--- layout: default1 description: Just... a guide title: Another Guide ---

“You never appreciate your anonymity until you don't have it anymore"



The Guide --------- *Note: Work in progress*
Well... I never thought i'd be making a guide so, here we go.... I guess.... Let's define a few important things here: `Adversary: Your threat.` `Privacy: The act of your personal activities being hidden from public.` `Security: The act of protecting yourself and online content such as files from either known and / or unknown adversary.` `Anonymity: The act of hiding yourself to become indistinguishable from everyone else. (blending in)` ### Getting Started _Disclaimer: This is for education / research._ ##### Table of contents: \>> [Important Concepts](#important-concepts)
\>> [Proper Mindset](#proper-mindset)
\>> [Knowing Your Adversary](#knowing-your-adversary)
\>> [Setting Goals](#setting-goals)
\>> [Creating Your Threat model](#creating-your-threat-model)
\>> [Knowing Resources](#knowing-resources)
\>> [Getting Ready to "clean up"](#getting-ready-to-"clean-up")
\>> [Setting Your Foundation](#setting-your-foundation)
\>> [QubesOS](#qubesos)
\>> [GrapheneOS](#grapheneos)
\>> [Creating our Aliases](#creating-our-aliases)
\>> [Hardening](#hardening)
#### __Important Concepts__ This guide requires you to understand various important concepts in order to truly be anonymous - The following below is to be ASSUMED. * Understanding of TOR and its threats * Understanding benefits and negatives of a VPN * Understanding important privacy concepts * Understanding important security concepts * [Understanding the principles of thread modeling](https://invidious.esmailelbob.xyz/watch?v=DHZRhboZhfI) * Understanding how the internet functions General Ideas: - Using a VPN will *NOT* make you anonymous - Just because you are using TOR does *NOT* mean you are safe - An adversary with enough time and resources will eventually find you - The best way to hide is to not use the internet - The land of compromises
#### __Proper Mindset__ Having the proper mindset when starting a process like this, is critical for success. You must be both willing and determined. Here is a general thought process... * Always always always know what you are doing. You don't want to compromise yourself because you _thought_ you knew what you were doing. Make sure 100%. Do research **before**. * Have a strong mind. Most flaws are user error, meaning YOU. Having a strong mind is critical. You must be in a clear state of mind, and almost be "talking to yourself" mentally. Ask yourself before you do something "is this right". A good memory is CRITICAL. You are going to need to remember almost **EVERYTHING** you do on the internet if you want to do this _"properly"._ Don't be compromised because you forgot something. Let's eliminate user error. More on this subject will be later in this _guide._ * Take over-procedures. Don't "skimp" out on encryption because you don't feel like entering in a password. Don't be lazy. * Do not compromise your security for a friend. If they are your friend, they will respect your new-founded love for being secure. * Do not reveal more than you need to. MMJ doesn't need to know what you had for lunch. (things to keep in mind)* Reveal as little about yourself and origin as possible. * Remember - you can be identified by more ways than you can imagine. * Do not trust anyone. * Your life will change drastically. * Do not be lazy
#### __Setting Goals__ We need to understand what we are trying to accomplish. Think - what are you trying to do? You need to properly identify a *threat model*, an *adversary* along with performing a self-analysis. You need to understand your own flaws.
#### __Creating your threat model__ The most important part of your setup. Threat modeling can become an advanced topic, you will need to learn how to balance security, privacy and anonymity. You'll need to properly layout and identify what you are protecting yourself from. Everyone has something to protect, whether it is passwords, location, internet activity, confidential documents, etc. The items you are trying to protect will be referred here as "assets". Ask yourself these basic questions: - What am I trying to protect? - Who am I trying to protect this from? - What happens if I fail to protect this? These are some basic questions to ask yourself when creating your threat model. Based upon your answers to these questions, will determine the route you must go. Example - You don't want your neighbor Joe to see you sleeping, so you close your blinds. Developing a threat model will require a lot of time and effort. You will need to think of every possibility for your "assets". Using your resources. you will need to start documenting various tools and services will be a benefit to you, such as ProtonMail, TOR, Matrix, etc. The tools and services will all depend on your threat model. Examples: - If you are trying to hide internet activity, then you would likely use a proxy, TOR, or a VPN. - If you want to encrypt your emails, you would likely use a secure email provider and PGP. - If you want to encrypt your communications, you would likely use an encrypted messenger. Listed below are some useful resources for getting started. - [Techlore Threat Modeling](https://tube.cthd.icu/watch?v=DHZRhboZhfI) - [EFF Threat Modeling](https://ssd.eff.org/en/module/your-security-plan)
#### __Knowing Resources__ Along your journey, you'll need to have the proper resources at hand to deal with any sort of situation you will be facing. Get yourself accustomed to these resources to better understand various conceptions and prepare yourself. ##### Common Tools: - [PrivacyGuides](https://privacyguides.org) - [PrivacyTools](https://privacytools.io) - [PRISM Break](https://prism-break.org/) - [Techlore - YouTube](https://invidious-us.kavin.rocks/channel/UCs6KfncB4OV6Vug4o_bzijg) - [The Hated One - YouTube](https://invidio.xamh.de/channel/UCjr2bPAyPV7t35MvcgT3W8Q) ##### More: - [Tor Project](https://torproject.org) - [EFF](https://eff.org)
#### __Getting Ready to "clean up"__ What is _"cleaning up"?_ Simply put, cleaning up is the process of deleting your various traces on the internet. For the average person, this will be a long and arduous process. You'll have to go through every single online account, email, activity, forum, message, game, etc. and literally delete *everything*. This may seem extremely tedious - but remember, your adversary can easily find these data points and exploit them. How to do this efficiently? Well... there is no "efficient" method, you just have to brute force this all of your data points have somewhat been eliminated. You can first start by going to various apps that you are already signed into, start to delete all of your activities, message, posts and friends. You'll have to do this for all of your "currently-known" services. After you've done this, make sure everything is deleted including your PfP, and change your username, anonymize as much data as possible such as changing username, email and other s. After you've done this, you are now ready to delete this account. As for finding services you may have forgotten, look through your entire email and find services you may have signed up for and start to do the same process. Try to search up your commonly-used usernames to help you with this process. Do this for every single account, just to ensure there is not anything that you may have missed. There are some services which exist that can help expedite this process, though be aware of the risks involved in doing this.
### Setting Foundation The next several sections are going to go over setting and creating our "foundation". Our foundation will be the core of our setup. Everything done here will impact the level of security, privacy and anonymity that we have. This section will be long, but is important. Choosing our operating system is one of the most important pieces for this setup. This section will be focused around [QubesOS](https://qubes-os.org). #### __QubesOS__ For our setup with Qubes, we are going to be heavily utilizing virtualization. Ensure your PC has enough RAM. Make sure you verify the ISO and such. During installation, ensure to encrypt the disk along with a secure password as an insecure one could easily comprise the entire system. Ensure that Whonix will be installed along with updates over TOR. After installation, ensure everything is updated. We can utilize updates over TOR to help prevent an adversary from knowing that we are using Qubes. This can be extremely beneficial as our adversary wouldn't know a "specific" way to target us.
##### "Splitting" Let's startup by creating some basic qubes. To start, clone ``vault`` and create ``pgp-keys`` and ``ssh-keys`` to store our keys securely. Both should have __no internet access__. We will need to properly setup [split-pgp](https://qubes-os.org/doc/split-gpg) and [split-ssh](https://kushaldas/in/posts/using-split-ssh-in-qubesos-4-0.html). Using the "split" method, we are able to create an additional [split-browser](https://github.com/rustybird/qubes-split-browser) and a [split-dm-crypt](https://github.com/rustybird/qubes-split-dm-crypt). More thoughts: - Split-Browser - Split-Print
##### Qube Basic Setup As for networking, if you have a VPN service such as ProtonVPN, you are able to utilize ``qtunnel`` and setup multiple VPNs. For each of our VPN qubes, we will need a ``sys-firewall``. If you wanted a dedicated ``sys-dns``, there are several guides on this: - [qubes-dns](https://github.com/3hhh/qubes-dns) - [Pihole qube](https://github.com/92VV3M42d3v8/PiHole) ``sys-net`` -> ``sys-firewall`` -> ``sys-vpn`` -> ``sys-firewall-vpn`` We will now create additional qubes for our use. - ``sys-net`` -> ``sys-firewall`` -> ``sys-firewall-email-personal`` -> ``personal-email`` - By placing the firewall here, this allows us to only whitelist internet traffic from specifically our email provider. - ``sys-net`` -> ``sys-firewall`` -> ``sys-firewall-IN-vpn-us-1`` -> ``sys-vpn-us-1`` -> ``sys-firewall-vpn-us-1`` - This again gives us the ability to whitelist traffic from only the ``sys-vpn-us-1``. More: - ``personal-web`` - Web Traffic - ``personal-email`` - Email - ``personal-dvm`` - Disposable - ``personal-random`` - Random Web - ``personal-social`` - Social Activity - ``sys-personal-vpn`` - VPN for only ``personal`` - ``sys-firewall-personal`` - Firewall for only ``personal`` - ``personal-vault`` - Vault VM for only ``personal`` This can be used for a wide variety of activities, not just specifically "personal". Your setup should take heavy use of the ``sys-firewall`` VM. We can utilize the firewall to help maintain compartmentalization among our system. The firewall can be useful for preventing data leaks & sniffing along with enforcing VPN policies.
##### Template Setup You should not install all of your applications on a single template qube, instead you should have different templates for each purpose. This is done as a security measure along with helping us with proper compartmentalization. It's best to use minimal templates as most applications will likely not get used, but if you need more applications you can simply install them in a new template. Ensure to read the [official documentation](https://qubes-os.org/doc/templates/minimal) for minimal templates. The official minimal templates are avaliable: - Fedora - Debian - CentOS - Gentoo For installing templates: dom0: ``` sudo qubes-dom0-update qubes-template---minimal ``` Suggested packages to install on the minimal template: ``` qubes-core-agent-paswordless-root qubes-core-agent-dom0-updates qubes-usb-proxy qubes-gpg-split ```
##### Additional Setup You are never truly done configuring and setting up Qubes. There will always be more and more to configure. This section goes through some of these additional configurations.
###### U2F-Proxy Like the variety of tools offered by QubesOS, [u2f-proxy](https://qubes-os.org/doc/u2f-proxy) is no exception. This is an amazing tool that we will use for multi-factor authentication. This allows you to "compartmentalize the browser in one qube and the USB stack in another so that they are always kept separate from each other". The Qubes documentation shows the following for installation: dom0: ``` sudo qubes-dom0-update qubes-u2f-dom0 ``` Now, execute this command for all the Qubes you will utilize u2f. ``` qvm-service --enable QUBE_NAME qubes-u2f-proxy ``` To install on our templates, use the following: Fedora: ``` sudo dnf install qubes-u2f ``` Debian: ``` sudo apt install qubes-u2f ``` Finally, you must restart your Qubes. It's suggested you read the [u2f-proxy](https://qubes-os.org/doc/u2f-proxy) documentation.
###### YubiKey Using a YubiKey can help mitigate certain attacks such as password "snooping", along with increasing security. Read the [official documentation](https://qubes-os.org/doc/yubikey). Installation for template qubes: Fedora: ``` sudo dnf install ykpers yubikey-personalization-gui ``` Debian: ``` sudo apt-get install yubikey-personalization yubikey-personalization-gui ``` The GUI on for Debian can be run via the ``yubikey-personalization-gui`` command. - Choose ``configuration slot2``. - Select ``HMAC-SHA1 mode: fixed 64 bit input``. - Ensure to backup the ``Secret Key (20 bytes hex)``. Now the following is required for dom0: ``` sudo qubes-dom0-update qubes-yubikey-dom0 ``` If we had changed the name of ``sys-usb`` or are using something other than that, we would need to edit ``/etc/qubes/yk-keys/yk-vm'' in dom0. - Paste the ``Secret Key (20 bytes hex)`` into ``/etc/qubes/yk-keys/yk-secret-key.hex`` in dom0. - Paste your hashed password into ``/etc/qubes/yk-keys/yk-login-pass-hashed.hex`` in dom0. To get your hashed password: ``` read -r password ``` ``` echo -n "$password" | openssl dgst -sha1 ``` Edit ``/etc/pam.d/login`` in dom0 and add: ``` auth include yubikey ``` Now, edit ``/etc/pam.d/xscreensaver`` to include: ``` auth include yubikey ```
###### GUI-VM This is for advanced users. Read the [official documentation](https://qubes-os.org/guivm-configuration).
###### Backups Creating proper backups securely is critical for any setup, especially this one here. You must understand the different backup techniques and solutions avaliable. For high security, it is recommended that we backup the system locally, meaning that we do not store our backups on the cloud. We should start to look at possible backup solutions. The built-in ``qvm-backup`` will work amazing for this. It provides security & authentication, which are both crucial to a proper backup solution. Ensure to read the [official documentation](https://github.com/qubes-os.org/doc/how-to-back-up-restore-and-migrate). It's suggested you have a high-speed SSD or M.2 for this procedure. There are "special" options described as "rugged", which has additional layer of armor and is generally waterproof. Ensure this drive is also high-capacity. In some cases, it may make sense to have an additional drive incase of failure or other malfunction. Going into redundancy, you also have the ability to setup a local RAID on your network. This would provide increased redundancy, though it can *potentially* decrease security, as having another system on the network, proper hardening, etc. but is unlikely to cause any harm. You could setup a local nextcloud instance or another type of local network storage and utilize [wyng](https://github.com/tasket/wyng-backup).
#### __GrapheneOS__ [GrapheneOS](https://grapheneos.com) is an amazing mobile operating system. This OS has been developed to provide security along with privacy. The only limitations is that it requires an OEM unlocked Google Pixel device. These devices have been known for their security, so putting them together is an amazing pair. After installing, there is plenty of things we can start to do. We will be utilizing the built-in profiles along with the "work profile". We will need to install [F-droid](https://f-droid.org).
#### Creating our aliases For setting our foundation, we are going to be creating a variety of aliases and each of these aliases are going to each need an "arsenal". For step 1 we are going to need a password manager. Upon creating our aliases we will have several different approaches: 1. Each username, email, and other will be completely random 2. Each alias will have its own email, username, etc. If you are using QubesOS, we are able to utilize compartmentalization heavily in this instance. We will start off by creating multiple qubes for our setup. - ``alias-web`` - ``alias-email`` - ``alias-untrusted`` - ``alias-messenger`` - ``alias-tor`` - ``alias-vault`` - ``alias-wallet`` - ``sys-firewall-alias`` - ``sys-vpn-alias`` By doing this for each alias, you have now setup an amazing solution for compartmentalization. This only works if you utilize each qube for the specified task. Ensure that nothing will leave the qube. Ensure that all the ``alias`` qubes are properly routed via VPN or TOR to ensure proper setup. For a more advanced setup, you are able to utilize Whonix qubes. For each of our email addresses, we are able to setup email aliases using AnonAddy and SimpleLogin. Each of our aliases is going to need some sort of "story". We are not putting this story out to tell per say, but simply knowing basic information about our new alias would be important. Information including age, country, special food, and activities. We just need to make note of them, not giving any of this information away. It's crucial to blend in, therefore some of this information may be used in conversation. Remember, each alias we create is different, therefore there should be absolutely no connection between any of them. For each alias, you will need to "reset" your memory in a way. You must be able to organize information you know from all of your aliases. Grudges, friendships and other must not travel over, this is how you fail.
#### Hardening Now that we've setup a solid foundation, it is now time for hardening. Hardening will be simple securing our pre-existing setup. You can never be too careful. Let's make some general notes here before we begin. - Mobile phones are extremely difficult to manage properly - You must think of all possible scenarios - Do your own research Let's first start off with hardening our setup we've created above.