||
|
|
||||||
#### What about those mobile-only apps (WhatsApp/Signal)?
|
#### What about those mobile-only apps (WhatsApp/Signal)?
|
||||||
|
|
||||||
There are only three ways of securely using those anonymously (thatWewould recommend). Using a VPN on your phone is not one of those ways. All of those are, unfortunately, "tedious" to say the least.
|
There are only three ways of securely using those anonymously (that we would recommend). Using a VPN on your phone is not one of those ways. All of those are, unfortunately, "tedious" to say the least.
|
||||||
|
|
||||||
- Use an Android Emulator within the Windows VM and run the App through your multi-layer of Tor/VPN. The drawback is that such emulators are usually quite resource-hungry and will slow down your VM and use more battery. Here is also an (outdated) guide on this matter: <https://www.bellingcat.com/resources/how-tos/2018/08/23/creating-android-open-source-research-device-pc/> <sup>[[Archive.org]][451]</sup>. As for myself,Wewill recommend the use of:
|
- Use an Android Emulator within the Windows VM and run the App through your multi-layer of Tor/VPN. The drawback is that such emulators are usually quite resource-hungry and will slow down your VM and use more battery. Here is also an (outdated) guide on this matter: <https://www.bellingcat.com/resources/how-tos/2018/08/23/creating-android-open-source-research-device-pc/> <sup>[[Archive.org]][451]</sup>. As for myself, we will recommend the use of:
|
||||||
|
|
||||||
- Android-x86 on Virtualbox (see <https://www.android-x86.org/documentation/virtualbox.html> <sup>[[Archive.org]][348]</sup>) that you can also set up easily.
|
- Android-x86 on Virtualbox (see <https://www.android-x86.org/documentation/virtualbox.html> <sup>[[Archive.org]][348]</sup>) that you can also set up easily.
|
||||||
|
|
||||||
@@ -6990,7 +6990,7 @@ There are only three ways of securely using those anonymously (thatWewould recom
|
|||||||
|
|
||||||
- **Not recommended and most complicated:** Have a burner Smartphone that you will connect to the VM layered network through Tethering/Sharing of the connection through Wi-Fi. We will not detail this here, but it is an option.
|
- **Not recommended and most complicated:** Have a burner Smartphone that you will connect to the VM layered network through Tethering/Sharing of the connection through Wi-Fi. We will not detail this here, but it is an option.
|
||||||
|
|
||||||
There is no way to reliably set a decent multi-layered connectivity approach easily on an Android phone (it is not even possible on IOS as far asWeknow). By reliable,Wemean being sure that the smartphone will not leak anything such as geolocation or anything else from booting up to shutting down.
|
There is no way to reliably set a decent multi-layered connectivity approach easily on an Android phone (it is not even possible on IOS as far as we know). By reliable, we mean being sure that the smartphone will not leak anything such as geolocation or anything else from booting up to shutting down.
|
||||||
|
|
||||||
#### Anything else:
|
#### Anything else:
|
||||||
|
|
||||||
@@ -7028,7 +7028,7 @@ See the [Bad Cryptography][Bad Cryptography:] section at the start of this guide
|
|||||||
|
|
||||||
**Always be cautious of apps rolling their own crypto until it has been reviewed by many in the crypto community (or even better published and peer-reviewed academically)**. Again, this is harder to verify with closed-source proprietary apps.
|
**Always be cautious of apps rolling their own crypto until it has been reviewed by many in the crypto community (or even better published and peer-reviewed academically)**. Again, this is harder to verify with closed-source proprietary apps.
|
||||||
|
|
||||||
It is not that rolling your own crypto is bad in essence, it is that good cryptography needs real peer-reviewing, auditing, testing... And since you are probably not a cryptanalyst (andWeam not one either), chances are high we are not competent to assess the cryptography of some apps.
|
It is not that rolling your own crypto is bad in essence, it is that good cryptography needs real peer-reviewing, auditing, testing... And since you are probably not a cryptanalyst (and we are not either), chances are high we are not competent to assess the cryptography of some apps.
|
||||||
|
|
||||||
#### Forward Secrecy:
|
#### Forward Secrecy:
|
||||||
|
|
||||||
@@ -7684,7 +7684,7 @@ You can also consult the following external resources for more comparisons:
|
|||||||
|
|
||||||
- Messenger-Matrix.de at <https://www.messenger-matrix.de/messenger-matrix-en.html> <sup>[[Archive.org]][461]</sup>
|
- Messenger-Matrix.de at <https://www.messenger-matrix.de/messenger-matrix-en.html> <sup>[[Archive.org]][461]</sup>
|
||||||
|
|
||||||
**I do not endorse or recommend some mainstream platforms for anonymity including the much-praised Signal which to this date still requires a phone number to register and contact others. In the context of this guide,Westrongly recommend against using Signal if possible.**
|
**We do not endorse or recommend some mainstream platforms for anonymity including the much-praised Signal which to this date still requires a phone number to register and contact others. In the context of this guide, we strongly recommend against using Signal if possible.**
|
||||||
|
|
||||||
### How to share files publicly but anonymously:
|
### How to share files publicly but anonymously:
|
||||||
|
|
||||||
@@ -7831,7 +7831,7 @@ Here is a comparative table of recommended/included software compiled from vario
|
|||||||
|
|
||||||
**Legend:** * Not recommended but mentioned. N/A = Not Included or absence of recommendation for that software type. (L)= Linux Only but can maybe be used on Windows/macOS through other means (HomeBrew, Virtualization, Cygwin). (?)= Not tested but open-source and could be considered.
|
**Legend:** * Not recommended but mentioned. N/A = Not Included or absence of recommendation for that software type. (L)= Linux Only but can maybe be used on Windows/macOS through other means (HomeBrew, Virtualization, Cygwin). (?)= Not tested but open-source and could be considered.
|
||||||
|
|
||||||
**In all cases,Westrongly recommend only using such applications from within a VM or Tails to prevent as much leaking as possible. If you do not, you will have to sanitize those documents carefully before publishing (See [Removing Metadata from Files/Documents/Pictures][Removing Metadata from Files/Documents/Pictures:]).**
|
**In all cases, we strongly recommend only using such applications from within a VM or Tails to prevent as much leaking as possible. If you do not, you will have to sanitize those documents carefully before publishing (See [Removing Metadata from Files/Documents/Pictures][Removing Metadata from Files/Documents/Pictures:]).**
|
||||||
|
|
||||||
### Communicating sensitive information to various known organizations:
|
### Communicating sensitive information to various known organizations:
|
||||||
|
|
||||||
@@ -7839,7 +7839,7 @@ You might be interested in communicating information to some organization such a
|
|||||||
|
|
||||||
If you must do so, you should take some steps because you cannot trust any organization to protect your anonymity[^422]. See [Appendix B1: Checklist of things to verify before sharing information][Appendix B1: Checklist of things to verify before sharing information:].
|
If you must do so, you should take some steps because you cannot trust any organization to protect your anonymity[^422]. See [Appendix B1: Checklist of things to verify before sharing information][Appendix B1: Checklist of things to verify before sharing information:].
|
||||||
|
|
||||||
For this,Westrongly recommend the use of SecureDrop[^423] (<https://securedrop.org/> <sup>[[Archive.org]][471]</sup>) which is an open-source project from the Freedom of the Press Foundation.
|
For this, we strongly recommend the use of SecureDrop[^423] (<https://securedrop.org/> <sup>[[Archive.org]][471]</sup>) which is an open-source project from the Freedom of the Press Foundation.
|
||||||
|
|
||||||
- Do take a moment to their read their "source guide" here: <https://docs.securedrop.org/en/stable/source.html> <sup>[[Archive.org]][472]</sup>
|
- Do take a moment to their read their "source guide" here: <https://docs.securedrop.org/en/stable/source.html> <sup>[[Archive.org]][472]</sup>
|
||||||
|
|
||||||
@@ -7911,7 +7911,7 @@ For these back-ups, you will need a USB key or an external hard drive with enoug
|
|||||||
|
|
||||||
#### Veracrypt:
|
#### Veracrypt:
|
||||||
|
|
||||||
For this purpose,Wewill recommend the use of Veracrypt on all platforms (Linux/Windows/macOS) for convenience, security, and portability.
|
For this purpose, we will recommend the use of Veracrypt on all platforms (Linux/Windows/macOS) for convenience, security, and portability.
|
||||||
|
|
||||||
#### Normal File containers:
|
#### Normal File containers:
|
||||||
|
|
||||||
@@ -7949,7 +7949,7 @@ To do this, when mounting the Decoy Volume, select Mount Options and Check the "
|
|||||||
|
|
||||||
- **Do not ever store such containers on cloud storage platforms that have backups and where you have no direct control over permanent deletion. They might keep "old versions" of your files which can then also be used by forensics to prove the existence of hidden data.**
|
- **Do not ever store such containers on cloud storage platforms that have backups and where you have no direct control over permanent deletion. They might keep "old versions" of your files which can then also be used by forensics to prove the existence of hidden data.**
|
||||||
|
|
||||||
- If you are mounting the hidden volume from your Host OS (**not recommended**), you should erase all traces of this hidden volume everywhere after use. There could be traces in various places (system logs, file systems journaling, recent documents in your applications, indexing, registry entries...). Refer to the [Some additional measures against forensics][Some additional measures against forensics:] section of this guide to remove such artifacts. Especially on Windows. Instead, you should mount them on your Guest VMs. With Virtualbox for instance, you could take a snapshot of the VM before opening/working the hidden volume and then restore the snapshot before opening/working on it after use. This should erase the traces of its presence and mitigate the issue. Your Host OS might keep logs of the USB key being inserted but not of the hidden volume usage. Therefore,Wedo not recommend using these from your host OS.
|
- If you are mounting the hidden volume from your Host OS (**not recommended**), you should erase all traces of this hidden volume everywhere after use. There could be traces in various places (system logs, file systems journaling, recent documents in your applications, indexing, registry entries...). Refer to the [Some additional measures against forensics][Some additional measures against forensics:] section of this guide to remove such artifacts. Especially on Windows. Instead, you should mount them on your Guest VMs. With Virtualbox for instance, you could take a snapshot of the VM before opening/working the hidden volume and then restore the snapshot before opening/working on it after use. This should erase the traces of its presence and mitigate the issue. Your Host OS might keep logs of the USB key being inserted but not of the hidden volume usage. Therefore, we do not recommend using these from your host OS.
|
||||||
|
|
||||||
- Do not store these on external SSD drives if you are not sure you can use Trim on them (see the [Understanding HDD vs SSD][Understanding HDD vs SSD:] section).
|
- Do not store these on external SSD drives if you are not sure you can use Trim on them (see the [Understanding HDD vs SSD][Understanding HDD vs SSD:] section).
|
||||||
|
|
||||||
@@ -7963,7 +7963,7 @@ You will have two options here:
|
|||||||
|
|
||||||
- This backup can be done while the Operating System is running.
|
- This backup can be done while the Operating System is running.
|
||||||
|
|
||||||
- This backup will not be encrypted using the disk encryption but using the Backup utility encryption algorithm (which you will have to trust and cannot really control for most). Alternatively, you could encrypt the backup media yourself separately (for instance with Veracrypt).Weam not aware of any free or non-free utility that natively supports Veracrypt.
|
- This backup will not be encrypted using the disk encryption but using the Backup utility encryption algorithm (which you will have to trust and cannot really control for most). Alternatively, you could encrypt the backup media yourself separately (for instance with Veracrypt).We are not aware of any free or non-free utility that natively supports Veracrypt.
|
||||||
|
|
||||||
- Some utilities will allow for differential/incremental backups instead of full backups.
|
- Some utilities will allow for differential/incremental backups instead of full backups.
|
||||||
|
|
||||||
@@ -7979,9 +7979,9 @@ You will have two options here:
|
|||||||
|
|
||||||
- This method is the easiest to manage.
|
- This method is the easiest to manage.
|
||||||
|
|
||||||
I made extensive testing using live backups utilities (Macrium Reflect, EaseUS Todo Reflect, Déjà Dup...) and personallyWedo not think it is worth it. Instead,Wewould recommend that you periodically back up your system with a simple Clonezilla image. It is much easier to perform, much easier to restore, and usually works reliably without issues in all cases. And contrary to many beliefs, it is not that slow with most backups taking about an hour depending on the speed of your destination media.
|
We made extensive testing using live backups utilities (Macrium Reflect, EaseUS Todo Reflect, Déjà Dup...) and personally we do not think it is worth it. Instead, we would recommend that you periodically back up your system with a simple Clonezilla image. It is much easier to perform, much easier to restore, and usually works reliably without issues in all cases. And contrary to many beliefs, it is not that slow with most backups taking about an hour depending on the speed of your destination media.
|
||||||
|
|
||||||
For backing up single files while you work,Werecommend using file containers or encrypted media directly and manually as explained in the earlier section.
|
For backing up single files while you work, we recommend using file containers or encrypted media directly and manually as explained in the earlier section.
|
||||||
|
|
||||||
#### Requirements:
|
#### Requirements:
|
||||||
|
|
||||||
@@ -8003,17 +8003,17 @@ So, you should follow the steps in [Appendix E: Clonezilla]
|
|||||||
|
|
||||||
##### QubesOS:
|
##### QubesOS:
|
||||||
|
|
||||||
Qubes OS recommends using their own utility for backups as documented here <https://www.qubes-os.org/doc/backup-restore/> <sup>[[Archive.org]][476]</sup>. But it is just a hassle and provides limited added value unless you just want to back up a single Qube. So instead,Weam also recommending just making a full image with Clonezilla which will remove all the hassle and bring you back a working system in a few simple steps.
|
Qubes OS recommends using their own utility for backups as documented here <https://www.qubes-os.org/doc/backup-restore/> <sup>[[Archive.org]][476]</sup>. But it is just a hassle and provides limited added value unless you just want to back up a single Qube. So instead, we are also recommending just making a full image with Clonezilla which will remove all the hassle and bring you back a working system in a few simple steps.
|
||||||
|
|
||||||
So, you should follow the steps in [Appendix E: Clonezilla]
|
So, you should follow the steps in [Appendix E: Clonezilla]
|
||||||
|
|
||||||
#### Windows:
|
#### Windows:
|
||||||
|
|
||||||
I will only recommend the use of the open-source and free Clonezilla utility for this purpose. There are commercial utilities that offer the same functionality, butWedo not see any advantage in using any of them vs Clonezilla.
|
I will only recommend the use of the open-source and free Clonezilla utility for this purpose. There are commercial utilities that offer the same functionality, but we do not see any advantage in using any of them vs Clonezilla.
|
||||||
|
|
||||||
Some warnings:
|
Some warnings:
|
||||||
|
|
||||||
- If you use Bitlocker for encryption with TPM[^424] enabled, you might need to save your Bitlocker Key (safely) somewhere as well as this might be needed to restore your drive if your HDD/SSD or other hardware parts changed. Another option would be to use Bitlocker without the use of TPM which would not require this option. But again,Wedo not recommend using Bitlocker at all.
|
- If you use Bitlocker for encryption with TPM[^424] enabled, you might need to save your Bitlocker Key (safely) somewhere as well as this might be needed to restore your drive if your HDD/SSD or other hardware parts changed. Another option would be to use Bitlocker without the use of TPM which would not require this option. But again, we do not recommend using Bitlocker at all.
|
||||||
|
|
||||||
- You should always have a backup of your Veracrypt rescue disk at hand somewhere to be able to resolve some issues that might still appear after a restore. Remember this rescue disk does not contain your passphrase or any sensitive information. You can store it as is.
|
- You should always have a backup of your Veracrypt rescue disk at hand somewhere to be able to resolve some issues that might still appear after a restore. Remember this rescue disk does not contain your passphrase or any sensitive information. You can store it as is.
|
||||||
|
|
||||||
@@ -8033,7 +8033,7 @@ So, plug in an external drive and it should prompt you to use it as a Time Machi
|
|||||||
|
|
||||||
It is just simpler and will work online while you work. You will be able to recover your data on any other Mac from the recovery options and you will be also able to use this disk for backing up other devices.
|
It is just simpler and will work online while you work. You will be able to recover your data on any other Mac from the recovery options and you will be also able to use this disk for backing up other devices.
|
||||||
|
|
||||||
It is possible to also use Clonezilla to clone your Mac Hard Drive, but it could bring hardware compatibility issues and probably will not add much in terms of security. So, for macOS,Weam not specifically recommending Clonezilla.
|
It is possible to also use Clonezilla to clone your Mac Hard Drive, but it could bring hardware compatibility issues and probably will not add much in terms of security. So, for macOS, We are not specifically recommending Clonezilla.
|
||||||
|
|
||||||
## Online Backups:
|
## Online Backups:
|
||||||
|
|
||||||
@@ -8071,7 +8071,7 @@ If you do intend to store sensitive data on "mainstream platforms" (Dropbox, Goo
|
|||||||
|
|
||||||
### Information:
|
### Information:
|
||||||
|
|
||||||
If you just want to save information (text),Wewill recommend the use of secure and private pastebins[^425]. MostlyWewill stick to the ones recommended by PrivacyGuides.org (<https://www.privacyguides.org/productivity/#paste-services> <sup>[[Archive.org]][480]</sup> ) :
|
If you just want to save information (text),Wewill recommend the use of secure and private pastebins[^425]. Mostly we will stick to the ones recommended by PrivacyGuides.org (<https://www.privacyguides.org/productivity/#paste-services> <sup>[[Archive.org]][480]</sup> ) :
|
||||||
|
|
||||||
- <https://privatebin.info/>
|
- <https://privatebin.info/>
|
||||||
|
|
||||||
@@ -8171,7 +8171,7 @@ So, you want to be sure. To achieve 100% secure deletion on an SSD drive, you wi
|
|||||||
- Overwrite the entire drive's contents
|
- Overwrite the entire drive's contents
|
||||||
- HDDs:
|
- HDDs:
|
||||||
- Overwrite the drive's contents using a tool like [srm](https://www.howtogeek.com/425232/how-to-securely-delete-files-on-linux/), [wipe](https://linux.die.net/man/1/wipe), [shred, etc.](https://recoverit.wondershare.com/harddrive-tips/format-and-wipe-linux-disk.html). Ideally you want to use the Gutmann method, which was created for most effective data erasure on all drives. This method also works on SSDs, although it is overkill.
|
- Overwrite the drive's contents using a tool like [srm](https://www.howtogeek.com/425232/how-to-securely-delete-files-on-linux/), [wipe](https://linux.die.net/man/1/wipe), [shred, etc.](https://recoverit.wondershare.com/harddrive-tips/format-and-wipe-linux-disk.html). Ideally you want to use the Gutmann method, which was created for most effective data erasure on all drives. This method also works on SSDs, although it is overkill.
|
||||||
- Simply overwriting the drive's contents is not always enough. Dedicated secure deletion tools are designed to perform multiple passes to more effectively wipe data. This is expecially important on older drives.Werecommend using either `wipe` or `srm`.
|
- Simply overwriting the drive's contents is not always enough. Dedicated secure deletion tools are designed to perform multiple passes to more effectively wipe data. This is expecially important on older drives. we recommend using either `wipe` or `srm`.
|
||||||
- If using `wipe`, just use its default options (`wipe /dev/sdX`), as the defaults are tuned to most effectively wipe data on HDDs.
|
- If using `wipe`, just use its default options (`wipe /dev/sdX`), as the defaults are tuned to most effectively wipe data on HDDs.
|
||||||
- If using `srm`, make sure to manually specify that it should perform a Gutmann wipe (`srm -G /dev/sdX`).
|
- If using `srm`, make sure to manually specify that it should perform a Gutmann wipe (`srm -G /dev/sdX`).
|
||||||
- SSDs:
|
- SSDs:
|
||||||
@@ -8463,7 +8463,7 @@ If you want more security and do not trust the Trim operation, then you will hav
|
|||||||
|
|
||||||
- You can do this the graphical way with BleachBit following this tutorial from the EFF: <https://ssd.eff.org/en/module/how-delete-your-data-securely-linux> <sup>[[Archive.org]][495]</sup>
|
- You can do this the graphical way with BleachBit following this tutorial from the EFF: <https://ssd.eff.org/en/module/how-delete-your-data-securely-linux> <sup>[[Archive.org]][495]</sup>
|
||||||
|
|
||||||
- Or you can do this from the command line following this tutorial: <https://linuxhint.com/completely_wipe_hard_drive_ubuntu/> <sup>[[Archive.org]][492]</sup> (For this purposeWerecommend wipe and shred).
|
- Or you can do this from the command line following this tutorial: <https://linuxhint.com/completely_wipe_hard_drive_ubuntu/> <sup>[[Archive.org]][492]</sup> (For this purpose we recommend wipe and shred).
|
||||||
|
|
||||||
#### External SSD drive:
|
#### External SSD drive:
|
||||||
|
|
||||||
@@ -8537,7 +8537,7 @@ Use the same method as Linux from a Qube connected to that specific USB device
|
|||||||
|
|
||||||
- You can do this the graphical way with BleachBit following this tutorial from the EFF: <https://ssd.eff.org/en/module/how-delete-your-data-securely-linux> <sup>[[Archive.org]][495]</sup>
|
- You can do this the graphical way with BleachBit following this tutorial from the EFF: <https://ssd.eff.org/en/module/how-delete-your-data-securely-linux> <sup>[[Archive.org]][495]</sup>
|
||||||
|
|
||||||
- Or you can do this from the command line following this tutorial: <https://linuxhint.com/completely_wipe_hard_drive_ubuntu/> <sup>[[Archive.org]][492]</sup> (For this purposeWerecommend wipe and shred).
|
- Or you can do this from the command line following this tutorial: <https://linuxhint.com/completely_wipe_hard_drive_ubuntu/> <sup>[[Archive.org]][492]</sup> (For this purpose we recommend wipe and shred).
|
||||||
|
|
||||||
#### External SSD drive:
|
#### External SSD drive:
|
||||||
|
|
||||||
@@ -8805,9 +8805,9 @@ To remove such attributes, you will have to do it manually from the terminal:
|
|||||||
|
|
||||||
(Note that Apple has removed the convenient xattr --c option that would just remove all attributes at once so you will have to do this for each attribute on each file)
|
(Note that Apple has removed the convenient xattr --c option that would just remove all attributes at once so you will have to do this for each attribute on each file)
|
||||||
|
|
||||||
**These attributes and entries will stick even if you clear your browser history, and this is obviously bad for privacy (right?), andWeam not aware of any convenient tool that will deal with those at the moment.**
|
**These attributes and entries will stick even if you clear your browser history, and this is obviously bad for privacy (right?), and we are not aware of any convenient tool that will deal with those at the moment.**
|
||||||
|
|
||||||
Fortunately, there are some mitigations for avoiding this issue in the first place as these attributes and entries are set by the browsers. So,Wetested various browsers (On macOS Catalina, Big Sur, and Monterey), and here are the results as of the date of this guide:
|
Fortunately, there are some mitigations for avoiding this issue in the first place as these attributes and entries are set by the browsers. So, we tested various browsers (On macOS Catalina, Big Sur, and Monterey), and here are the results as of the date of this guide:
|
||||||
|
|
||||||
| **Browser** | **Quarantine DB Entry** | **Quarantine File Attribute** | **Origin File Attribute** |
|
| **Browser** | **Quarantine DB Entry** | **Quarantine File Attribute** | **Origin File Attribute** |
|
||||||
|------------------------------|------------------------------|-------------------------------|---------------------------|
|
|------------------------------|------------------------------|-------------------------------|---------------------------|
|
||||||
@@ -8936,7 +8936,7 @@ Now you should clean the history within any app that you used including Browser
|
|||||||
|
|
||||||
##### Wi-Fi History:
|
##### Wi-Fi History:
|
||||||
|
|
||||||
Now it is time to clear the history of the Wi-Fi you connect to. Unfortunately, Windows keeps storing a list of past Networks in the registry even if you "forgot" those in the Wi-Fi settings. As far asWeknow, no utilities clean those yet (BleachBit or PrivaZer for instance) so you will have to do it the manual way:
|
Now it is time to clear the history of the Wi-Fi you connect to. Unfortunately, Windows keeps storing a list of past Networks in the registry even if you "forgot" those in the Wi-Fi settings. As far as we know, no utilities clean those yet (BleachBit or PrivaZer for instance) so you will have to do it the manual way:
|
||||||
|
|
||||||
- Launch Regedit using this tutorial: <https://support.microsoft.com/en-us/windows/how-to-open-registry-editor-in-windows-10-deab38e6-91d6-e0aa-4b7c-8878d9e07b11> <sup>[[Archive.org]][526]</sup>
|
- Launch Regedit using this tutorial: <https://support.microsoft.com/en-us/windows/how-to-open-registry-editor-in-windows-10-deab38e6-91d6-e0aa-4b7c-8878d9e07b11> <sup>[[Archive.org]][526]</sup>
|
||||||
|
|
||||||
@@ -9046,7 +9046,7 @@ Here are the steps for BleachBit:
|
|||||||
|
|
||||||
- Select any other traces you want to remove from their list
|
- Select any other traces you want to remove from their list
|
||||||
|
|
||||||
- Again, as with the earlier utility, we would not clean the free space on an SSD drive becauseWethink the Windows native "optimize" utility is enough (see below) and that filling up the free space on a trim enabled SSD is just completely overkill and unnecessary.
|
- Again, as with the earlier utility, we would not clean the free space on an SSD drive because we think the Windows native "optimize" utility is enough (see below) and that filling up the free space on a trim enabled SSD is just completely overkill and unnecessary.
|
||||||
|
|
||||||
- Click Clean and wait. This will take a while and will fill your whole free space with data on both HDD and SSD drives.
|
- Click Clean and wait. This will take a while and will fill your whole free space with data on both HDD and SSD drives.
|
||||||
|
|
||||||
@@ -9118,7 +9118,7 @@ Search for the page that was changed (where your profile was deleted/changed) an
|
|||||||
|
|
||||||
### Qwant:
|
### Qwant:
|
||||||
|
|
||||||
As far asWeknow, there is no readily available tool to force this, and you will have to wait for the results to get updated if there is any. If you know a way, please report this to me through the GitHub issues.
|
As far as we know, there is no readily available tool to force this, and you will have to wait for the results to get updated if there is any. If you know a way, please report this to us through the GitHub issues.
|
||||||
|
|
||||||
### Yahoo Search:
|
### Yahoo Search:
|
||||||
|
|
||||||
@@ -9146,7 +9146,7 @@ You can remove pages from internet archives but **only if you own the website in
|
|||||||
|
|
||||||
As per their help page <https://help.archive.org/hc/en-us/articles/360004651732-Using-The-Wayback-Machine>
|
As per their help page <https://help.archive.org/hc/en-us/articles/360004651732-Using-The-Wayback-Machine>
|
||||||
|
|
||||||
"How canWeexclude or remove my site's pages from the Wayback Machine?
|
"How can we exclude or remove my site's pages from the Wayback Machine?
|
||||||
|
|
||||||
You can send an e-mail request for us to review to info@archive.org with the URL (web address) in the text of your message".
|
You can send an e-mail request for us to review to info@archive.org with the URL (web address) in the text of your message".
|
||||||
|
|
||||||
@@ -9290,7 +9290,7 @@ Keep in mind that many countries have specific laws to compel you to reveal your
|
|||||||
|
|
||||||
# A small final editorial note:
|
# A small final editorial note:
|
||||||
|
|
||||||
After reading this whole guide,Wehope you will have gained some additional beneficial insight about privacy and anonymity. It is clear now, in my humble opinion, that the world we live in has only a few safe harbors remaining where one could have a reasonable expectation of privacy and even less so anonymity. Many will often say that 1984 by George Orwell was not meant to be an instruction book. Yet today this guide and its many references should,Wehope, reveal to you how far down we are in the rabbit hole.
|
After reading this whole guide, we hope you will have gained some additional beneficial insight about privacy and anonymity. It is clear now, in my humble opinion, that the world we live in has only a few safe harbors remaining where one could have a reasonable expectation of privacy and even less so anonymity. Many will often say that 1984 by George Orwell was not meant to be an instruction book. Yet today this guide and its many references should, we hope, reveal to you how far down we are in the rabbit hole.
|
||||||
|
|
||||||
You should also know that most of the digital information described in length in this guide can be forged or tampered with by a motivated adversary for any purpose. Even if you do manage to keep secrets from prying eyes, anyone can fabricate anything to fit their narrative:
|
You should also know that most of the digital information described in length in this guide can be forged or tampered with by a motivated adversary for any purpose. Even if you do manage to keep secrets from prying eyes, anyone can fabricate anything to fit their narrative:
|
||||||
|
|
||||||
@@ -9414,7 +9414,7 @@ This project for instance is running several Tor Exit nodes using donations to f
|
|||||||
|
|
||||||
- Thanks to the makers of the Social Dilemma documentary **(go watch it if you did not yet)**
|
- Thanks to the makers of the Social Dilemma documentary **(go watch it if you did not yet)**
|
||||||
|
|
||||||
- Thanks to Michael Bazzell and his great OSINT books whichWerecommend you **buy** at <https://inteltechniques.com>
|
- Thanks to Michael Bazzell and his great OSINT books which we recommend you **buy** at <https://inteltechniques.com>
|
||||||
|
|
||||||
- Thanks to Randall Munroe at XKCD for his great and insightful webcomics.
|
- Thanks to Randall Munroe at XKCD for his great and insightful webcomics.
|
||||||
|
|
||||||
@@ -9884,7 +9884,7 @@ These instructions are valid for all Operating Systems:
|
|||||||
|
|
||||||
- **If you are backing up a disk with simple Encryption, encryption of the backup is not required since you are backing up an already encrypted disk, but you can still encrypt the backup anyway if you want additional security (and slower backup).**
|
- **If you are backing up a disk with simple Encryption, encryption of the backup is not required since you are backing up an already encrypted disk, but you can still encrypt the backup anyway if you want additional security (and slower backup).**
|
||||||
|
|
||||||
- **If you intend to back up a device with plausible deniability encryption,Westrongly recommend against it as this backup image could be used to prove the existence of the hidden volume using forensics techniques as explained earlier. Do not make an image backup of the partition containing your hidden OS.**
|
- **If you intend to back up a device with plausible deniability encryption, we strongly recommend against it as this backup image could be used to prove the existence of the hidden volume using forensics techniques as explained earlier. Do not make an image backup of the partition containing your hidden OS.**
|
||||||
|
|
||||||
- You are done, if you need to restore, follow these instructions: <https://clonezilla.org/show-live-doc-content.php?topic=clonezilla-live/doc/02_Restore_disk_image> <sup>[[Archive.org]][583]</sup>
|
- You are done, if you need to restore, follow these instructions: <https://clonezilla.org/show-live-doc-content.php?topic=clonezilla-live/doc/02_Restore_disk_image> <sup>[[Archive.org]][583]</sup>
|
||||||
|
|
||||||
@@ -9946,13 +9946,13 @@ Clean all the data from the browser after each use.
|
|||||||
|
|
||||||
# Appendix H: Windows Cleaning Tools
|
# Appendix H: Windows Cleaning Tools
|
||||||
|
|
||||||
In this guideWewill recommend two-third native tools and two third-party tools:
|
In this guide we will recommend two-third native tools and two third-party tools:
|
||||||
|
|
||||||
- Native Tools:
|
- Native Tools:
|
||||||
|
|
||||||
- Windows 10/11 Disk Cleanup Utility: <https://support.microsoft.com/en-us/windows/disk-cleanup-in-windows-10-8a96ff42-5751-39ad-23d6-434b4d5b9a68> <sup>[[Archive.org]][585]</sup>
|
- Windows 10/11 Disk Cleanup Utility: <https://support.microsoft.com/en-us/windows/disk-cleanup-in-windows-10-8a96ff42-5751-39ad-23d6-434b4d5b9a68> <sup>[[Archive.org]][585]</sup>
|
||||||
|
|
||||||
> This tool will clean up a bunch of things natively. It is not enough, andWeinstead recommend using the third-party tools below to clean more stuff. PrivaZer for instance will use the disk cleanup utility directly itself and BleachBit will use its own mechanisms.
|
> This tool will clean up a bunch of things natively. It is not enough, and we instead recommend using the third-party tools below to clean more stuff. PrivaZer for instance will use the disk cleanup utility directly itself and BleachBit will use its own mechanisms.
|
||||||
|
|
||||||
- Windows 10/11 Optimize Utility (Defrag on HDD Drives): <https://support.microsoft.com/en-us/windows/defragment-your-windows-10-pc-048aefac-7f1f-4632-d48a-9700c4ec702a> <sup>[[Archive.org]][586]</sup> (yes the tutorial is for Windows 10 but should work on 11 too)
|
- Windows 10/11 Optimize Utility (Defrag on HDD Drives): <https://support.microsoft.com/en-us/windows/defragment-your-windows-10-pc-048aefac-7f1f-4632-d48a-9700c4ec702a> <sup>[[Archive.org]][586]</sup> (yes the tutorial is for Windows 10 but should work on 11 too)
|
||||||
|
|
||||||
@@ -9986,7 +9986,7 @@ Both these utilities can delete files and can overwrite the free space after del
|
|||||||
|
|
||||||
# Appendix I: Using ShredOS to securely wipe an HDD drive:
|
# Appendix I: Using ShredOS to securely wipe an HDD drive:
|
||||||
|
|
||||||
Several utilities are recommended (like the old unmaintained DBAN[^463] or System Rescue CD (<https://www.system-rescue.org/> <sup>[[Archive.org]][589]</sup>)) for this butWewill recommend the use of ShredOS.
|
Several utilities are recommended (like the old unmaintained DBAN[^463] or System Rescue CD (<https://www.system-rescue.org/> <sup>[[Archive.org]][589]</sup>)) for this but we will recommend the use of ShredOS.
|
||||||
|
|
||||||
Feel free to go with DBAN instead if you want (using this tutorial: <https://www.lifewire.com/how-to-erase-a-hard-drive-using-dban-2619148> <sup>[[Archive.org]][590]</sup>), the process is basically the same but will not work out of the box with UEFI laptops.
|
Feel free to go with DBAN instead if you want (using this tutorial: <https://www.lifewire.com/how-to-erase-a-hard-drive-using-dban-2619148> <sup>[[Archive.org]][590]</sup>), the process is basically the same but will not work out of the box with UEFI laptops.
|
||||||
|
|
||||||
@@ -10060,7 +10060,7 @@ Unfortunately, most of these tools are Windows only.
|
|||||||
|
|
||||||
# Appendix K: Considerations for using external SSD drives
|
# Appendix K: Considerations for using external SSD drives
|
||||||
|
|
||||||
**I do not recommend using external SSDs due to the uncertainty about their support for Trim, ATA Secure Erase, and Sanitize options through USB controllers. Instead,Werecommend using external HDD disks which can be cleaned/wiped safely and securely without hassle (albeit much slower than SSD drives).**
|
**I do not recommend using external SSDs due to the uncertainty about their support for Trim, ATA Secure Erase, and Sanitize options through USB controllers. Instead, we recommend using external HDD disks which can be cleaned/wiped safely and securely without hassle (albeit much slower than SSD drives).**
|
||||||
|
|
||||||
Please do not buy or use gimmicky self-encrypting devices such as these: <https://syscall.eu/blog/2018/03/12/aigo_part1/> <sup>[[Archive.org]][235]</sup>
|
Please do not buy or use gimmicky self-encrypting devices such as these: <https://syscall.eu/blog/2018/03/12/aigo_part1/> <sup>[[Archive.org]][235]</sup>
|
||||||
|
|
||||||
@@ -10138,7 +10138,7 @@ Download the latest Debian testing amd64 netinst ISO from <https://www.debian.or
|
|||||||
|
|
||||||
**(Get testing to get the latest mat2 release, stable is a few versions back)**
|
**(Get testing to get the latest mat2 release, stable is a few versions back)**
|
||||||
|
|
||||||
This is very lightweight, andWerecommend you do it from a VM (VM inside a VM) to benefit from Whonix Tor Gateway. While it is possible to put this VM directly behind a Whonix Gateway. Whonix will not easily (AFAIK) allow communications between VMs on its network by default.
|
This is very lightweight, and we recommend doing it from a VM (VM inside a VM) to benefit from Whonix Tor Gateway. While it is possible to put this VM directly behind a Whonix Gateway. Whonix will not easily (AFAIK) allow communications between VMs on its network by default.
|
||||||
|
|
||||||
You could also just leave it on Clearnet during the install process and then leave it on the Host-Only network later.
|
You could also just leave it on Clearnet during the install process and then leave it on the Host-Only network later.
|
||||||
|
|
||||||
@@ -10338,7 +10338,7 @@ There are, IMHO, two viable options:
|
|||||||
|
|
||||||
There are three VPN companies recommended by PrivacyGuides.org (<https://www.privacyguides.org/vpn/> <sup>[[Archive.org]][620]</sup>) that accept cash payments: Mullvad, iVPN, and Proton VPN.
|
There are three VPN companies recommended by PrivacyGuides.org (<https://www.privacyguides.org/vpn/> <sup>[[Archive.org]][620]</sup>) that accept cash payments: Mullvad, iVPN, and Proton VPN.
|
||||||
|
|
||||||
In addition,Wewill also mention a newcomer to watch: Safing SPN <https://safing.io/> <sup>[[Archive.org]][621]</sup>) which (while still in the alpha stage at the time of this writing) which also accepts cash and has a very distinct new concept for a VPN which provides benefits similar to Tor Stream isolation with their "SPN"). Note that Safing SPN is not available on macOS at the moment. This possibility is "provisional" and at your own risk, butWethink was worth mentioning.
|
In addition, we will also mention a newcomer to watch: Safing SPN <https://safing.io/> <sup>[[Archive.org]][621]</sup>) which (while still in the alpha stage at the time of this writing) which also accepts cash and has a very distinct new concept for a VPN which provides benefits similar to Tor Stream isolation with their "SPN"). Note that Safing SPN is not available on macOS at the moment. This possibility is "provisional" and at your own risk, but we think was worth mentioning.
|
||||||
|
|
||||||
Personally, for now, we would recommend Mullvad due to personal experience.
|
Personally, for now, we would recommend Mullvad due to personal experience.
|
||||||
|
|
||||||
@@ -10580,7 +10580,7 @@ Here are some guides provided by the recommended VPN providers in this guide:
|
|||||||
|
|
||||||
- Mullvad: <https://mullvad.net/en/help/using-mullvad-vpn-app/#killswitch> <sup>[[Archive.org]][651]</sup>
|
- Mullvad: <https://mullvad.net/en/help/using-mullvad-vpn-app/#killswitch> <sup>[[Archive.org]][651]</sup>
|
||||||
|
|
||||||
- Whonix Workstation: Coming Soon, it is certainly possible, butWedid not find a suitable and easy tutorial yet. It is also worth remembering that if your VPN stops on Whonix, you will still be behind the Tor Network.
|
- Whonix Workstation: Coming Soon, it is certainly possible, but we did not find a suitable and easy tutorial yet. It is also worth remembering that if your VPN stops on Whonix, you will still be behind the Tor Network.
|
||||||
|
|
||||||
- macOS:
|
- macOS:
|
||||||
|
|
||||||
@@ -10788,11 +10788,11 @@ My take on the matter is on the pragmatic side. There is still room for some AV
|
|||||||
|
|
||||||
So, if you are in doubt:
|
So, if you are in doubt:
|
||||||
|
|
||||||
- For non-sensitive files,Wedo encourage you to check any documents/images/videos/archives/programs you intend to open with VirusTotal (or other similar tools) because ... Why not? (Either by uploading or checking hashes).
|
- For non-sensitive files, we do encourage you to check any documents/images/videos/archives/programs you intend to open with VirusTotal (or other similar tools) because ... Why not? (Either by uploading or checking hashes).
|
||||||
|
|
||||||
- For sensitive files, we would recommend at least an offline unprivileged ClamAV scan of the files.
|
- For sensitive files, we would recommend at least an offline unprivileged ClamAV scan of the files.
|
||||||
|
|
||||||
For instance, this guide's PDF files were submitted to VirusTotal because it is meant to be public knowledge andWesee no valid argument against it. It does not guarantee the absence of malware, but it does not hurt to add this check.
|
For instance, this guide's PDF files were submitted to VirusTotal because it is meant to be public knowledge and we see no valid argument against it. It does not guarantee the absence of malware, but it does not hurt to add this check.
|
||||||
|
|
||||||
### Manual Reviews:
|
### Manual Reviews:
|
||||||
|
|
||||||
@@ -11018,7 +11018,7 @@ Another useful resource to be considered for comparing browsers is: <https://pri
|
|||||||
|
|
||||||
## Brave:
|
## Brave:
|
||||||
|
|
||||||
**This is my recommended/preferred choice for a Browser within your guest VMs. This is not my recommended choice for a Browser within your Host OS whereWestrictly recommend Tor Browser as they recommend it themselves**[^503]**.**
|
**This is my recommended/preferred choice for a Browser within your guest VMs. This is not my recommended choice for a Browser within your Host OS where we strictly recommend Tor Browser as they recommend it themselves**[^503]**.**
|
||||||
|
|
||||||
Why Brave despite the controversies[^504]?
|
Why Brave despite the controversies[^504]?
|
||||||
|
|
||||||
@@ -11697,7 +11697,7 @@ We would recommend the "Safest" level by default. The "Safer" level should be en
|
|||||||
|
|
||||||
If you are extra paranoid, use the "Safest" level by default and consider downgrading to Safer is the website is unusable because of Javascript blocking.
|
If you are extra paranoid, use the "Safest" level by default and consider downgrading to Safer is the website is unusable because of Javascript blocking.
|
||||||
|
|
||||||
**Optional and not recommended by the Tor Project**: If you are not using the "Safest" level,Wewill diverge from some but agree with others (for instance the Tails project and others[^525]) and will actually recommend some modifications of the default Tor Browser in the addition of two extensions:
|
**Optional and not recommended by the Tor Project**: If you are not using the "Safest" level, we will diverge from some but agree with others (for instance the Tails project and others[^525]) and will actually recommend some modifications of the default Tor Browser in the addition of two extensions:
|
||||||
|
|
||||||
- uBlock Origin (as it is the case on Tails) while leaving the extension on the default settings:
|
- uBlock Origin (as it is the case on Tails) while leaving the extension on the default settings:
|
||||||
|
|
||||||
@@ -11717,7 +11717,7 @@ Now, you are really done, and you can now surf the web anonymously from your des
|
|||||||
|
|
||||||
There are many services that you might want to use (VPS hosting, mail hosting, domain names...) but require payment of some kind.
|
There are many services that you might want to use (VPS hosting, mail hosting, domain names...) but require payment of some kind.
|
||||||
|
|
||||||
As mentioned before in this guide multiple times,Westrongly recommend the use of services accepting cash (that you could send anonymously through the postal services) or Monero which you can buy and use directly and safely.
|
As mentioned before in this guide multiple times, we strongly recommend the use of services accepting cash (that you could send anonymously through the postal services) or Monero which you can buy and use directly and safely.
|
||||||
|
|
||||||
But what if the service you want does not accept Monero but does accept a more mainstream cryptocurrency such as Bitcoin (BTC) or Ethereum (ETH).
|
But what if the service you want does not accept Monero but does accept a more mainstream cryptocurrency such as Bitcoin (BTC) or Ethereum (ETH).
|
||||||
|
|
||||||
@@ -11809,7 +11809,7 @@ Wasabi wallet is not recommended due to censorship of transactions[^536] and vul
|
|||||||
|
|
||||||
## When converting from BTC to Monero:
|
## When converting from BTC to Monero:
|
||||||
|
|
||||||
**Now, as part of any process above, if you want to convert BTC back to Monero**,Werecommend not using a swapping service but instead recommend using the new Monero Atomic Swap Tool: <https://unstoppableswap.net/>. This will prevent unnecessary fees and intermediates when using a commercial swapping service. The website is self-explanatory with detailed instructions for all OSes.
|
**Now, as part of any process above, if you want to convert BTC back to Monero**, we recommend not using a swapping service but instead recommend using the new Monero Atomic Swap Tool: <https://unstoppableswap.net/>. This will prevent unnecessary fees and intermediates when using a commercial swapping service. The website is self-explanatory with detailed instructions for all OSes.
|
||||||
|
|
||||||
# Appendix A1: Recommended VPS hosting providers
|
# Appendix A1: Recommended VPS hosting providers
|
||||||
|
|
||||||
@@ -11891,7 +11891,7 @@ Note that some of those have a convenient ".onion" address:
|
|||||||
|
|
||||||
- DuckDuckGo: <https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/>
|
- DuckDuckGo: <https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/>
|
||||||
|
|
||||||
In the end,Weam often not satisfied with the results of both those search engines and still end up on Bing or Google.
|
In the end, we were often not satisfied with the results of both those search engines and still ended up on Bing or Google.
|
||||||
|
|
||||||
# Appendix A4: Counteracting Forensic Linguistics
|
# Appendix A4: Counteracting Forensic Linguistics
|
||||||
|
|
||||||
@@ -12005,7 +12005,7 @@ Finally, and optionally, add some salt by purposefully adding some mistakes to y
|
|||||||
|
|
||||||
First decide upon a list of words that you frequently do not misspell, maybe the words "grammatical", "symbol", and "pronounced" (this list should include more words). **Do not use an AutoCorrect automatic replace option for this as it might correct when it does not make sense.** Instead, use Search and Replace and do this manually for each word. **Do not use "Replace All" either and review each change.** This is just the first step, for providing misinformation against linguistic fingerprinting.
|
First decide upon a list of words that you frequently do not misspell, maybe the words "grammatical", "symbol", and "pronounced" (this list should include more words). **Do not use an AutoCorrect automatic replace option for this as it might correct when it does not make sense.** Instead, use Search and Replace and do this manually for each word. **Do not use "Replace All" either and review each change.** This is just the first step, for providing misinformation against linguistic fingerprinting.
|
||||||
|
|
||||||
Next, find a list of words that you commonly use in your writing. Let us say thatWelove to use contractions whenWewrite, maybeWealways use words such as: "can't", "don't", "shouldn't", "won't", or "let's". Well, maybe go into LibreWriter and use "Search and Replace" to replace all contractions with the full versions of the words ("can't" > "cannot", "don't" > "do not", "shouldn't" > "should not", "won't" > "will not", "let's" > "let us"). This can make a large difference in your writing and give a difference in how people and most importantly your adversaries perceive you. You can change most words to be different, as an example you can change "huge" to "large". Just make sure these words fit with your identity.
|
Next, find a list of words that you commonly use in your writing. Let us say that we love to use contractions when wew rite, maybe we always use words such as: "can't", "don't", "shouldn't", "won't", or "let's". Well, maybe go into LibreWriter and use "Search and Replace" to replace all contractions with the full versions of the words ("can't" > "cannot", "don't" > "do not", "shouldn't" > "should not", "won't" > "will not", "let's" > "let us"). This can make a large difference in your writing and give a difference in how people and most importantly your adversaries perceive you. You can change most words to be different, as an example you can change "huge" to "large". Just make sure these words fit with your identity.
|
||||||
|
|
||||||
Now, consider changing your words choices to fit a geographic location. Maybe you live in the US, and you want to give the impression that your identity is from the UK. For example, you can make use of location-based spelling and lexicon. This is risky, and one mistake can give it away.
|
Now, consider changing your words choices to fit a geographic location. Maybe you live in the US, and you want to give the impression that your identity is from the UK. For example, you can make use of location-based spelling and lexicon. This is risky, and one mistake can give it away.
|
||||||
|
|
||||||
@@ -12045,9 +12045,9 @@ You might also consider the use of something like AnonyMouth <https://web.archiv
|
|||||||
|
|
||||||
- <https://wikipedia.org/wiki/Ted_Kaczynski#After_publication> <sup>[[Wikiless]][718]</sup> <sup>[[Archive.org]][719]</sup>: May have an IQ of 167, but he was caught primarily based on forensic linguistics.
|
- <https://wikipedia.org/wiki/Ted_Kaczynski#After_publication> <sup>[[Wikiless]][718]</sup> <sup>[[Archive.org]][719]</sup>: May have an IQ of 167, but he was caught primarily based on forensic linguistics.
|
||||||
|
|
||||||
- <https://i.blackhat.com/USA-19/Wednesday/us-19-Wixey-Im-Unique-Just-Like-You-Human-Side-Channels-And-Their-Implications-For-Security-And-Privacy.pdf> <sup>[[Archive.org]][720]</sup>: Explains how your writing style can be used to track you,Wehighly recommend reading through these slides, or watching the accompanying presentation on YouTube.
|
- <https://i.blackhat.com/USA-19/Wednesday/us-19-Wixey-Im-Unique-Just-Like-You-Human-Side-Channels-And-Their-Implications-For-Security-And-Privacy.pdf> <sup>[[Archive.org]][720]</sup>: Explains how your writing style can be used to track you, we highly recommend reading through these slides, or watching the accompanying presentation on YouTube.
|
||||||
|
|
||||||
- <https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/DEFCON-26-Matt-Wixey-Betrayed-by-the-Keyboard-Updated.pdf> <sup>[[Archive.org]][721]</sup>: Explains how your writing style can be used to track you,Wehighly recommend reading through these slides, or watching the accompanying presentation on YouTube, this is quite similar to the last presentation.
|
- <https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/DEFCON-26-Matt-Wixey-Betrayed-by-the-Keyboard-Updated.pdf> <sup>[[Archive.org]][721]</sup>: Explains how your writing style can be used to track you, we highly recommend reading through these slides, or watching the accompanying presentation on YouTube, this is quite similar to the last presentation.
|
||||||
|
|
||||||
- <https://i.blackhat.com/us-18/Wed-August-8/us-18-Wixey-Every-ROSE-Has-Its-Thorn-The-Dark-Art-Of-Remote-Online-Social-Engineering.pdf> <sup>[[Archive.org]][722]</sup>: This goes over how to potentially spot deception through the internet, and presents a checklist to see how trustworthy someone is. We would advise reading the slides or watching the presentation on YouTube.
|
- <https://i.blackhat.com/us-18/Wed-August-8/us-18-Wixey-Every-ROSE-Has-Its-Thorn-The-Dark-Art-Of-Remote-Online-Social-Engineering.pdf> <sup>[[Archive.org]][722]</sup>: This goes over how to potentially spot deception through the internet, and presents a checklist to see how trustworthy someone is. We would advise reading the slides or watching the presentation on YouTube.
|
||||||
|
|
||||||
@@ -12103,7 +12103,7 @@ Offline versions (best format for the best readability) of this guide at:
|
|||||||
|
|
||||||
# Appendix A7: Comparing versions
|
# Appendix A7: Comparing versions
|
||||||
|
|
||||||
If you want to compare an older version of the PDF with a newer version, consider these online tools (note thatWedo not endorse those tools in relation to their privacy policies, but it should not matter since these PDFs are public):
|
If you want to compare an older version of the PDF with a newer version, consider these online tools (note that we do not endorse those tools in relation to their privacy policies, but it should not matter since these PDFs are public):
|
||||||
|
|
||||||
- <https://tools.pdf24.org/en/compare-pdf>
|
- <https://tools.pdf24.org/en/compare-pdf>
|
||||||
|
|
||||||
@@ -12495,7 +12495,7 @@ You can find some introduction on these on these projects:
|
|||||||
|
|
||||||
[^113]: Reuters, Exclusive: Apple dropped plan for encrypting backups after FBI complained -- sources <https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT> <sup>[[Archive.org]][887]</sup>
|
[^113]: Reuters, Exclusive: Apple dropped plan for encrypting backups after FBI complained -- sources <https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT> <sup>[[Archive.org]][887]</sup>
|
||||||
|
|
||||||
[^114]: ZDnet,Weasked Apple for all my data. Here's what was sent back <https://www.zdnet.com/article/apple-data-collection-stored-request/> <sup>[[Archive.org]][888]</sup>
|
[^114]: ZDnet, I asked Apple for all my data. Here's what was sent back <https://www.zdnet.com/article/apple-data-collection-stored-request/> <sup>[[Archive.org]][888]</sup>
|
||||||
|
|
||||||
[^115]: De Correspondent, Here's how we found the names and addresses of soldiers and secret agents using a simple fitness app <https://decorrespondent.nl/8481/heres-how-we-found-the-names-and-addresses-of-soldiers-and-secret-agents-using-a-simple-fitness-app/412999257-6756ba27> <sup>[[Archive.org]][889]</sup>
|
[^115]: De Correspondent, Here's how we found the names and addresses of soldiers and secret agents using a simple fitness app <https://decorrespondent.nl/8481/heres-how-we-found-the-names-and-addresses-of-soldiers-and-secret-agents-using-a-simple-fitness-app/412999257-6756ba27> <sup>[[Archive.org]][889]</sup>
|
||||||
|
|
||||||
@@ -12517,7 +12517,7 @@ You can find some introduction on these on these projects:
|
|||||||
|
|
||||||
[^124]: Wikipedia, Google SensorVault, <https://en.wikipedia.org/wiki/Sensorvault> <sup>[[Wikiless]][898]</sup> <sup>[[Archive.org]][899]</sup>
|
[^124]: Wikipedia, Google SensorVault, <https://en.wikipedia.org/wiki/Sensorvault> <sup>[[Wikiless]][898]</sup> <sup>[[Archive.org]][899]</sup>
|
||||||
|
|
||||||
[^125]: NRKBeta, My Phone Was Spying on Me, soWeTracked Down the Surveillants <https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i-tracked-down-the-surveillants/> <sup>[[Archive.org]][900]</sup>
|
[^125]: NRKBeta, My Phone Was Spying on Me, so I Tracked Down the Surveillants <https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i-tracked-down-the-surveillants/> <sup>[[Archive.org]][900]</sup>
|
||||||
|
|
||||||
[^126]: New York Times <https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html> <sup>[[Archive.org]][901]</sup>
|
[^126]: New York Times <https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html> <sup>[[Archive.org]][901]</sup>
|
||||||
|
|
||||||
@@ -12697,7 +12697,7 @@ You can find some introduction on these on these projects:
|
|||||||
|
|
||||||
[^214]: Wikipedia, Stuxnet <https://en.wikipedia.org/wiki/Stuxnet> <sup>[[Wikiless]][1002]</sup> <sup>[[Archive.org]][1003]</sup>
|
[^214]: Wikipedia, Stuxnet <https://en.wikipedia.org/wiki/Stuxnet> <sup>[[Wikiless]][1002]</sup> <sup>[[Archive.org]][1003]</sup>
|
||||||
|
|
||||||
[^215]: Superuser.com, How doWesafely investigate a USB stick found in the parking lot at work? <https://superuser.com/questions/1206321/how-do-i-safely-investigate-a-usb-stick-found-in-the-parking-lot-at-work> <sup>[[Archive.org]][1004]</sup>
|
[^215]: Superuser.com, How do I safely investigate a USB stick found in the parking lot at work? <https://superuser.com/questions/1206321/how-do-i-safely-investigate-a-usb-stick-found-in-the-parking-lot-at-work> <sup>[[Archive.org]][1004]</sup>
|
||||||
|
|
||||||
[^216]: The Guardian, Glenn Greenwald: how the NSA tampers with US-made internet routers <https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden> <sup>[[Archive.org]][1005]</sup>
|
[^216]: The Guardian, Glenn Greenwald: how the NSA tampers with US-made internet routers <https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden> <sup>[[Archive.org]][1005]</sup>
|
||||||
|
|
||||||
@@ -12863,7 +12863,7 @@ You can find some introduction on these on these projects:
|
|||||||
|
|
||||||
[^299]: Usenix.org, Shedding too much Light on a Microcontroller's Firmware Protection <https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf> <sup>[[Archive.org]][1107]</sup>
|
[^299]: Usenix.org, Shedding too much Light on a Microcontroller's Firmware Protection <https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf> <sup>[[Archive.org]][1107]</sup>
|
||||||
|
|
||||||
[^300]: TorProject.org, CanWerun Tor Browser on an iOS device? <https://support.torproject.org/tormobile/tormobile-3/> <sup>[[Archive.org]][1108]</sup>
|
[^300]: TorProject.org, Can I run Tor Browser on an iOS device? <https://support.torproject.org/tormobile/tormobile-3/> <sup>[[Archive.org]][1108]</sup>
|
||||||
|
|
||||||
[^301]: Wikipedia, Tails <https://en.wikipedia.org/wiki/Tails_(operating_system)> <sup>[[Wikiless]][1109]</sup> <sup>[[Archive.org]][1110]</sup>
|
[^301]: Wikipedia, Tails <https://en.wikipedia.org/wiki/Tails_(operating_system)> <sup>[[Wikiless]][1109]</sup> <sup>[[Archive.org]][1110]</sup>
|
||||||
|
|
||||||
@@ -13147,7 +13147,7 @@ You can find some introduction on these on these projects:
|
|||||||
|
|
||||||
[^441]: Partedmagic NVMe Secure Erase <https://partedmagic.com/nvme-secure-erase/> <sup>[[Archive.org]][1258]</sup>
|
[^441]: Partedmagic NVMe Secure Erase <https://partedmagic.com/nvme-secure-erase/> <sup>[[Archive.org]][1258]</sup>
|
||||||
|
|
||||||
[^442]: UFSExplorer, CanWerecover data from an encrypted storage? <https://www.ufsexplorer.com/solutions/data-recovery-on-encrypted-storage.php> <sup>[[Archive.org]][1259]</sup>
|
[^442]: UFSExplorer, Can I recover data from an encrypted storage? <https://www.ufsexplorer.com/solutions/data-recovery-on-encrypted-storage.php> <sup>[[Archive.org]][1259]</sup>
|
||||||
|
|
||||||
[^443]: Apple Developer Documentation <https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html> <sup>[[Archive.org]][1260]</sup>
|
[^443]: Apple Developer Documentation <https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html> <sup>[[Archive.org]][1260]</sup>
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user