Having the proper mindset when starting a process like this, is critical for success. You must be both willing and determined.
Here is a general thought process...
* Always always always know what you are doing. You don't want to compromise yourself because you _thought_ you knew what you were doing. Make sure 100%. Do research **before**.
* Have a strong mind. Most flaws are user error, meaning YOU. Having a strong mind is critical. You must be in a clear state of mind, and almost be "talking to yourself" mentally. Ask yourself before you do something "is this right". A good memory is CRITICAL. You are going to need to remember almost **EVERYTHING** you do on the internet if you want to do this _"properly"._ Don't be compromised because you forgot something. Let's eliminate user error. More on this subject will be later in this _guide._
* Take over-procedures. Don't "skimp" out on encryption because you don't feel like entering in a password. Don't be lazy.
* Do not compromise your security for a friend. If they are your friend, they will respect your new-founded love for being secure.
* Do not reveal more than you need to. MMJ doesn't need to know what you had for lunch.
(things to keep in mind)* Reveal as little about yourself and origin as possible.
* Remember - you can be identified by more ways than you can imagine.
Threat modeling can become an advanced topic, you will need to learn how to balance security, privacy and anonymity. You'll need to properly layout and identify what you are protecting yourself from. Everyone has something to protect, whether it is passwords, location, internet activity, confidential documents, etc. The items you are trying to protect will be referred here as "assets".
Ask yourself these basic questions:
- What am I trying to protect?
- Who am I trying to protect this from?
- What happens if I fail to protect this?
These are some basic questions to ask yourself when creating your threat model. Based upon your answers to these questions, will determine the route you must go. Example - You don't want your neighbor Joe to see you sleeping, so you close your blinds.
Developing a threat model will require a lot of time and effort. You will need to think of every possibility for your "assets". Using your resources. you will need to start documenting various tools and services will be a benefit to you, such as ProtonMail, TOR, Matrix, etc. The tools and services will all depend on your threat model.
Examples:
- If you are trying to hide internet activity, then you would likely use a proxy, TOR, or a VPN.
- If you want to encrypt your emails, you would likely use a secure email provider and PGP.
- If you want to encrypt your communications, you would likely use an encrypted messenger.
Listed below are some useful resources for getting started.
Along your journey, you'll need to have the proper resources at hand to deal with any sort of situation you will be facing. Get yourself accustomed to these resources to better understand various conceptions and prepare yourself.
Simply put, cleaning up is the process of deleting your various traces on the internet. For the average person, this will be a long and arduous process. You'll have to go through every single online account, email, activity, forum, message, game, etc. and literally delete *everything*. This may seem extremely tedious - but remember, your adversary can easily find these data points and exploit them.
How to do this efficiently? Well... there is no "efficient" method, you just have to brute force this all of your data points have somewhat been eliminated.
You can first start by going to various apps that you are already signed into, start to delete all of your activities, message, posts and friends. You'll have to do this for all of your "currently-known" services. After you've done this, make sure everything is deleted including your PfP, and change your username, anonymize as much data as possible such as changing username, email and other s. After you've done this, you are now ready to delete this account.
As for finding services you may have forgotten, look through your entire email and find services you may have signed up for and start to do the same process. Try to search up your commonly-used usernames to help you with this process. Do this for every single account, just to ensure there is not anything that you may have missed.
There are some services which exist that can help expedite this process, though be aware of the risks involved in doing this.
Choosing our operating system is one of the most important pieces for this setup. This guide will be focused around [QubesOS](https://qubes-os.org), but any type of linux/unix OS should be suitable as long as it is properly configured & hardened for our needs.
For our setup with Qubes, we are going to be heavily utilizing virtualization. Ensure your PC has enough RAM. Make sure you verify the ISO and such. During installation, ensure to encrypt the disk along with a secure password as an insecure one could easily comprise the entire system. Ensure that Whonix will be installed along with updates over TOR. After installation, ensure everything is updated. Let's startup by creating some basic VMs. To start, clone ``vault`` and create ``pgp-keys`` and ``ssh-keys`` to store our keys securely. Both should have __no internet access__. We will need to properly setup [split-pgp](https://qubes-os.org/doc/split-gpg) and split-ssh.
As for networking, if you have a VPN service such as ProtonVPN, you are able to utilize ``qtunnel`` and setup multiple VPNs. For each of our VPN VMs, we will need a ``sys-firewall``. If you wanted a dedicated ``sys-dns``, you would be able to do this as well. Make sure to read the proper documentation on how to achieve this.
For setting our foundation, we are going to be creating a variety of aliases and each of these aliases are going to each need an "arsenal". For step 1 we are going to need a password manager.
Upon creating our aliases we will have several different approaches:
1. Each username, email, and other will be completely random
2. Each alias will have its own email, username, etc.