anonymousland/_items/Another guide.md

layout	description	title
default1	Just... a guide	Another Guide

“You never appreciate your anonymity until you don't have it anymore"

The Guide

Note: Work in progress

Well... I never thought i'd be making a guide so, here we go.... I guess....
Let's define a few important things here:

Adversary: Your threat.

Privacy: The act of your personal activities being hidden from public.

Security: The act of protecting yourself and online content such as files from either known and / or unknown adversary.

Anonymity: The act of hiding yourself to become indistinguishable from everyone else. (blending in)

Getting Started

Disclaimer: This is for education / research.

Table of contents:

>> Important Concepts
>> Proper Mindset
>> Knowing Your Adversary
>> Setting Goals
>> Creating Your Threat model
>> Knowing Resources
>> Getting Ready to "clean up"
>> Setting Your Foundation
>> QubesOS
>> GrapheneOS
>> Creating our Aliases
>> Hardening

Important Concepts

This guide requires you to understand various important concepts in order to truly be anonymous - The following below is to be ASSUMED.

• Understanding of TOR and its threats
• Understanding benefits and negatives of a VPN
• Understanding important privacy concepts
• Understanding important security concepts
• Understanding the principles of thread modeling
• Understanding how the internet functions

General Ideas:

• Using a VPN will NOT make you anonymous
• Just because you are using TOR does NOT mean you are safe
• An adversary with enough time and resources will eventually find you
• The best way to hide is to not use the internet
• The land of compromises

Proper Mindset

Having the proper mindset when starting a process like this, is critical for success. You must be both willing and determined.

Here is a general thought process...

• Always always always know what you are doing. You don't want to compromise yourself because you thought you knew what you were doing. Make sure 100%. Do research before.

• Have a strong mind. Most flaws are user error, meaning YOU. Having a strong mind is critical. You must be in a clear state of mind, and almost be "talking to yourself" mentally. Ask yourself before you do something "is this right". A good memory is CRITICAL. You are going to need to remember almost EVERYTHING you do on the internet if you want to do this "properly". Don't be compromised because you forgot something. Let's eliminate user error. More on this subject will be later in this guide.

• Take over-procedures. Don't "skimp" out on encryption because you don't feel like entering in a password. Don't be lazy.

• Do not compromise your security for a friend. If they are your friend, they will respect your new-founded love for being secure.

• Do not reveal more than you need to. MMJ doesn't need to know what you had for lunch.

(things to keep in mind)* Reveal as little about yourself and origin as possible.

• Remember - you can be identified by more ways than you can imagine.

• Do not trust anyone.

• Your life will change drastically.

• Do not be lazy

Setting Goals

We need to understand what we are trying to accomplish.

Think - what are you trying to do?

You need to properly identify a threat model, an adversary along with performing a self-analysis. You need to understand your own flaws.

Creating your threat model

The most important part of your setup.

Threat modeling can become an advanced topic, you will need to learn how to balance security, privacy and anonymity. You'll need to properly layout and identify what you are protecting yourself from. Everyone has something to protect, whether it is passwords, location, internet activity, confidential documents, etc. The items you are trying to protect will be referred here as "assets".

Ask yourself these basic questions:

• What am I trying to protect?
• Who am I trying to protect this from?
• What happens if I fail to protect this?

These are some basic questions to ask yourself when creating your threat model. Based upon your answers to these questions, will determine the route you must go. Example - You don't want your neighbor Joe to see you sleeping, so you close your blinds.

Developing a threat model will require a lot of time and effort. You will need to think of every possibility for your "assets". Using your resources. you will need to start documenting various tools and services will be a benefit to you, such as ProtonMail, TOR, Matrix, etc. The tools and services will all depend on your threat model.

Examples:

• If you are trying to hide internet activity, then you would likely use a proxy, TOR, or a VPN.

• If you want to encrypt your emails, you would likely use a secure email provider and PGP.

• If you want to encrypt your communications, you would likely use an encrypted messenger.

Listed below are some useful resources for getting started.

• Techlore Threat Modeling
• EFF Threat Modeling

Knowing Resources

Along your journey, you'll need to have the proper resources at hand to deal with any sort of situation you will be facing. Get yourself accustomed to these resources to better understand various conceptions and prepare yourself.

Common Tools:

• PrivacyGuides
• PrivacyTools
• PRISM Break
• Techlore - YouTube
• The Hated One - YouTube

More:

• Tor Project
• EFF

Getting Ready to "clean up"

What is "cleaning up"?

Simply put, cleaning up is the process of deleting your various traces on the internet. For the average person, this will be a long and arduous process. You'll have to go through every single online account, email, activity, forum, message, game, etc. and literally delete everything. This may seem extremely tedious - but remember, your adversary can easily find these data points and exploit them.

How to do this efficiently? Well... there is no "efficient" method, you just have to brute force this all of your data points have somewhat been eliminated.

You can first start by going to various apps that you are already signed into, start to delete all of your activities, message, posts and friends. You'll have to do this for all of your "currently-known" services. After you've done this, make sure everything is deleted including your PfP, and change your username, anonymize as much data as possible such as changing username, email and other s. After you've done this, you are now ready to delete this account.

As for finding services you may have forgotten, look through your entire email and find services you may have signed up for and start to do the same process. Try to search up your commonly-used usernames to help you with this process. Do this for every single account, just to ensure there is not anything that you may have missed.

There are some services which exist that can help expedite this process, though be aware of the risks involved in doing this.

Setting Foundation

The next several sections are going to go over setting and creating our "foundation". Our foundation will be the core of our setup. Everything done here will impact the level of security, privacy and anonymity that we have. This section will be long, but is important.

Choosing our operating system is one of the most important pieces for this setup. This section will be focused around QubesOS.

QubesOS

What is QubesOS? Simply put, QubesOS is a "reasonably secure operating system" and it will be the basis of our secure setup. It uses a method known as "security by compartmentalization". Simply put, most aspects of the OS are split into Qubes which can be thought of as virtual machines, meaning that if something gets compromised, the rest of the system can be safely used. Due to the way QubesOS is built, requirements will be heavy. Recommend at least 16GB of RAM with plenty of storage. The official requirements can be found here.

Why should we use QubesOS?

• It is commonly regarded as one of the most secure operating systems
• Provides amazing potential for creativity
• Still can be considered trusted even if a section is compromised
• Can heavily utilize TOR, proxies and VPNs

Things needed for setup & installation:

• GnuPG
• At least an 8GB flash drive
• Rufus, BalenaEtcher, or dd

To first start off, download the official ISO along with the digests.

To verify the ISO, run the command:
md5sum -c Qubes-RX-x86_64.iso.DIGESTS
which should output Qubes-RX-x86_64.iso: OK. If not, it can mean either the download is corrupt or compromised.

To verifiy with GPG, run the following command:
gpg2 -v --verify Qubes-RX-x86_64.iso.asc Qubes-RX-x86_64.iso

The output should read Good signature from "Qubes OS Release X Signing Key"

After verifying the integrity of the ISO, you are now able to use your desired flashing software. Ensure your flash drive is plugged in, and select it along with the ISO. Your flash drive will be erased. For Rufus users, select DD mode on format.

Installation

After booting to your installation medium click the "verify" option. Afterwords, theres a few things we need to do.

• Set a strong encryption password. This is super important! Make it strong
• Ensure root is disabled
• Set a strong user account password

After you go through this, select "Begin Installation" and wait until it asks you to reboot. Now you are ready for the final configuration. Ensure you have all the Whonix options selected. If you are using a desktop do not select the sys-usb option. This will render your mouse and keyboard useless. Use sys-usb on a laptop! For increased anonymity it is recommended to chose updates over TOR. We also want our default qubes along with the default system qubes.

"Splitting"

Let's startup by creating some basic qubes. To start, clone vault and create pgp-keys and ssh-keys to store our keys securely. Both should have no internet access. We will need to properly setup split-pgp and split-ssh. Using the "split" method, we are able to create an additional split-browser and a split-dm-crypt.

More thoughts:

• Split-Browser
• Split-Print

Template Setup

Templates are going to be the foundation of any QubesOS install. As such, it should also be carefully configured.

You should not install all of your applications on a single template qube, instead you should have different templates for each purpose. This is done as a security measure along with helping us with proper compartmentalization. It's best to use minimal templates as most applications will likely not get used, but if you need more applications you can simply install them in a new template. Ensure to read the official documentation for minimal templates.

The official minimal templates are avaliable:

• Fedora
• Debian
• CentOS
• Gentoo

For installing templates: dom0:

sudo qubes-dom0-update qubes-template-<DISTRO_NAME>-<RELEASE_NUMBER>-minimal

Suggested packages to install on the minimal template:

qubes-core-agent-paswordless-root
qubes-core-agent-dom0-updates
qubes-usb-proxy
qubes-gpg-split

Qube Basic Setup

As for networking, if you have a VPN service such as ProtonVPN, you are able to utilize qtunnel and setup multiple VPNs. For each of our VPN qubes, we will need a sys-firewall. If you wanted a dedicated sys-dns, there are several guides on this:

• qubes-dns
• Pihole qube

sys-net -> sys-firewall -> sys-vpn -> sys-firewall-vpn

We will now create additional qubes for our use.

• sys-net -> sys-firewall -> sys-firewall-email-personal -> personal-email - By placing the firewall here, this allows us to only whitelist internet traffic from specifically our email provider.

• sys-net -> sys-firewall -> sys-firewall-IN-vpn-us-1 -> sys-vpn-us-1 -> sys-firewall-vpn-us-1 - This again gives us the ability to whitelist traffic from only the sys-vpn-us-1.

More:

• personal-web - Web Traffic
• personal-email - Email
• personal-dvm - Disposable
• personal-random - Random Web
• personal-social - Social Activity
• sys-personal-vpn - VPN for only personal
• sys-firewall-personal - Firewall for only personal
• personal-vault - Vault VM for only personal

This can be used for a wide variety of activities, not just specifically "personal". Your setup should take heavy use of the sys-firewall VM. We can utilize the firewall to help maintain compartmentalization among our system. The firewall can be useful for preventing data leaks & sniffing along with enforcing VPN policies.

Additional Setup

You are never truly done configuring and setting up Qubes. There will always be more and more to configure. This section goes through some of these additional configurations.

U2F-Proxy

Like the variety of tools offered by QubesOS, u2f-proxy is no exception. This is an amazing tool that we will use for multi-factor authentication. This allows you to "compartmentalize the browser in one qube and the USB stack in another so that they are always kept separate from each other".

The Qubes documentation shows the following for installation:

dom0:

sudo qubes-dom0-update qubes-u2f-dom0

Now, execute this command for all the Qubes you will utilize u2f.

qvm-service --enable QUBE_NAME qubes-u2f-proxy

To install on our templates, use the following:

Fedora:

sudo dnf install qubes-u2f

Debian:

sudo apt install qubes-u2f

Finally, you must restart your Qubes. It's suggested you read the u2f-proxy documentation.

YubiKey

Using a YubiKey can help mitigate certain attacks such as password "snooping", along with increasing security. Read the official documentation.

Installation for template qubes:

Fedora:

sudo dnf install ykpers yubikey-personalization-gui

Debian:

sudo apt-get install yubikey-personalization yubikey-personalization-gui

The GUI on for Debian can be run via the yubikey-personalization-gui command.

• Choose configuration slot2.
• Select HMAC-SHA1 mode: fixed 64 bit input.
• Ensure to backup the Secret Key (20 bytes hex).

Now the following is required for dom0:

sudo qubes-dom0-update qubes-yubikey-dom0

If we had changed the name of sys-usb or are using something other than that, we would need to edit ``/etc/qubes/yk-keys/yk-vm'' in dom0.

• Paste the Secret Key (20 bytes hex) into /etc/qubes/yk-keys/yk-secret-key.hex in dom0.

• Paste your hashed password into /etc/qubes/yk-keys/yk-login-pass-hashed.hex in dom0.

To get your hashed password:

read -r password

echo -n "$password" | openssl dgst -sha1

Edit /etc/pam.d/login in dom0 and add:

auth include yubikey

Now, edit /etc/pam.d/xscreensaver to include:

auth include yubikey

GUI-VM

This is for advanced users. Read the official documentation.

Backups

Creating proper backups securely is critical for any setup, especially this one here. You must understand the different backup techniques and solutions available. For high security, it is recommended that we backup the system locally, meaning that we do not store our backups on the cloud. We should start to look at possible backup solutions. The built-in qvm-backup will work amazing for this. It provides security & authentication, which are both crucial to a proper backup solution. Ensure to read the official documentation.

It's suggested you have a high-speed SSD or M.2 for this procedure. There are "special" options described as "rugged", which has additional layer of armor and is generally waterproof. Ensure this drive is also high-capacity. In some cases, it may make sense to have an additional drive incase of failure or other malfunction. Going into redundancy, you also have the ability to setup a local RAID on your network. This would provide increased redundancy, though it can potentially decrease security, as having another system on the network, proper hardening, etc. but is unlikely to cause any harm. You could setup a local NextCloud instance or another type of local network storage and utilize wyng.

GrapheneOS

GrapheneOS is an amazing mobile operating system. This OS has been developed to provide security along with privacy. The only limitations is that it requires an OEM unlocked Google Pixel device. These devices have been known for their security, so putting them together is an amazing pair.

After installing, there is plenty of things we can start to do. We will be utilizing the built-in profiles along with the "work profile". We will need to install F-droid.

Creating our aliases

Note: This is a continuation of the [QubeOS setup](#qubesos).

For setting our foundation, we are going to be creating a variety of aliases and each of these aliases are going to each need an "arsenal". For step 1 we are going to need a password manager.

Upon creating our aliases we will have several different approaches:

1. Each username, email, and other will be completely random
2. Each alias will have its own email, username, etc.

If you are using QubesOS, we are able to utilize compartmentalization heavily in this instance. We will start off by creating multiple qubes for our setup.

• alias-web
• alias-email
• alias-untrusted
• alias-messenger
• alias-tor
• alias-vault
• alias-wallet
• sys-firewall-alias
• sys-vpn-alias

By doing this for each alias, you have now setup an amazing solution for compartmentalization. This only works if you utilize each qube for the specified task. Ensure that nothing will leave the qube. Ensure that all the alias qubes are properly routed via VPN or TOR to ensure proper setup. For a more advanced setup, you are able to utilize Whonix qubes. For each of our email addresses, we are able to setup email aliases using AnonAddy and SimpleLogin.

Each of our aliases is going to need some sort of "story". We are not putting this story out to tell per say, but simply knowing basic information about our new alias would be important. Information including age, country, special food, and activities. We just need to make note of them, not giving any of this information away. It's crucial to blend in, therefore some of this information may be used in conversation. Remember, each alias we create is different, therefore there should be absolutely no connection between any of them. For each alias, you will need to "reset" your memory in a way. You must be able to organize information you know from all of your aliases. Grudges, friendships and other must not travel over, this is how you fail.

Hardening

Now that we've setup a solid foundation, it is now time for hardening. Hardening will be simple securing our pre-existing setup. You can never be too careful. Let's make some general notes here before we begin.

• Mobile phones are extremely difficult to manage properly
• You must think of all possible scenarios
• Do your own research

Let's first start off with hardening our setup we've created above.