Signed recent changes

and fixed the PDF build

export/guide.html

@@ -847,7 +847,7 @@
 <p>See “We kill people based on Metadata”<a href="#fn146" class="footnote-ref" id="fnref146" role="doc-noteref"><sup>146</sup></a> or this famous tweet from the IDF <a href="https://twitter.com/idf/status/1125066395010699264" class="uri">https://twitter.com/idf/status/1125066395010699264</a> <sup><a href="https://web.archive.org/web/https://twitter.com/idf/status/1125066395010699264">[Archive.org]</a></sup> <sup><a href="https://nitter.net/idf/status/1125066395010699264">[Nitter]</a></sup>.</p>
 <p>See <a href="#appendix-n-warning-about-smartphones-and-smart-devices">Appendix N: Warning about smartphones and smart devices</a></p>
 <h3 id="your-digital-fingerprint-footprint-and-online-behavior">Your Digital Fingerprint, Footprint, and Online Behavior:</h3>
-<p>This is the part where you should watch the documentary “The Social Dilemma”<a href="#fn147" class="footnote-ref" id="fnref147" role="doc-noteref"><sup>147</sup></a> on Netflix as they cover this topic much better than anyone else IMHO.</p>
+<p>This is the part where you should watch the documentary “The Social Dilemma”<a href="#fn147" class="footnote-ref" id="fnref147" role="doc-noteref"><sup>147</sup></a> on Netflix as they cover this topic much better than anyone else.</p>
 <p>This includes is the way you write (stylometry) <a href="#fn148" class="footnote-ref" id="fnref148" role="doc-noteref"><sup>148</sup></a>‘<a href="#fn149" class="footnote-ref" id="fnref149" role="doc-noteref"><sup>149</sup></a>, the way you behave<a href="#fn150" class="footnote-ref" id="fnref150" role="doc-noteref"><sup>150</sup></a>’<a href="#fn151" class="footnote-ref" id="fnref151" role="doc-noteref"><sup>151</sup></a>. The way you click. The way you browse. The fonts you use on your browser<a href="#fn152" class="footnote-ref" id="fnref152" role="doc-noteref"><sup>152</sup></a>. Fingerprinting is being used to guess who someone is by the way that user is behaving. You might be using specific pedantic words or making specific spelling mistakes that could give you away using a simple Google search for similar features because you typed comparably on some Reddit post 5 years ago using a not so anonymous Reddit account<a href="#fn153" class="footnote-ref" id="fnref153" role="doc-noteref"><sup>153</sup></a>. The words you type in a search engine alone can be used against you as the authorities now have warrants to find users who used specific keywords in search engines<a href="#fn154" class="footnote-ref" id="fnref154" role="doc-noteref"><sup>154</sup></a>.</p>
 <p>Social Media platforms such as Facebook/Google can go a step further and can register your behavior in the browser itself. For instance, they can register everything you type even if you do not send it / save it. Think of when you draft an e-mail in Gmail. It is saved automatically as you type. They can register your clicks and cursor movements as well.</p>
 <p>All they need to achieve this in most cases is Javascript enabled in your browser (which is the case in most Browsers including Tor Browser by default). Even with Javascript disabled, there are still ways to fingerprint you<a href="#fn155" class="footnote-ref" id="fnref155" role="doc-noteref"><sup>155</sup></a>.</p>
@@ -1501,7 +1501,7 @@
 <li><p><a href="https://sms24.me" class="uri">https://sms24.me</a></p></li>
 </ul>
 <p><strong>DISCLAIMER:We cannot vouch for any of these providers and therefore we will still recommend doing it yourself physically. In this case, you will have to rely on the anonymity of Monero and you should not use any service that requires any kind of identification using your real identity. Please do read <a href="#appendix-b2-monero-disclaimer">Appendix B2: Monero Disclaimer</a>.</strong></p>
-<p>Therefore IMHO, it is just more convenient, cheaper, and less risky to just get a pre-paid SIM card from one of the physical places that still sell them for cash without requiring ID registration. But at least there is an alternative if you have no other choice.</p>
+<p>Therefore, it is just more convenient, cheaper, and less risky to just get a pre-paid SIM card from one of the physical places that still sell them for cash without requiring ID registration. But at least there is an alternative if you have no other choice.</p>
 <h3 id="get-a-usb-key">Get a USB key:</h3>
 <p><strong>Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms but just want anonymous browsing or if the platforms you will use allow registration without a phone number.</strong></p>
 <p>Get at least one or two decent size generic USB keys (at least 16GB but we would recommend 32GB).</p>
@@ -1766,7 +1766,7 @@
 <p>All future online steps performed with this laptop should ideally be done from a safe network such as Public Wi-Fi in a safe place (see <a href="#find-some-safe-places-with-decent-public-wi-fi">Find some safe places with decent public Wi-Fi</a>). But several steps will have to be taken offline first.</p>
 <h3 id="some-laptop-recommendations">Some laptop recommendations:</h3>
 <p>We would strongly recommend getting a “business grade” laptop (meaning not consumer/gaming-grade laptop) if you can. For instance, some ThinkPad from Lenovo (my personal favorite).</p>
-<p>This is because those business laptops usually offer better and more customizable security features (especially in the BIOS/UEFI settings) with longer support than most consumer laptops (Asus, MSI, Gigabyte, Acer…). The interesting features to look for are IMHO:</p>
+<p>This is because those business laptops usually offer better and more customizable security features (especially in the BIOS/UEFI settings) with longer support than most consumer laptops (Asus, MSI, Gigabyte, Acer…). The interesting features to look for are:</p>
 <ul>
 <li><p>Better custom Secure Boot <strong>settings (where you can selectively manage all the keys and not just use the Standard ones)</strong></p></li>
 <li><p>HDD/SSD passwords in addition to just BIOS/UEFI passwords.</p></li>
@@ -2564,7 +2564,7 @@
 <p><strong>In the context of this guide, Tor is required somewhere to achieve reasonable and safe anonymity and you should use it if you can.</strong></p>
 <h4 id="no-vpntor">No VPN/Tor:</h4>
 <p>If you cannot use VPN nor Tor where you are, you probably are in a very hostile environment where surveillance and control are extremely high.</p>
-<p>Just do not, it is not worth it and too risky IMHO. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes.</p>
+<p>Just do not, it is not worth it and too risky. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes.</p>
 <p>Do not forget to check back on <a href="#threats">Adversaries (threats)</a> and <a href="#appendix-s-check-your-network-for-surveillancecensorship-using-ooni">Appendix S: Check your network for surveillance/censorship using OONI</a>.</p>
 <p>If you have absolutely no other option and still want to do something, see <a href="#appendix-p-accessing-the-internet-as-safely-as-possible-when-tor-and-vpns-are-not-an-option">Appendix P: Accessing the internet as safely as possible when Tor/VPN is not an option</a> <strong>(at your own risk) and consider <a href="#the-tor-browser-route">The Tails route</a> instead.</strong></p>
 <h4 id="conclusion-1">Conclusion:</h4>
@@ -3012,7 +3012,7 @@
 <h4 id="about-vpn-client-data-miningleaks">About VPN Client Data Mining/Leaks:</h4>
 <p>You might be asking yourself if those VPN clients are trustworthy not to leak any information about your local environment to the VPN provider when using them in the “VPN over Tor” context.</p>
 <p>This is a valid concern but should be taken with a grain of salt.</p>
-<p>Remember that all VPN activities are happening from a sandboxed VM on an internal network behind a Network Gateway (the Whonix Gateway). It does not matter much if the VPN client leaves some identifiers on your guest VM. The guest VM is still sandboxed and walled-off from the Host OS. The attack surface is IMHO pretty small especially when using the reputable and recommended VPN providers within the guides (iVPN, Mullvad, Proton VPN, and maybe Safing.io).</p>
+<p>Remember that all VPN activities are happening from a sandboxed VM on an internal network behind a Network Gateway (the Whonix Gateway). It does not matter much if the VPN client leaves some identifiers on your guest VM. The guest VM is still sandboxed and walled-off from the Host OS. The attack surface is small especially when using the reputable and recommended VPN providers within the guides (iVPN, Mullvad, Proton VPN, and maybe Safing.io).</p>
 <p>At best, the VPN client would know your local IP (internal IP) and some randomized identifiers but should not be able to get anything from the Host OS. And in theory, the VPN client should not send any telemetry back to the VPN provider. If your VPN client does this or asks this, you should consider changing the provider.</p>
 <h3 id="optional-allowing-only-the-vms-to-access-the-internet-while-cutting-off-the-host-os-to-prevent-any-leak">(Optional) Allowing only the VMs to access the internet while cutting off the Host OS to prevent any leak:</h3>
 <p>This step will allow you to configure your Host OS so that only the Whonix Gateway VM will have access to the internet. This will therefore prevent any “leak” from your Host OS while letting the Whonix Gateway establish the tor connectivity. The other VMs (Whonix Workstation or any other VM you installed behind it will not be affected)</p>
@@ -3026,7 +3026,7 @@
 <li><p>The Best Way: Using an external USB Wi-Fi dongle and just disabling Wi-Fi on the Host OS/Computer.</p></li>
 </ul>
 <h4 id="the-lazy-way-not-supported-by-whonix-but-it-will-work-if-you-are-in-a-hurry-see-further-for-the-better-way">The Lazy Way (<strong>not supported by Whonix</strong> but it will work if you are in a hurry, see further for the better way):</h4>
-<p><strong>This way is not supported by the Whonix project</strong><a href="#fn373" class="footnote-ref" id="fnref373" role="doc-noteref"><sup>373</sup></a> but we will go ahead and give this option anyway. IMHO this is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.</p>
+<p><strong>This way is not supported by the Whonix project</strong><a href="#fn373" class="footnote-ref" id="fnref373" role="doc-noteref"><sup>373</sup></a> but I will go ahead and give this option anyway. This is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs.</p>
 <p><strong>Note that this option as-is will only work on Wi-Fis without a captive portal (where you must enter some information to unlock access).</strong></p>
 <p>The illustration below shows the result of this step:</p>
 <p><img src="data:image/jpeg;base64,/9j/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAIPBEYDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD9G/2mfiX8RrT9o349Wdr4+8Z21pZfGT4l2VnaweJ9bit7Szs/GOsW1paW0KXqxwW1rbRRW9tBEqxQQRxwxIsaKo8Q/wCFp/E3/oonjj/wq9d/+Tq7n9qH/k5b9oT/ALLb8U//AFONcrwqv9GOHcsy2fD+RSll2BlKWTZXKUpYTDuUpPBUG5Sbpttt6tt3b1P85swq1Xj8c3UqNvGYltucm23Wm2227tt7s7z/AIWn8Tf+iieOP/Cr13/5Oo/4Wn8Tf+iieOP/AAq9d/8Ak6uDor2f7Kyv/oW4D/wjw/8A8r8l9xx+0qfzz/8AAn/md5/wtP4m/wDRRPHH/hV67/8AJ1H/AAtP4m/9FE8cf+FXrv8A8nVwdFH9lZX/ANC3Af8AhHh//lfkvuD2lT+ef/gT/wAzvP8AhafxN/6KJ44/8KvXf/k6j/hafxN/6KJ44/8ACr13/wCTq4Oij+ysr/6FuA/8I8P/APK/JfcHtKn88/8AwJ/5nef8LT+Jv/RRPHH/AIVeu/8AydR/wtP4m/8ARRPHH/hV67/8nVwdFH9lZX/0LcB/4R4f/wCV+S+4PaVP55/+BP8AzO8/4Wn8Tf8Aoonjj/wq9d/+TqP+Fp/E3/oonjj/AMKvXf8A5Org6KP7Kyv/AKFuA/8ACPD/APyvyX3B7Sp/PP8A8Cf+Z3n/AAtP4m/9FE8cf+FXrv8A8nUf8LT+Jv8A0UTxx/4Veu//ACdXB0Uf2Vlf/QtwH/hHh/8A5X5L7g9pU/nn/wCBP/M7z/hafxN/6KJ44/8ACr13/wCTqP8AhafxN/6KJ44/8KvXf/k6uDoo/srK/wDoW4D/AMI8P/8AK/JfcHtKn88//An/AJnef8LT+Jv/AEUTxx/4Veu//J1H/C0/ib/0UTxx/wCFXrv/AMnVwdFH9lZX/wBC3Af+EeH/APlfkvuD2lT+ef8A4E/8zvP+Fp/E3/oonjj/AMKvXf8A5Oo/4Wn8Tf8Aoonjj/wq9d/+Tq4Oij+ysr/6FuA/8I8P/wDK/JfcHtKn88//AAJ/5nef8LT+Jv8A0UTxx/4Veu//ACdR/wALT+Jv/RRPHH/hV67/APJ1cHRR/ZWV/wDQtwH/AIR4f/5X5L7g9pU/nn/4E/8AM7z/AIWn8Tf+iieOP/Cr13/5Oo/4Wn8Tf+iieOP/AAq9d/8Ak6uDoo/srK/+hbgP/CPD/wDyvyX3B7Sp/PP/AMCf+Z3n/C0/ib/0UTxx/wCFXrv/AMnUf8LT+Jv/AEUTxx/4Veu//J1cHRR/ZWV/9C3Af+EeH/8AlfkvuD2lT+ef/gT/AMzvP+Fp/E3/AKKJ44/8KvXf/k6j/hafxN/6KJ44/wDCr13/AOTq4Oij+ysr/wChbgP/AAjw/wD8r8l9we0qfzz/APAn/md5/wALT+Jv/RRPHH/hV67/APJ1H/C0/ib/ANFE8cf+FXrv/wAnVwdFH9lZX/0LcB/4R4f/AOV+S+4PaVP55/8AgT/zO8/4Wn8Tf+iieOP/AAq9d/8Ak6j/AIWn8Tf+iieOP/Cr13/5Org6KP7Kyv8A6FuA/wDCPD//ACvyX3B7Sp/PP/wJ/wCZ3n/C0/ib/wBFE8cf+FXrv/ydR/wtP4m/9FE8cf8AhV67/wDJ1cHRR/ZWV/8AQtwH/hHh/wD5X5L7g9pU/nn/AOBP/M7z/hafxN/6KJ44/wDCr13/AOTqP+Fp/E3/AKKJ44/8KvXf/k6uDoo/srK/+hbgP/CPD/8AyvyX3B7Sp/PP/wACf+Z3n/C0/ib/ANFE8cf+FXrv/wAnUf8AC0/ib/0UTxx/4Veu/wDydXB0Uf2Vlf8A0LcB/wCEeH/+V+S+4PaVP55/+BP/ADO8/wCFp/E3/oonjj/wq9d/+TqP+Fp/E3/oonjj/wAKvXf/AJOrg6KP7Kyv/oW4D/wjw/8A8r8l9we0qfzz/wDAn/md5/wtP4m/9FE8cf8AhV67/wDJ1H/C0/ib/wBFE8cf+FXrv/ydXB0Uf2Vlf/QtwH/hHh//AJX5L7g9pU/nn/4E/wDM7z/hafxN/wCiieOP/Cr13/5Oo/4Wn8Tf+iieOP8Awq9d/wDk6uDoo/srK/8AoW4D/wAI8P8A/K/JfcHtKn88/wDwJ/5nef8AC0/ib/0UTxx/4Veu/wDydR/wtP4m/wDRRPHH/hV67/8AJ1cHRR/ZWV/9C3Af+EeH/wDlfkvuD2lT+ef/AIE/8zvP+Fp/E3/oonjj/wAKvXf/AJOo/wCFp/E3/oonjj/wq9d/+Tq4Oij+ysr/AOhbgP8Awjw//wAr8l9we0qfzz/8Cf8Amd5/wtP4m/8ARRPHH/hV67/8nUf8LT+Jv/RRPHH/AIVeu/8AydXB0Uf2Vlf/AELcB/4R4f8A+V+S+4PaVP55/wDgT/zPQYPif8TZZoYv+Fi+OB5sscef+Er13je4XP8Ax/ds1dvPih8QbfU5418eePjaW9w8JhPjTW/NkELGNiJ/OwnmMu/HksUB2ZYjdXmsMhililAyYpEkAPAJRgwBPvjFfSfwX8YeKPCfg79ovxZ4O8Q694P8Rw+CfCn2PXPDGsajoWtWUWpfF3wPFewWuraXcWl/DFcwSNb3KRTItxCTHKrIxWvEzPLsLh6sa9PKcDVoSo0sDGlang6bxWY5jgcJCcqlGjUqwlThNzjXjRnUpKMo0ZQlUk37OWulXpuhOvKlWjWq42VX6tDF1FhsBl+LxUoRhWnTpzVSdNQlRlWhCo3F1VONOKXm1x8WvHLxOtv4z+IMEx27JZPHmtzouGBbdFmLfuXKj94uCQ3ONpbbfFnx1HFtuvGvxBuJdxJkj8d63bptP3VEW6YjHcmQ5PYDiul/4ad/aU/6OF+OP/h2fHv/AMv6P+Gnf2lP+jhfjj/4dnx7/wDL+udcPRVB4f8AsHKvZup7Xm/t/NXX5uVRssU8q+sqnZJ+xVVUeb3+TmbZv9fwXtlX+vYjnVP2XL/qzkvseXm5rvDf2h9XdS7f710nV5bR5+XRco3xX+IJuhIvjrx8tpuUm2PjXW2lKhQGX7V5wA3Plgfs+VU7eSN9WLj4teOXidbfxn8QYJjt2SyePNbnRcMC26LMW/cuVH7xcEhucbT0f/DTv7Sn/Rwvxx/8Oz49/wDl/R/w07+0p/0cL8cf/Ds+Pf8A5f1cshUpYebyDJ08NGnGmo55mUYyVJpxdeEcoUMXJtL2k8VGtKqtKrmtCY4zAxjXgsfirYiU5VG+HMolKLqK0vYTlmTnhorX2ccNKlGm7OmoPVc1bfFnx1HFtuvGvxBuJdxJkj8d63bptP3VEW6YjHcmQ5PYDiorn4nfEth9rt/Hfjy3spZXghEnjHW7hhLDFA8yGQXUJYjzo3GYlG2QKC5RjXvvwg+Ofxt8a+IvFfhnxl8Yfin4t8Oaj8EP2km1Dw/4m+IPi3XtEvmsP2ePihqVi15pWq6vd2F01lqNnaX9oZ4HNte2ttdQ7J4IpF+THuYm0m2tAT58eo31w67TgRTW2nxRnd0JL28owOQFBONwzlh8uw1PNHSnkWBhWm8NPEOnisVmWFhhcZDM5KcKGIw+Fw+EnTxOW0qalDDuChWVODi5tGlf2M8sVWGNc6UViIYdVMtwGX4qeKwk8si4Tr0KmJr4qE8PmFSpyzxCm50HUmpctzq/+Fp/E3/oonjj/wAKvXf/AJOo/wCFp/E3/oonjj/wq9d/+Tq4Oivpf7Kyv/oW4D/wjw//AMr8l9x877Sp/PP/AMCf+Z3n/C0/ib/0UTxx/wCFXrv/AMnUf8LT+Jv/AEUTxx/4Veu//J1cHRR/ZWV/9C3Af+EeH/8AlfkvuD2lT+ef/gT/AMzvP+Fp/E3/AKKJ44/8KvXf/k6j/hafxN/6KJ44/wDCr13/AOTq4Oij+ysr/wChbgP/AAjw/wD8r8l9we0qfzz/APAn/md5/wALT+Jv/RRPHH/hV67/APJ1H/C0/ib/ANFE8cf+FXrv/wAnVwdFH9lZX/0LcB/4R4f/AOV+S+4PaVP55/8AgT/zO8/4Wn8Tf+iieOP/AAq9d/8Ak6j/AIWn8Tf+iieOP/Cr13/5Org6KP7Kyv8A6FuA/wDCPD//ACvyX3B7Sp/PP/wJ/wCZ3n/C0/ib/wBFE8cf+FXrv/ydR/wtP4m/9FE8cf8AhV67/wDJ1cHRR/ZLine truncated
@@ -3107,7 +3107,7 @@
 <p>This way will not go against Whonix recommendations (as it will not expose the Whonix Gateway to the Host OS) and will have the advantage of allowing connections not only to open Wi-Fis but also to the ones with a Captive Portal where you need to enter some information to access the internet.</p>
 <p>Yet this will still not be supported by the Whonix project, but it is fine as the main concern for the earlier Lazy Way is to have the Whonix Gateway VM exposed to the Host Network, and it will not be the case here.</p>
 <p>This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge.</p>
-<p>For this purpose, we will recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro and we would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.</p>
+<p>For this purpose, I will recommend the use of a lightweight Linux Distro. Any will do but the easiest will be an Ubuntu-based distro and I would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.</p>
 <p>Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.</p>
 <p>Of course, you can also achieve this with any other Linux distro if you so decide you do not like XUbuntu.</p>
 <p>This is how it will look at the end:</p>
@@ -3235,7 +3235,7 @@
 <h4 id="the-best-way">The best way:</h4>
 <p>This way will not go against Whonix recommendations (as it will not expose the Whonix Gateway to the Host OS) and will have the advantage of allowing connections not only to open Wi-Fis but also to the ones with a Captive Portal where you need to enter some information to access the internet. Yet this will still not be supported by the Whonix project, but it is fine as the main concern for the earlier Lazy Way is to have the Whonix Gateway VM exposed to the Host Network, and it will not be the case here. This option is the best because the network will be completely disabled on the Host OS from booting up.</p>
 <p>This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge and to connect to the Wi-Fi network. <strong>This option requires a working USB Wi-Fi Dongle that will be passed through to a bridge VM.</strong></p>
-<p>For this purpose, we will recommend the use of a lightweight Linux Distro. Any will do but the easiest IMHO will be an Ubuntu-based distro and we would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.</p>
+<p>For this purpose, I will recommend the use of a lightweight Linux Distro. Any will do but the easiest will be an Ubuntu-based distro and I would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup.</p>
 <p>Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else.</p>
 <p>Of course, you can also achieve this with any other Linux distro if you so decide you do not like XUbuntu.</p>
 <p>This is how it will look at the end:</p>
@@ -3330,7 +3330,7 @@
 <p><strong>Take a post-install VirtualBox snapshot of your VMs.</strong></p>
 <p>You are done and can now skip the rest to go to the <a href="#getting-online">Getting Online</a> part.</p>
 <h2 id="the-qubes-route">The Qubes Route:</h2>
-<p><strong>Note that while this route is written for Qubes OS 4.0.x, it should also work with Qubes OS 4.1.x but it hasn’t been tested yet. The guide will be updated and tested for Qubes OS 4.1 soon. In the mean time, you can see the changelog here: <a href="https://www.qubes-os.org/doc/releases/4.1/release-notes/" class="uri">https://www.qubes-os.org/doc/releases/4.1/release-notes/</a></strong></p>
+<p><strong>Note that the guide has been updated to Qubes OS 4.1</strong></p>
 <p>As they say on their website, Qubes OS is a reasonably secure, free, open-source, and security-oriented operating system for single-user desktop computing. Qubes OS leverages and extensively uses Xen-based virtualization to allow for the creation and management of isolated compartments called Qubes.</p>
 <p>Qubes OS is not a Linux distribution<a href="#fn374" class="footnote-ref" id="fnref374" role="doc-noteref"><sup>374</sup></a> but a Xen distribution. It is different from Linux distributions because it will make extensive use of Virtualization and Compartmentalization so that any app will run in a different VM (Qube). As a bonus, Qubes OS integrates Whonix by default and allows for increased privacy and anonymity. It is highly recommended that you document yourself over Qubes OS principles before going this route. Here are some recommended resources:</p>
 <ul>
@@ -3438,7 +3438,7 @@
 <p><strong>In the context of this guide, Tor is required somewhere to achieve reasonable and safe anonymity and you should use it if you can.</strong></p>
 <h4 id="no-vpntor-1">No VPN/Tor:</h4>
 <p>If you cannot use VPN nor Tor where you are, you probably are in a very hostile environment where surveillance and control are extremely high.</p>
-<p>Just do not, it is not worth it and too risky IMHO. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes.</p>
+<p>Just do not, it is not worth it and too risky. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes.</p>
 <p>Do not forget to check back on <a href="#threats">Adversaries (threats)</a> and <a href="#appendix-s-check-your-network-for-surveillancecensorship-using-ooni">Appendix S: Check your network for surveillance/censorship using OONI</a>.</p>
 <p>If you have absolutely no other option and still want to do something, see <a href="#appendix-p-accessing-the-internet-as-safely-as-possible-when-tor-and-vpns-are-not-an-option">Appendix P: Accessing the internet as safely as possible when Tor/VPN is not an option</a> <strong>(at your own risk).</strong></p>
 <h4 id="conclusion-2">Conclusion:</h4>
@@ -3581,7 +3581,7 @@
 <p><strong>Skip this step if you want to use Tor only or VPN is not an option.</strong></p>
 <p>See <a href="#appendix-o-getting-an-anonymous-vpnproxy">Appendix O: Getting an anonymous VPN/Proxy</a></p>
 <h3 id="note-about-plausible-deniability">Note about Plausible Deniability:</h3>
-<p>Qubes OS uses LUKS for full disk encryption and it is technically possible to achieve a form of deniability by using detached LUKS headers. This is not yet integrated into this guide but you will find a tutorial on how to achieve this here: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/af76301c21e1b4a33851" class="uri">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/af76301c21e1b4a33851</a> and some more background information within the Linux Host OS section (see <a href="#note-about-plausible-deniability-on-linux">Note about plausible deniability on Linux</a>).</p>
+<p>Qubes OS uses LUKS for full disk encryption and it is technically possible to achieve a form of deniability by using detached LUKS headers. This is not yet integrated into this guide but you will find an evolving tutorial on how to achieve this here: <a href="https://forum.qubes-os.org/t/qubes-os-installation-detached-encrypted-boot-and-header/6205" class="uri">https://forum.qubes-os.org/t/qubes-os-installation-detached-encrypted-boot-and-header/6205</a> and some more background information within the Linux Host OS section (see <a href="#note-about-plausible-deniability-on-linux">Note about plausible deniability on Linux</a>).</p>
 <h3 id="installation-3">Installation:</h3>
 <p>You will follow the instructions from their own guide <a href="https://www.qubes-os.org/doc/installation-guide/" class="uri">https://www.qubes-os.org/doc/installation-guide/</a> <sup><a href="https://web.archive.org/web/https://www.qubes-os.org/doc/installation-guide/">[Archive.org]</a></sup>:</p>
 <p>(Secure Boot is not supported as per their FAQ: <a href="https://www.qubes-os.org/faq/#is-secure-boot-supported" class="uri">https://www.qubes-os.org/faq/#is-secure-boot-supported</a> <sup><a href="https://web.archive.org/web/https://www.qubes-os.org/faq/">[Archive.org]</a></sup> so it should be disabled in the BIOS/UEFI settings.)</p>
@@ -3595,13 +3595,22 @@
 <li><p>If you want to use Tor over VPN or cannot use any of those, leave it unchecked.</p></li>
 <li><p>Be absolutely sure that you are verifying the signature of the ISO, which you can find on this page: <a href="https://www.qubes-os.org/security/verifying-signatures/" class="uri">https://www.qubes-os.org/security/verifying-signatures/</a> <sup><a href="https://web.archive.org/web/20220511015546/https://www.qubes-os.org/security/verifying-signatures/">[Archive.org]</a></sup>. Check by obtaining the fingerprint from multiple independent sources in several different ways as recommended. This is to ensure the image has not been tampered with. Do not skip this vital step even though you know you are getting the ISO from a trusted source, because it’s possible for the Qubes website to be compromised.</p></li>
 </ul></li>
-<li><p>If you cannot use Tor at all, there is also no point in installing Whonix. So, you should disable Whonix installation within the Software Selection Menu.</p></li>
+<li><p>If you are prevented from using Tor, there is no point in installing the Whonix VM templates. You can disable Whonix installation during the post-installation, initial setup wizard.</p></li>
 </ul>
 <p>To be sure your Qubes ISO hasn’t been tampered with, you should get the Qubes master key fingerprint from multiple different sources. This guide can be used as one source.</p>
 <p>The Qubes master signing key fingerprint should match <code>427F 11FD 0FAA 4B08 0123  F01C DDFA 1A3E 3687 9494</code>.</p>
 <p><em>Remember to read the guide to verifying signatures on the Qubes website: <a href="https://www.qubes-os.org/security/verifying-signatures/" class="uri">https://www.qubes-os.org/security/verifying-signatures/</a> <sup><a href="https://web.archive.org/web/20220511015546/https://www.qubes-os.org/security/verifying-signatures/">[Archive.org]</a></sup>.</em></p>
 <h3 id="lid-closure-behavior">Lid Closure Behavior:</h3>
-<p>Unfortunately, Qubes OS does not support hibernation<a href="#fn377" class="footnote-ref" id="fnref377" role="doc-noteref"><sup>377</sup></a> which is IMHO an issue regarding cold-boot attacks. To mitigate those, we highly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.</p>
+<p>Unfortunately, Qubes OS does not support hibernation<a href="#fn377" class="footnote-ref" id="fnref377" role="doc-noteref"><sup>377</sup></a> which is an issue regarding cold-boot attacks. To mitigate those, I highly recommend that you configure Qubes OS to shut down on any power action (power button, lid closure). You can do set this from the XFCE Power Manager. Do not use the sleep features.</p>
+<h3 id="anti-evil-maid-aem">Anti Evil Maid (AEM):</h3>
+<p>Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks. Installing and using AEM requires attaching a USB drive directly to dom0. So the user must make a choice between protecting dom0 from a potentially malicious USB drive, and protecting the system from Evil Maid attacks. Note that AEM is only compatible with Intel CPUs and Legacy boot options.</p>
+<p>The preference for mitigating any evil maid attack is to maintain physical control of your device at all times. If that is not possible, then this might be relevant to your threat model.</p>
+<p>See the following links for more details and installation instructions:</p>
+<ul>
+<li><p><a href="https://www.qubes-os.org/doc/anti-evil-maid/" class="uri">https://www.qubes-os.org/doc/anti-evil-maid/</a> <sup><a href="https://web.archive.org/web/https://www.qubes-os.org/doc/anti-evil-maid/">[Archive.org]</a></sup></p></li>
+<li><p><a href="https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html" class="uri">https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html</a> <sup><a href="https://web.archive.org/web/https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html">[Archive.org]</a></sup></p></li>
+<li><p><a href="https://github.com/QubesOS/qubes-antievilmaid" class="uri">https://github.com/QubesOS/qubes-antievilmaid</a> <sup><a href="https://web.archive.org/web/https://github.com/QubesOS/qubes-antievilmaid">[Archive.org]</a></sup></p></li>
+</ul>
 <h3 id="connect-to-a-public-wi-fi">Connect to a Public Wi-Fi:</h3>
 <p>Remember this should be done from a safe place (see <a href="#find-some-safe-places-with-decent-public-wi-fi">Find some safe places with decent public Wi-Fi</a> and <a href="#appendix-q-using-long-range-antenna-to-connect-to-public-wi-fis-from-a-safe-distance">Appendix Q: Using long-range Antenna to connect to Public Wi-Fis from a safe distance</a>):</p>
 <ul>
@@ -3632,12 +3641,12 @@
 <p>After you are connected to a Wi-Fi you need to update Qubes OS and Whonix. You must keep Qubes OS always updated before conducting any sensitive activities. Especially your Browser VMs. Normally, Qubes OS will warn you about updates in the upper right corner with a gear icon. As this might take a while in this case due to using Tor, you can force the process by doing the following:</p>
 <ul>
 <li><p>Click the upper left Applications icon</p></li>
-<li><p>Select System Tools</p></li>
-<li><p>Select Qubes Update and Launch it</p></li>
+<li><p>Select Qubes Tools</p></li>
+<li><p>Select Qubes Update</p></li>
 <li><p>Check the “Enable updates for Qubes without known available updates”</p></li>
 <li><p>Select all the Qubes</p></li>
-<li><p>Click Next and update</p></li>
-<li><p>If you checked the Tor option during install, wait patiently as this might take a while over Tor</p></li>
+<li><p>Click Next and wait for updates to complete</p></li>
+<li><p>If you checked the Tor option during install, be patient as this might take a while over Tor</p></li>
 </ul>
 <h3 id="upgrading-whonix-from-version-15-to-version-16">Upgrading Whonix from version 15 to version 16:</h3>
 <p>Again, you should really do this ASAP. We would use a fresh install but it’s technically possible to do it in-place, see <a href="https://www.whonix.org/wiki/Release_Upgrade_Whonix_15_to_Whonix_16" class="uri">https://www.whonix.org/wiki/Release_Upgrade_Whonix_15_to_Whonix_16</a> <sup><a href="https://web.archive.org/web/https://www.whonix.org/wiki/Release_Upgrade_Whonix_15_to_Whonix_16">[Archive.org]</a></sup></p>
@@ -3681,13 +3690,35 @@
 <h3 id="setup-the-vpn-proxyvm">Setup the VPN ProxyVM:</h3>
 <p><strong>Skip this step if you do not want to use a VPN and just use Tor only or if VPN is not an option either.</strong></p>
 <p>This tutorial should also work with any OpenVPN provider (Mullvad, IVPN, Safing.io, or Proton VPN for instance).</p>
-<p>This is based on the tutorial provided by Qubes OS themselves (<a href="https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md" class="uri">https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md</a> <sup><a href="https://web.archive.org/web/https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md">[Archive.org]</a></sup>). This part of the guide needs reworking and update, please follow their tutorial.</p>
-<pre><code>-   If you are going for VPN over Tor, you need to go into the settings of the ProxyVM you made and select &quot;sys-vpn&quot; for networking.
-    -   An easier way to setup your ProxyVM is to simply run a VPN client on the ProxyVM.
-    -   Usually when you connect to your VPN provider&#39;s website, it&#39;ll tell you whether your traffic is being properly routed through the VPN.
-
--   If you are going for Tor over VPN, the opposite should be done, the ProxyVM should have its networking set as &quot;sys-tor&quot; and the &quot;sys-tor&quot; VM should have &quot;sys-vpn&quot; for its networking.
-    -   Test the VM connectivity to the internet by launching a Browser within the ProxyVM. Visit &lt;https://check.torproject.org&gt; &lt;sup&gt;[[Archive.org]][378]&lt;/sup&gt; (It should say you are connected to Tor)</code></pre>
+<p>This is based on the tutorial provided by Qubes OS themselves (<a href="https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md" class="uri">https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md</a> <sup><a href="https://web.archive.org/web/https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md">[Archive.org]</a></sup>). If you are familiar with this process, you can follow their tutorial.</p>
+<p>Alternatively, Mullvad also have a help article that guides you through setting up a Proxy VM <a href="https://mullvad.net/en/help/qubes-os-4-and-mullvad-vpn/" class="uri">https://mullvad.net/en/help/qubes-os-4-and-mullvad-vpn/</a> <sup><a href="https://web.archive.org/web/https://mullvad.net/en/help/qubes-os-4-and-mullvad-vpn/">[Archive.org]</a></sup>.</p>
+<h4 id="create-the-proxyvm">Create the ProxyVM:</h4>
+<ul>
+<li><p>Click the Applications icon (upper left corner)</p></li>
+<li><p>Click Create Qubes VM</p></li>
+<li><p>Name and label as you wish: I suggest “VPNGatewayVM”</p></li>
+<li><p>Select Type: Standalone Qube copied from a template</p></li>
+<li><p>Select Template: Debian-11 (the default)</p></li>
+<li><p>Select Networking:</p>
+<ul>
+<li><p>Select sys-whonix if you want to do VPN over Tor / Tor only (recommended)</p></li>
+<li><p>Select sys-firewall if you want to do Tor over VPN / No Tor or VPN / Just VPN</p></li>
+</ul></li>
+<li><p>Advanced: Check provides network</p></li>
+<li><p>Check “Start Qube automatically on boot”</p></li>
+<li><p>Create the VM</p>
+<ul>
+<li>If you are going for VPN over Tor, you need to go into the settings of the ProxyVM you made and select “sys-vpn” for networking.
+<ul>
+<li>An easier way to setup your ProxyVM is to simply run a VPN client on the ProxyVM.</li>
+<li>Usually when you connect to your VPN provider’s website, it’ll tell you whether your traffic is being properly routed through the VPN.</li>
+</ul></li>
+<li>If you are going for Tor over VPN, the opposite should be done, the ProxyVM should have its networking set as “sys-tor” and the “sys-tor” VM should have “sys-vpn” for its networking.
+<ul>
+<li>Test the VM connectivity to the internet by launching a Browser within the ProxyVM. Visit <a href="https://check.torproject.org" class="uri">https://check.torproject.org</a> <sup><a href="https://web.archive.org/web/https://check.torproject.org/">[Archive.org]</a></sup> (It should say you are connected to Tor)</li>
+</ul></li>
+</ul></li>
+</ul>
 <h4 id="download-the-vpn-configuration-from-your-cashmonero-paid-vpn-provider">Download the VPN configuration from your cash/Monero paid VPN provider:</h4>
 <h5 id="if-you-can-use-tor-1">If you can use Tor:</h5>
 <p><strong>Using Tor Browser (be careful not to use any Clearnet Browser for this),</strong> download the necessary OpenVPN configuration files for Linux from your VPN provider.</p>
@@ -3828,10 +3859,10 @@
 <h3 id="setup-a-safe-browser-within-qubes-os-optional-but-recommended">Setup a safe Browser within Qubes OS (optional but recommended):</h3>
 <p>See: <a href="#appendix-v-what-browser-to-use-in-your-guest-vmdisposable-vm">Appendix V: What browser to use in your Guest VM/Disposable VM</a></p>
 <h4 id="fedora-disposable-vm">Fedora Disposable VM:</h4>
-<p>Within the Applications Menu (upper left), Select the Fedora-34 template:</p>
+<p>Within the Applications Menu (upper left), Select the Fedora-36 template:</p>
 <ul>
 <li><p>Go into Qube Settings</p></li>
-<li><p>Clone the VM and name it “fedora-3x-brave” (this VM template will have Brave)</p></li>
+<li><p>Clone the VM and name it “fedora-36-brave” (this VM template will have Brave)</p></li>
 <li><p>Again, go into the Applications Menu and select the clone you just created</p></li>
 <li><p>Go into Qube Settings</p></li>
 <li><p>Change its network to the ProxyVPN and Apply</p></li>
@@ -3844,7 +3875,7 @@
 <li><p><code>sudo rpm --import https://brave-browser-rpm-release.s3.brave.com/brave-core.asc</code></p></li>
 <li><p><code>sudo dnf install brave-browser</code></p></li>
 </ul>
-<p>You should also consider hardening your browser, see</p>
+<p>You should also consider hardening your browser, see <a href="#appendix-v1-hardening-your-browsers">Appendix V1: Hardening your Browsers</a></p>
 <h4 id="whonix-disposable-vm">Whonix Disposable VM:</h4>
 <p>Edit the Whonix Disposable VM template and follow instructions here <a href="https://www.whonix.org/wiki/Install_Software" class="uri">https://www.whonix.org/wiki/Install_Software</a> <sup><a href="https://web.archive.org/web/https://www.whonix.org/wiki/Install_Software">[Archive.org]</a></sup></p>
 <h4 id="additional-browser-precautions">Additional browser precautions:</h4>
@@ -3923,22 +3954,16 @@
 <li><code>adb install my-app.apk</code></li>
 </ul></li>
 </ul>
-<p>That’s it, you should now have an Android Qube over Tor (or anything else) capable of running pretty much any App you can sideload with ADB. This is, for now, and IMHO, the easiest way to get Android emulation on Qubes OS.</p>
+<p>That’s it, you should now have an Android Qube over Tor (or anything else) capable of running pretty much any App you can sideload with ADB. This is, for now, the easiest way to get Android emulation on Qubes OS.</p>
 <h3 id="keepassxc-1">KeePassXC:</h3>
-<p>You will need something to store your data (logins/passwords, identities, and TOTP<a href="#fn380" class="footnote-ref" id="fnref380" role="doc-noteref"><sup>380</sup></a> information).</p>
-<p>For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA<a href="#fn381" class="footnote-ref" id="fnref381" role="doc-noteref"><sup>381</sup></a> authentication with the authenticator feature.</p>
-<p>In the context of Qubes OS you should store your sensitive information within the Domain-vault Qube:</p>
+<p>You will need somewhere to store your data (logins/passwords, identities, and TOTP<a href="#fn380" class="footnote-ref" id="fnref380" role="doc-noteref"><sup>380</sup></a> information).</p>
+<p>For this purpose, KeePassXC is recommended because of its integrated TOTP feature. This is the ability to create entries for 2FA<a href="#fn381" class="footnote-ref" id="fnref381" role="doc-noteref"><sup>381</sup></a> authentication with the authenticator feature.</p>
+<p>In the context of Qubes OS you should store your sensitive information within the vault Qube:</p>
 <ul>
-<li><p>First, click the Applications icon (upper left) and select the Domain: Vault Qube.</p></li>
+<li><p>First, click the Applications icon (upper left) and select the vault Qube.</p></li>
 <li><p>Click Qubes Settings</p></li>
-<li><p>Temporarily enable network by changing the network to your VPN ProxyVM you created earlier</p></li>
-<li><p>Open a terminal within the Domain: Vault Qube</p></li>
-<li><p>Type: <code>sudo dnf install keepassxc</code> and wait for it to install</p></li>
-<li><p>Close the terminal and disable the network by changing back the network to (none)</p></li>
-<li><p>Go back into the Domain: Vault Qube Settings and into the Applications tab</p></li>
-<li><p>Click Refresh</p></li>
-<li><p>Add KeePassXC to the Selected tab</p></li>
-<li><p>Launch KeePassXC within the Domain: Vault Qube</p></li>
+<li><p>Select the Applications tab</p></li>
+<li><p>From the list of available applications, add KeePassXC to the list of selected applications.</p></li>
 </ul>
 <p>You are done and can now skip the rest to go to the “<a href="#creating-new-identities">Creating your anonymous online identities</a>” part.</p>
 <h1 id="creating-your-anonymous-online-identities">Creating your anonymous online identities:</h1>
@@ -4157,7 +4182,7 @@
 </ul></li>
 <li><p>Identities that are “EU residents” with an “EU IP” (VPN/Tor Exit IP) will benefit from GDPR protections on many platforms. Others will not. GDPR is your friend in most cases, and you should take this into account.</p></li>
 <li><p>Similarly, origin IP geolocation (your IP/location when you go to “whatsmyipaddress.com”) should match your identity location as much as possible (When using a VPN over Tor, you can pick this in the VPN client if you use the VPN over Tor approach or just create a new identity in Tor Browser or Brave Tor Tab until you get an appropriate Exit node, or configure Tor to restrict your Exit Nodes). Consider excluding any exit IP that is not located in Western Europe/US/Canada/Japan/South Korea/Australia/New Zealand as you will have fewer issues. Ideally, you should get a European Union IP to get additional GDPR protection and if possible, a German exit IP due to their legal stance on using anonymous accounts on online platforms.</p></li>
-<li><p>Brave Browser (Chromium-based) with a Private Tor Tab has (IMHO) a better acceptance level than Tor Browser (Firefox based). You will experience fewer issues with captchas and online platforms<a href="#fn405" class="footnote-ref" id="fnref405" role="doc-noteref"><sup>405</sup></a> if you use Brave than if you use Tor Browser (feel free to try this yourself).</p></li>
+<li><p>Brave Browser (Chromium-based) with a Private Tor Tab has a better acceptance level than Tor Browser (Firefox based). You will experience fewer issues with captchas and online platforms<a href="#fn405" class="footnote-ref" id="fnref405" role="doc-noteref"><sup>405</sup></a> if you use Brave than if you use Tor Browser (feel free to try this yourself).</p></li>
 <li><p>For every identity, you should have a matching profile picture associated with it. For this purpose, we recommend you just go to <a href="https://thispersondoesnotexist.com/" class="uri">https://thispersondoesnotexist.com/</a> <sup><a href="https://web.archive.org/web/https://thispersondoesnotexist.com/">[Archive.org]</a></sup> and generate a computer-generated profile picture (Do note that algorithms have been developed<a href="#fn406" class="footnote-ref" id="fnref406" role="doc-noteref"><sup>406</sup></a>’<a href="#fn407" class="footnote-ref" id="fnref407" role="doc-noteref"><sup>407</sup></a> to detect these and it might not work 100% of the time). You can also generate such pictures yourself from your computer if you prefer by using the open-source StyleGan project here <a href="https://github.com/NVlabs/stylegan2" class="uri">https://github.com/NVlabs/stylegan2</a> <sup><a href="https://web.archive.org/web/https://github.com/NVlabs/stylegan2">[Archive.org]</a></sup>. Just refresh the page until you find a picture that matches your identity in all aspects (age, sex, and ethnicity) and save that picture. It would be even better to have several pictures associated with that identity, butWedo not have an “easy way” of doing that yet.</p>
 <ul>
 <li><p><strong>Bonus</strong>, you could also make it more real by using this service (with an anonymous identity) <a href="https://www.myheritage.com/deep-nostalgia" class="uri">https://www.myheritage.com/deep-nostalgia</a> <sup><a href="https://web.archive.org/web/https://www.myheritage.com/deep-nostalgia">[Archive.org]</a></sup> to make a picture more lifelike. Here is an example:</p>
@@ -7602,7 +7627,7 @@ PDF-Redact Tools (L)
 </ul></li>
 <li><p>Using any other platform (even Twitter DMs) but again using GPG to encrypt the message for the recipient.</p></li>
 </ul>
-<p>What you should avoid IMHO:</p>
+<p>What you should avoid:</p>
 <ul>
 <li><p>Do not send physical materials using the post due to the risk of leaving DNA/Fingerprints or other traceable information (see <a href="#cashmonero-paid-vpn">Cash-Paid VPN (preferred)</a>).</p></li>
 <li><p>Do not use methods linked to a phone number (even a burner one) such as Signal/WhatsApp/Telegram.</p></li>
@@ -7815,7 +7840,7 @@ PDF-Redact Tools (L)
 <li><p>ATA/NVMe Secure Erase: This method will remove the mapping table that keeps track of allocated data on the storage Blocks but does not destroy the actual data.</p></li>
 <li><p>ATA/NVMe Sanitize Crypto Scramble (aka Instant Secure Erase, Crypto Erase), which applies to self-encrypting SSD drives: This method will change the encryption key of the self-encrypting SSD drive and render all the data stored in it unreadable.</p></li>
 <li><p>ATA/NVMe Sanitize Block Erase: This method performs an actual block erase on every storage block and will destroy the data and change the encryption key if present.</p></li>
-<li><p>ATA/NVMe Sanitize Overwrite <strong>(terribly slow, could be dangerous and not recommended)</strong>: This method performs a block erase and then overwrite every storage block (it is the same as Block Erase but will overwrite data in addition). This method is overkill and not necessary IMHO.</p></li>
+<li><p>ATA/NVMe Sanitize Overwrite <strong>(terribly slow, could be dangerous and not recommended)</strong>: This method performs a block erase and then overwrite every storage block (it is the same as Block Erase but will overwrite data in addition). This method is overkill and not necessary.</p></li>
 </ul></li>
 <li><p>Physical Destruction:</p>
 <ul>
@@ -8195,7 +8220,7 @@ PDF-Redact Tools (L)
 <li><p>To remove all metadata: <code>exiftool -All= filename.odt</code></p></li>
 </ul>
 <h4 id="all-in-one-tool">All-in-one Tool:</h4>
-<p>Another option good tool IMHO to remove metadata from various documents is the open-source mat2 recommended by privacyguides.org<a href="#fn461" class="footnote-ref" id="fnref461" role="doc-noteref"><sup>461</sup></a> (<a href="https://0xacab.org/jvoisin/mat2" class="uri">https://0xacab.org/jvoisin/mat2</a> <sup><a href="https://web.archive.org/web/https://0xacab.org/jvoisin/mat2">[Archive.org]</a></sup>) which you can use on Linux quite easily. We never managed to make it work properly within Windows due to various dependencies issues despite the provided instructions. It is however very straightforward to install and use on Linux.</p>
+<p>Another option good tool to remove metadata from various documents is the open-source mat2 recommended by privacyguides.org<a href="#fn461" class="footnote-ref" id="fnref461" role="doc-noteref"><sup>461</sup></a> (<a href="https://0xacab.org/jvoisin/mat2" class="uri">https://0xacab.org/jvoisin/mat2</a> <sup><a href="https://web.archive.org/web/https://0xacab.org/jvoisin/mat2">[Archive.org]</a></sup>) which you can use on Linux quite easily. I never managed to make it work properly within Windows due to various dependencies issues despite the provided instructions. It is however very straightforward to install and use on Linux.</p>
 <p>So, we would suggest creating a small Debian VM within Virtualbox (behind your Whonix Gateway) which you can then use from your other VMs to analyze various files from a convenient web interface. For this see <a href="#appendix-l-creating-a-mat2-web-guest-vm-for-removing-metadata-from-files">Appendix L: Creating a mat2-web guest VM for removing metadata from files</a></p>
 <p><img src="data:image/jpeg;base64,/9j/2wBDAAcFBQYFBAcGBQYIBwcIChELCgkJChUPEAwRGBUaGRgVGBcbHichGx0lHRcYIi4iJSgpKywrGiAvMy8qMicqKyr/2wBDAQcICAoJChQLCxQqHBgcKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKir/wAARCAIjBEYDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD6IoooqyQooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACsXxB4ns/D11pdtcq0k+p3Qt4Y0PIGCWc+wA/UVtV8u+O/G7+IfjNZT2U5+xabeR21sUbhhvAdv+BEn6jFXBJy1E720PqEEMAQcg9DS1l6BcmfTtjHLRMV59O3+H4VqUTi4ScWKMuaKYUUUVBQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRWdr+t2nhzQbvVtRfZb2sZdvVvRR7k4A9zTA85+NvxGm8LabFouiziPU71C0sgAJhh5GR6Mx6Htg+1fNdjJ5WpWsn9yeNvyYVd8Sa/eeJ/EV5q+otme6kLFQeEHRVHsBgfhWWG2MGH8JBrSOhVtD7G8PXqW99JHK4VJehJ754/rXTpcwySGOOVGcDJVWBIrzmyuY7yygurdw8c0ayIw7gjIrR068azvo5skjOGHqK9Cth1UbmnqebSrOC5Wd1RSKwdQynIIyCO9LXlnoBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKpaxqtroejXWp6jJ5dtaxGSRvYdh7noB6mmBT8TeKtL8J6Lc6lq1wqRwKD5akF3Y/dVR6nH6E9Aa8g1ex1Xx74Kvr7VC0WoajtubW2DHbAiZMUX4gkk9y2e1eXXGvw+LviQNW8VT+TZ3NyHlHJWOMfdT/AHcAAn0ya+gkZXjVoypRgCpXoR2x7V3YalF3bObETcLJHytJHJDK8U0bRyISro4wykdiOxq3o+k3eu6tBp2npunnbAJ6IO7H2A5r2H4p+FbW/wDD9xrNvbhdQswHeRODJGDhg3rgcg9eK434PKW8bysCcLZSZ9/mUVLpctRRZqq3NTc0ex6JpUWh6Jaabbu8kdtGIw7nlvU/mTx2q9RRXppWVjym7u7Or8Pags1qLaRwJI+FBPUVtV54rFGDKSCOhFdBpniIjbFf8joJB2+tefXwzu5QO2jXVuWR0dFNR1kQPGwZWGQQetOrgOwKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUANkkSGJpJXVEQFmZjgKB1JNfOXxr+KFl4khi0Dw5cmaxjk33U6ghZnH3VX1UcnPQnHpXt3jfXZfDvhea/isUvVDrHJHIflCtxk+o6DHvXK+Drnwd45sJLW88N6TBexEs1uLVMFf7ynGfr6fjXRGjN0/apaGXtoKp7NvU+V2BKkDrivpzw5fWuo+G7C5sJBJA0CKpHYqoBBHYgjGK5HxLY/DKLV5rMeGdRtXicpJJbzmM5HojEjH5V2HhPUPBem+GdSTwhply0lrA15Lb3UjgvtABO7JA47DrjpXZSp1qXvOLsznrVaVXRS1RdngS6t5LeZQ0cqmNwe4Iwf5186eGNcm8G+LftBVnjid7e5iHV03YOPcEAj6V9QeENZ0Pxlp8s0Nk1vPAQJoWlJ25HBBB5HX8q5248OfCrxfqEt9ctbpcKdku+6a3L4OATyN31FKs5OWkXeIUOVLVq0jJ0v4ieGNV2rFqaW8h/5Z3SmI/meP1rpUdZEDowZWGQynII+tJqHwh+G+naTNdXuk+TbRLveb7VMSB/31zWx4N03wlFpSWXhu6S8gtwSqNOXaNSc4weQOeMiiGJly80o6CnQje0XqZe1iMgHH0pK6DQvEvhvX7uey0sxPNBndG0OMgHG4ccisfWfH/hLR9cOnTweaycSzW8Sssbf3TyCT64zito1ZylycjuZOnBR5uZWLGl6rLYTgEloSfmTP8q7KORZY1kQ5VgCD6ivN7j4ieEZNQhs7Cyu9QeYqqNAhUFicBcMQc/hXo8UaxQpGg2qqhQM9AK5MVG1pOLTfc6MO90ndD6KKK4TrCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigBdrf3T+VG1v7p/KrFFK47Ffa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLFfa390/lRtb+6fyqxRRcLGH4mtIbvwrqcN4p8lrWQucdMKTn8MZr5hsb+50vUIrywmaG4hbcjqeQf89q+lviFd/Yvh9rEucbrcxf99kL/wCzV89+GdNsrq7mvNZdk02xQTXAQZeXkBY192JAzxgZNfQZW7UZyltc8bH61YpbndeLdN1Dx14V0TXrLSXOoyK6TpEeWQNgMFPJGcnjoG/GmQNY/DvwYtjr2nC61LV33XNmZNrLACQMsOnqPcn0qPSV1Lx74i/4SOaeLSdH0MoUVckQxp821QOpwOT9OOgrm9fmn8ffEO5fRIJJTdyBYEY4O1VAyc9BgZ9q2pwb/dSdox1fl1Sv+PyMpyS/eRWr0Xn3dv63On8R3mmeGvAkaeDrOQ2uuA+bqEjbmUA8xZ7EcjHpnqcmvMrcxi4j+0bvK3Dfsxu255xnvXsHhC10M+Gr3w3YPF4Line truncated
 <p>Mat2 is also pre-installed on the Whonix Workstation VM<a href="#fn462" class="footnote-ref" id="fnref462" role="doc-noteref"><sup>462</sup></a> and available on Tails by default<a href="#fn463" class="footnote-ref" id="fnref463" role="doc-noteref"><sup>463</sup></a>.</p>
@@ -8799,7 +8824,7 @@ PDF-Redact Tools (L)
 <li><p>Click “Install Now”</p></li>
 <li><p>(Only for VirtualBox VM Install) Push Shift and F10 at the same time</p></li>
 <li><p>(Only for VirtualBox VM Install) Launch “regedit” in the command prompt</p></li>
-<li><p>(Only for VirtualBox VM Install) When the Registry Editor opens, navigate to “HKEY_LOCAL_MACHINE”, right-click on the “Setup” key and select “New =&gt; Key”. When prompted to name the key, enter “LabConfig” and press enter.</p></li>
+<li><p>(Only for VirtualBox VM Install) When the Registry Editor opens, navigate to <code>HKEY_LOCAL_MACHINE\SYSTEM\Setup</code>, right-click on the “Setup” key and select “New =&gt; Key”. When prompted to name the key, enter “LabConfig” and press enter.</p></li>
 <li><p>(Only for VirtualBox VM Install) Now right-click on the “LabConfig” key and select “New =&gt; DWORD (32-bit)” value and create a value named “BypassTPMCheck”, and set its data to “1”. With the same steps create the “BypassRAMCheck” and “BypassSecureBootCheck”</p></li>
 <li><p>Select “I don’t have a product key”</p></li>
 <li><p>Accept the agreement</p></li>
@@ -9267,7 +9292,7 @@ PDF-Redact Tools (L)
 <p><strong>You should never rely on some external commercial service to protect your anonymity.</strong></p>
 <h1 id="appendix-o-getting-an-anonymous-vpnproxy">Appendix O: Getting an anonymous VPN/Proxy</h1>
 <p>If you follow my advice, you will also need a VPN subscription but this time you will need an anonymous one that cannot be tied to you by the financial system. Meaning you will need to buy a VPN subscription with cash or a reasonably private cryptocurrency (Monero). You will later use this VPN to connect to the various services anonymously but never directly from your IP.</p>
-<p>There are, IMHO, two viable options:</p>
+<p>There are, two viable options:</p>
 <h2 id="cashmonero-paid-vpn">Cash/Monero-Paid VPN:</h2>
 <p>There are three VPN companies recommended by PrivacyGuides.org (<a href="https://www.privacyguides.org/vpn/" class="uri">https://www.privacyguides.org/vpn/</a> <sup><a href="https://web.archive.org/web/https://www.privacyguides.org/vpn/">[Archive.org]</a></sup>) that accept cash payments: Mullvad, iVPN, and Proton VPN.</p>
 <p>In addition, we will also mention a newcomer to watch: Safing SPN <a href="https://safing.io/" class="uri">https://safing.io/</a> <sup><a href="https://web.archive.org/web/https://safing.io/">[Archive.org]</a></sup>) which (while still in the alpha stage at the time of this writing) which also accepts cash and has a very distinct new concept for a VPN which provides benefits similar to Tor Stream isolation with their “SPN”). Note that Safing SPN is not available on macOS at the moment. This possibility is “provisional” and at your own risk, but we think was worth mentioning.</p>
@@ -9412,7 +9437,7 @@ PDF-Redact Tools (L)
 </ul></li>
 </ul>
 <p><strong>Important note: Tor does not support UDP, and you should use TCP instead with the VPN client in the Tor over VPN cases (on the VMs).</strong></p>
-<p>In all cases, you should set the VPN to start from boot and enable the “kill switch” if you can. This is an extra step since this guide proposes solutions that all fall back on the Tor network in case of VPN failure. Still recommended IMHO.</p>
+<p>In all cases, you should set the VPN to start from boot and enable the “kill switch” if you can. This is an extra step since this guide proposes solutions that all fall back on the Tor network in case of VPN failure.</p>
 <p>Here are some guides provided by the recommended VPN providers in this guide:</p>
 <ul>
 <li><p>Windows:</p>
@@ -9667,7 +9692,7 @@ PDF-Redact Tools (L)
 <p><strong>Do not use a live system on a Software supervised/monitored device on a known network.</strong></p>
 <p><strong>Refer to the Tails route to achieve this. See <a href="#the-tor-browser-route">The Tails route</a> and <a href="#appendix-p-accessing-the-internet-as-safely-as-possible-when-tor-and-vpns-are-not-an-option">Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option</a> sections.</strong></p>
 <h1 id="appendix-v-what-browser-to-use-in-your-guest-vmdisposable-vm">Appendix V: What browser to use in your Guest VM/Disposable VM</h1>
-<p>There are IMHO 6 possibilities of browser to use on your guest/disposable VM:</p>
+<p>There are 6 possibilities of browser to use on your guest/disposable VM:</p>
 <ul>
 <li><p>Brave (Chromium-based)</p></li>
 <li><p>Edge (Chromium-based, Windows Only)</p></li>
@@ -9878,7 +9903,7 @@ PDF-Redact Tools (L)
 <li>You will experience more captchas (this is based on my tests).</li>
 </ul>
 <h2 id="tor-browser">Tor Browser:</h2>
-<p>If you are extra paranoid and want to use Tor Browser and have “Tor over VPN over Tor”, you could go with Tor Browser within the VM as well. This is IMHO completely pointless/useless.</p>
+<p>If you are extra paranoid and want to use Tor Browser and have “Tor over VPN over Tor”, you could go with Tor Browser within the VM as well. This is completely pointless/useless.</p>
 <p>We would not recommend this option. It is just silly.</p>
 <h1 id="appendix-v1-hardening-your-browsers">Appendix V1: Hardening your Browsers:</h1>
 <h2 id="brave-1">Brave:</h2>
@@ -10362,7 +10387,7 @@ PDF-Redact Tools (L)
 <p>But what if the service you want does not accept Monero but does accept a more mainstream cryptocurrency such as Bitcoin (BTC) or Ethereum (ETH).</p>
 <p><strong>Bitcoin and other “mainstream cryptocurrencies” are not anonymous at all (Remember <a href="#your-cryptocurrencies-transactions">Your Cryptocurrencies transactions</a>) and you should never ever purchase, for example, Bitcoin from an exchange and then use these directly for purchasing services anonymously. This will not work, and the transaction can be traced easily.</strong></p>
 <ul>
-<li><p><strong>Stay away from Crypto Mixers and Tumblers.</strong> You might think this is a good idea but not only are they IMHO useless with cryptocurrencies such as BTC/ETH/LTC, but they are also dangerous as you might end up trading your currency for dirty currency from illicit activities. Use Monero to anonymize your crypto. Use a normal KYC-enabled Exchange to buy/sell your Monero (such as Kraken) or (at your own risk), use a service like LocalMonero.</p></li>
+<li><p><strong>Stay away from Crypto Mixers and Tumblers.</strong> You might think this is a good idea but not only are they useless with cryptocurrencies such as BTC/ETH/LTC, but they are also dangerous as you might end up trading your currency for dirty currency from illicit activities. Use Monero to anonymize your crypto. Use a normal KYC-enabled Exchange to buy/sell your Monero (such as Kraken) or (at your own risk), use a service like LocalMonero.</p></li>
 <li><p><strong>Stay away from what are in my opinion risky private/anonymizing wallets such as <a href="https://we.incognito.org" class="uri">https://we.incognito.org</a>.</strong> Use a safer method outlined below.</p></li>
 </ul>
 <h2 id="reasonably-anonymous-option">Reasonably anonymous option:</h2>
@@ -10699,7 +10724,7 @@ PDF-Redact Tools (L)
 <p>You may want to watch this insightful video for more details: <a href="https://www.youtube.com/watch?v=j02QoI4ZlnU"><strong>https://www.youtube.com/watch?v=j02QoI4ZlnU</strong></a> <sup><a href="https://yewtu.be/watch?v=j02QoI4ZlnU">[Invidious]</a></sup></p>
 <p>Also please consider reading: <strong><a href="https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md#privacy-limitations" class="uri">https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md#privacy-limitations</a></strong> <sup><a href="https://web.archive.org/web/https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md#privacy-limitations">[Archive.org]</a></sup></p>
 <p><strong>If you feel extra paranoid and want the highest safety level possible,</strong> see the <a href="#extra-paranoid-anonymous-option">Extra-Paranoid anonymous option</a>.</p>
-<p><strong>Use these at your own risk, sending cash payments to providers accepting cash (through the postal service) is always a better solution if/when possible, IMHO.</strong></p>
+<p><strong>Use these at your own risk, sending cash payments to providers accepting cash (through the postal service) is always a better solution if/when possible.</strong></p>
 <h1 id="appendix-b3-threat-modeling-resources">Appendix B3: Threat modeling resources</h1>
 <p>Here are various threat modeling resources if you want to go deeper in threat modeling.</p>
 <ul>