Good cryptography is not easy and usually takes years of research to develop and fine-tune.
Yet, this is not stopping some from doing it anyway and publishing various production Apps/Services using their self-made cryptography or proprietary closed-source methods:
You should apply caution when using Apps/Services using closed-source or proprietary encryption methods. All the good crypto standards are public and peer-reviewed and there should be no issue disclosing the one you use.
-You should be wary of Apps/Services using a “modified” or proprietary cryptographic method267.
-By default, you should not trust any “Roll your own crypto” until it was audited, peer-reviewed, vetted, and accepted by the cryptography community268’269.
-There is no such thing as “military-grade crypto”270‘271’272.
+You should be wary of Apps/Services using a “modified” or proprietary cryptographic method263.
+By default, you should not trust any “Roll your own crypto” until it was audited, peer-reviewed, vetted, and accepted by the cryptography community264’265.
+There is no such thing as “military-grade crypto”266‘267’268.
Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization.
In the context of this guide,we recommend sticking to Apps/Services using well-established, published, and peer-reviewed methods.
@@ -1171,58 +1157,50 @@Hashes:
-
-
Prefer: SHA3-224, SHA-384 or BLAKE2273 (these are considered very Quantum Resistant based on an instance of the KECCAK algorithm), SHAKE128 and SHAKE256 (referred to as extendable-output functions (XOFs) via FIPS 202);
--
-
Most digital signature algorithms are quantum-broken;
-Highly suspicious RBGs such as MS_DRBG still exist in standards such as ISO 18031;
-The AES and SHA2 based DRBGs in current NIST standards are fine
-
-Still relatively safe to use: SHA-2 (e.g., SHA-256 or SHA-512, which are still considered mostly quantum-safe)
-Avoid: SHA-0, SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used); i.e., anything with known collisions, and/or a history of extensive, not one-off, cryptographic failures
+Prefer: SHA-3 or BLAKE2269
+Still relatively ok to use: SHA-2 (such as the widely used SHA-256 or SHA-512)
+Avoid: SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used)
File/Disk Encryption:
Prefer:
-
-
Hardware Accelerated274: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.
+Hardware Accelerated270: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.
Non-Hardware Accelerated: Same as accelerated above or if available consider:
-
-
ChaCha20275 or XChaCha20 (You can use ChaCha20 with Kryptor https://www.kryptor.co.uk, unfortunately, it is not available with Veracrypt).
-Serpent276
-TwoFish277
+ChaCha20271 or XChaCha20 (You can use ChaCha20 with Kryptor https://www.kryptor.co.uk, unfortunately, it is not available with Veracrypt).
+Serpent272
+TwoFish273
Avoid: Pretty much anything else
Password Storage:
-
-
- Prefer: Argon2 -
- If these aren’t options, use bcrypt, then scrypt (in that order) -
Be skeptical of Argon2d, as it’s vulnerable to some forms of side-channels. Prefer Argon2i or Argon2id.
-Avoid: SHA-3, SHA-2, SHA-1, MD5; PBKDF2 due to concerns regarding brute-force [Archive.org]
+- Prefer: Argon2, scrypt +
- If these aren’t options, use bcrypt, or if not possible at least PBKDF2 (only as a last resort) +
Be skeptical of Argon2d, as it’s vulnerable to some forms of side-channels. Prefer Argon2i or Argon2id
+Avoid: SHA-3, SHA-2, SHA-1, MD5
Browser Security (HTTPS):
Prefer: TLS 1.3 (ideally TLS 1.3 with ECH/eSNI support) or at least TLS 1.2 (widely used)
-Avoid: Anything Else (TLS <=1.1, SSL <=3)
+Avoid: Anything Else (TLS =<1.1, SSL =<3)
Signing messages/files with PGP/GPG:
Prefer ECDSA (ed25519)+ECDH (ec25519) or RSA 4096 Bits*
-
-
- Consider a more modern278 alternative to PGP/GPG: Minisign https://jedisct1.github.io/minisign/ [Archive.org] +
- Consider a more modern274 alternative to PGP/GPG: Minisign https://jedisct1.github.io/minisign/ [Archive.org]
Avoid: RSA 2048 bits
SSH keys:
-
-
ED25519 (preferred) or RSA 4096 Bits*
--
-
- But refer to Attacking Deterministic Signature algorithms, which details fault injections “(varying the voltage supply) - mainly a threat to tamper-proof hardware and hardware security modules” such as Rowhammer, or templating attacks, etc. -
+ED25519 (preferred) or RSA 4096 Bits*
Avoid: RSA 2048 bits
-Warning: RSA and ED25519 are unfortunately not seen as “Quantum Resistant”279 and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.
+Warning: RSA and ED25519 are unfortunately not seen as “Quantum Resistant”275 and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.
Here are some real cases of issues bad cryptography:
-
@@ -1234,20 +1212,20 @@
2021, Proton, Proton logged IP address of French activist after an order by Swiss authorities (source link unavailable).
-2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities282.
-2021, DoubleVPN servers, logs, and account info seized by law enforcement283.
-2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months284.
-2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user285 (they did not decrypt the stored e-mail).
-2017, PureVPN was forced to disclose information of one user to the FBI286.
-2014, an EarthVPN user was arrested based on logs provider to the Dutch Police287.
-2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order288.
-2011, HideMyAss user was de-anonymized, and logs were provided to the FBI289.
+2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities278.
+2021, DoubleVPN servers, logs, and account info seized by law enforcement279.
+2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months280.
+2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user281 (they did not decrypt the stored e-mail).
+2017, PureVPN was forced to disclose information of one user to the FBI282.
+2014, an EarthVPN user was arrested based on logs provider to the Dutch Police283.
+2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order284.
+2011, HideMyAss user was de-anonymized, and logs were provided to the FBI285.
Attacks requiring malware implants:
-
@@ -1282,14 +1260,14 @@
Attacks not requiring malware:
-
-
Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing295. Publication with demonstration: http://wallcamera.csail.mit.edu/ [Archive.org]
-Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room296. Publication with photographic examples: https://arxiv.org/pdf/2001.04642.pdf [Archive.org]
-Measuring floor vibrations to identify individuals and determine their health condition and mood297. Publication with demonstration: https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html [Archive.org]
-Observing a light bulb from a distance to listen to the sound in the room298 without any malware: Demonstration: https://www.youtube.com/watch?v=t32QvpfOHqw [Invidious]. It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013299 and that you can even buy devices to perform this yourself such as here: http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html [Archive.org]
+Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing291. Publication with demonstration: http://wallcamera.csail.mit.edu/ [Archive.org]
+Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room292. Publication with photographic examples: https://arxiv.org/pdf/2001.04642.pdf [Archive.org]
+Measuring floor vibrations to identify individuals and determine their health condition and mood293. Publication with demonstration: https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html [Archive.org]
+Observing a light bulb from a distance to listen to the sound in the room294 without any malware: Demonstration: https://www.youtube.com/watch?v=t32QvpfOHqw [Invidious]. It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013295 and that you can even buy devices to perform this yourself such as here: http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html [Archive.org]
Do not conduct sensitive activity while connected to an untrusted/unsecured power line to prevent power line leaks.
Do not use your devices in front of a camera that could be compromised.
@@ -1330,7 +1308,7 @@
DEFCON, Zero Trust a Vision for Securing Cloud, https://www.youtube.com/watch?v=euSsqXO53GY [Invidious]
@@ -1378,7 +1356,7 @@
It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):
If it is an ARM-based M1/M2 Mac:
-
@@ -1421,7 +1399,7 @@
If your main concern is a forensic examination of your devices, you should consider the Tor Browser route or the Tails route.
If your main concerns are remote adversaries that might uncover your online identity on various platforms, you should consider the Tails, Whonix, or Qubes OS routes (listed in order of difficulty).
-If you want system-wide plausible deniability303‘304 despite the risks305’306, consider the Tails route, including the persistent plausible deniability section (see Persistent Plausible Deniability using Whonix within Tails).**
+If you want system-wide plausible deniability299‘300 despite the risks301’302, consider the Tails route, including the persistent plausible deniability section (see Persistent Plausible Deniability using Whonix within Tails).**
If you are in a hostile environment where Tor/VPN usage alone is impossible/dangerous/suspicious, consider the Tails route (without actually using Tor), or more advanced routes like Whonix or Qubes OS.
First read more about it at the EFF here: https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship [Archive.org]
-Check some data yourself here on the Tor Project OONI307 (Open Observatory of Network Interference) website: https://explorer.ooni.org/
+Check some data yourself here on the Tor Project OONI303 (Open Observatory of Network Interference) website: https://explorer.ooni.org/
Have a look at https://censoredplanet.org/ and see if they have data about your country.
Specific to China, look at https://gfwatch.org/ and https://www.usenix.org/system/files/sec21-hoang.pdf [Archive.org]
Test for yourself using OONI (this can be risky in a hostile environment).
@@ -1507,7 +1485,7 @@
Head over to https://apps.apple.com/us/app/onion-browser/id519296448
Install
@@ -1713,17 +1691,17 @@
You have very low IT skills
You decide to go with Tails anyway
Tails uses Tor and therefore you will be using Tor to access any resource on the internet. This alone will make you suspicious to most platforms where you want to create anonymous accounts (this will be explained in more detail later).
Your ISP (whether it is yours or some public Wi-Fi) will also see that you are using Tor, and this could make you suspicious in itself.
Tails does not include (natively) some of the software you might want to use later which will complicate things quite a bit if you want to run some specific things (Android Emulators for instance).
Tails uses Tor Browser which while it is very secure will be detected as well by most platforms and will hinder you in creating anonymous identities on many platforms.
-Tails will not protect you more from the 5$ wrench314.
+Tails will not protect you more from the 5$ wrench310.
Tor in itself might not be enough to protect you from an adversary with enough resources as explained earlier.
Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt316.
+Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt312.
Use instead file containers instead of encrypted volumes.
Make sure you do know how to clean data from an external SSD drive properly.
Better custom Secure Boot settings (where you can selectively manage all the keys and not just use the Standard ones)
HDD/SSD passwords in addition to just BIOS/UEFI passwords.
-AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any “evil” functionalities317. However, if you are going for the Qubes OS Route consider Intel CPUs as Qubes OS does not support AMD with their anti-evil-maid system318.
+AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any “evil” functionalities313. However, if you are going for the Qubes OS Route consider Intel CPUs as Qubes OS does not support AMD with their anti-evil-maid system314.
Secure Wipe tools from the BIOS (especially useful for SSD/NVMe drives, see Appendix M: BIOS/UEFI options to wipe disks in various Brands).
Better control over the disabling/enabling of select peripherals (USB ports, Wi-Fis, Bluetooth, Camera, Microphone …).
Better security features with Virtualization.
@@ -1859,13 +1837,13 @@
Disable USB/HDMI or any other port (Ethernet, Firewire, SD card …) if you can.
Disable Intel ME if you can (odds are very high you can’t).
Disable AMD PSP if you can (AMD’s equivalent to IME, see Your CPU)
-Disable Secure Boot if you intend to use Qubes OS as they do not support it out of the box319. Keep it on if you intend to use Linux/Windows.
+Disable Secure Boot if you intend to use Qubes OS as they do not support it out of the box315. Keep it on if you intend to use Linux/Windows.
Check if your laptop BIOS has a secure erase option for your HDD/SSD that could be convenient in case of need.
Your Linux distribution of choice (excluding Qubes OS)
Windows 10/11 (preferably Home edition due to the absence of Bitlocker)
macOS (Catalina or higher up to Monterey)
Have basic tamper protection (as explained previously) to prevent physical access to the internals of the laptop without your knowing. This will prevent them from cloning your disks and installing a physical key logger without your knowledge.
@@ -1935,14 +1913,14 @@
Some OSes and Encryption software have the Anti Evil Maid (AEM) protection that can be enabled. This is the case with Windows/Veracrypt and QubeOS (only on Intel CPUs).
If your OS or Encryption software allows it, you should consider encrypting the keys within RAM too (this is possible with Windows/Veracrypt and will be explained later). Again see https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/ [Archive.org]
Do enable the option to Wipe keys from memory if a device is inserted in Veracrypt.
-You should limit the use of Sleep stand-by and instead use Shutdown or Hibernate to prevent the encryption keys from staying in RAM when your computer goes to sleep. This is because sleep will maintain power in your memory for resuming your activity faster. Only hibernation and shutdown will actually clear the key from the memory338.
+You should limit the use of Sleep stand-by and instead use Shutdown or Hibernate to prevent the encryption keys from staying in RAM when your computer goes to sleep. This is because sleep will maintain power in your memory for resuming your activity faster. Only hibernation and shutdown will actually clear the key from the memory334.
Windows ShellBags that are stored within the Windows Registry silently storing various histories of accessed volumes/files/folders339.
-Windows Indexing keeping traces of the files present in your user folder by default340.
-Recent lists (aka Jump Lists) in Windows and various apps keeping traces of recently accessed documents341.
+Windows ShellBags that are stored within the Windows Registry silently storing various histories of accessed volumes/files/folders335.
+Windows Indexing keeping traces of the files present in your user folder by default336.
+Recent lists (aka Jump Lists) in Windows and various apps keeping traces of recently accessed documents337.
Many more traces in various logs, please see this convenient interesting poster for more insight: https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download [Archive.org]
Gatekeeper342 and XProtect keeping track of your download history in a local database and file attributes.
+Gatekeeper338 and XProtect keeping track of your download history in a local database and file attributes.
Spotlight Indexing
Recent lists in various apps keeping traces of recently accessed documents.
Temporary folders keeping various traces of App usage and Document usage.
@@ -2028,7 +2006,7 @@
Full Disk simple encryption (your hard drive is encrypted with one passphrase).
Full Disk encryption with plausible deniability (this means that depending on the passphrase entered at boot, you will either boot a decoy OS or a hidden OS).
File container simple encryption (it is a large file that you will be able to mount within Veracrypt as if it were an external drive to store encrypted files within).
File container with plausible deniability (it is the same large file but depending on the passphrase you use when mounting it, you will either mount a “hidden volume” or the “decoy volume”).
Encrypt the memory with a Veracrypt option346 (settings > performance/driver options > encrypt RAM) at a cost of 5-15% performance. This setting will also disable hibernation (which does not actively clear the key when hibernating) and instead encrypt the memory altogether to mitigate some cold-boot attacks. More details about this feature here: https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/ [Archive.org]
+Encrypt the memory with a Veracrypt option342 (settings > performance/driver options > encrypt RAM) at a cost of 5-15% performance. This setting will also disable hibernation (which does not actively clear the key when hibernating) and instead encrypt the memory altogether to mitigate some cold-boot attacks. More details about this feature here: https://sourceforge.net/p/veracrypt/discussion/technical/thread/3961542951/ [Archive.org]
Enable the Veracrypt option to wipe the keys from memory if a new device is inserted (system > settings > security > clear keys from memory if a new device is inserted). This could help in case your system is seized while still on (but locked).
-Enable the Veracrypt option to mount volumes as removable volumes (Settings > Preferences > Mount volume as removable media). This will prevent Windows from writing some logs about your mounts in the Event logs347 and prevent some local data leaks.
+Enable the Veracrypt option to mount volumes as removable volumes (Settings > Preferences > Mount volume as removable media). This will prevent Windows from writing some logs about your mounts in the Event logs343 and prevent some local data leaks.
Be careful and have a good situational awareness if you sense something weird. Shut your laptop down as fast as possible.
Adversaries:
@@ -1486,7 +1464,7 @@You might be asking yourself: “How do I know if I’m in a hostile online environment where activities are actively monitored and blocked?”
You should test that the phone is in working order before going to the next step. But we will repeat ourselves and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either.
When you are certain the phone is in working order, disable Bluetooth then power it off (remove the battery if you can) and go back home and resume your normal activities. Go to the next step.
Getting an anonymous pre-paid SIM card:
-This is the hardest part of the whole guide. It is a SPOF (Single Point of Failure). The places where you can still buy prepaid SIM cards without ID registration are getting increasingly limited due to various KYC type regulations308.
+This is the hardest part of the whole guide. It is a SPOF (Single Point of Failure). The places where you can still buy prepaid SIM cards without ID registration are getting increasingly limited due to various KYC type regulations304.
So here is a list of places where you can still get them now: https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country [Archive.org]
You should be able to find a place that is “not too far” and just go there physically to buy some pre-paid cards and top-up vouchers with cash. Do verify that no law was passed before going that would make registration mandatory (in case the above wiki was not updated). Try to avoid CCTV and cameras and do not forget to buy a Top-Up voucher with the SIM card (if it is not a package) as most pre-paid cards will require a top-up before use.
See Appendix N: Warning about smartphones and smart devices
@@ -1545,7 +1523,7 @@Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms, but you will want anonymous browsing; or if the platforms which you will use allow registration without a phone number.
Get at least one or two decent size generic USB keys (at least 16GB but we would recommend 32GB).
Please do not buy or use gimmicky self-encrypting devices such as these: https://syscall.eu/blog/2018/03/12/aigo_part1/ [Archive.org]
-Some might be very efficient309 but many are gimmicky gadgets that offer no real protection310.
+Some might be very efficient305 but many are gimmicky gadgets that offer no real protection306.
Find some safe places with decent public Wi-Fi:
You need to find safe places where you will be able to do your sensitive activities using some publicly accessible Wi-Fi (without any account/ID registration, avoid CCTVs).
This can be anywhere that will not be tied to you directly (your home/work) and where you can use the Wi-Fi for a while without being bothered. But also, a place where you can do this without being “noticed” by anyone.
@@ -1632,7 +1610,7 @@Please see Warning for using Orbot on Android.
iOS:
Disclaimer: Onion Browser, following a 2018 release on iOS, has had IP leaks via WebRTC. It is still the only officially endorsed browser for the Tor network for iOS. Users should exercise caution when using the browser and check for any DNS leaks.
-While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project311.
+While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project307.
Tails312 stands for The Amnesic Incognito Live System. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network.
+Tails308 stands for The Amnesic Incognito Live System. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network.
You insert the Tails USB key into your laptop, boot from it and you have a full operating system running with privacy and anonymity in mind. As soon as you shut down the computer, everything will be gone unless you saved it somewhere.
Tails is an amazingly straightforward way to get going in no time with what you have and without much learning. It has extensive documentation and tutorials.
-WARNING: Tails is not always up to date with their bundled software. And not always up to date with the Tor Browser updates either. You should always make sure you are using the latest version of Tails and you should use extreme caution when using bundled apps within Tails that might be vulnerable to exploits and reveal your location313.
+WARNING: Tails is not always up to date with their bundled software. And not always up to date with the Tor Browser updates either. You should always make sure you are using the latest version of Tails and you should use extreme caution when using bundled apps within Tails that might be vulnerable to exploits and reveal your location309.
It does however have some drawbacks:
Important Note: If your laptop is monitored/supervised and some local restrictions are in place, please read Appendix U: How to bypass (some) local restrictions on supervised computers.
@@ -1758,7 +1736,7 @@When you are done and have a working Tails on your laptop, go to the Creating your anonymous online identities step much further in this guide or if you want persistence and plausible deniability, continue with the next section.
Persistent Plausible Deniability using Whonix within Tails:
Consider checking the https://github.com/aforensics/HiddenVM [Archive.org] project for Tails.
-This project is a clever idea of a one-click self-contained VM solution that you could store on an encrypted disk using plausible deniability315 (see The Whonix route: first chapters and also for some explanations about Plausible deniability, as well as the How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives: section at the end of this guide for more understanding).
+This project is a clever idea of a one-click self-contained VM solution that you could store on an encrypted disk using plausible deniability311 (see The Whonix route: first chapters and also for some explanations about Plausible deniability, as well as the How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives: section at the end of this guide for more understanding).
This would allow the creation of a hybrid system mixing Tails with the Virtualization options of the Whonix route in this guide.
image19 @@ -1779,7 +1757,7 @@See https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis [Wikiless] [Archive.org]
CAUTION: Please see Appendix K: Considerations for using external SSD drives and Understanding HDD vs SSD sections if you consider storing such hidden VMs on an external SSD drive:
-
-
Only enable those on a “need to use” basis and disable them again after use. This can help mitigate some attacks in case your laptop is seized while locked but still on OR if you had to shut it down rather quickly and someone took possession of it (this topic will be explained later in this guide).
About Secure boot:
-So, what is Secure Boot320? In short, it is a UEFI security feature designed to prevent your computer from booting an operating system from which the bootloader was not signed by specific keys stored in the UEFI firmware of your laptop.
-When the operating system (or the Bootloader321) supports it, you can store the keys of your bootloader in your UEFI firmware, and this will prevent booting up any unauthorized Operating System (such as a live OS USB or anything similar).
+So, what is Secure Boot316? In short, it is a UEFI security feature designed to prevent your computer from booting an operating system from which the bootloader was not signed by specific keys stored in the UEFI firmware of your laptop.
+When the operating system (or the Bootloader317) supports it, you can store the keys of your bootloader in your UEFI firmware, and this will prevent booting up any unauthorized Operating System (such as a live OS USB or anything similar).
Secure Boot settings are protected by the password you set up to access the BIOS/UEFI settings. If you have that password, you can disable Secure Boot and allow unsigned OSes to boot on your system. This can help mitigate some Evil-Maid attacks (explained later in this guide).
In most cases, Secure Boot is disabled by default or is enabled but in “setup” mode which will allow any system to boot. For Secure Boot to work, your Operating System will have to support it and then sign its bootloader and push those signing keys to your UEFI firmware. After that, you will have to go to your BIOS/UEFI settings and save those pushed keys from your OS and change the Secure Boot from setup to user mode (or custom mode in some cases).
After doing that step, only the Operating Systems from which your UEFI firmware can verify the integrity of the bootloader will be able to boot.
@@ -1890,9 +1868,9 @@You should also enable firmware password reset protection (available from Catalina) according to the documentation here: https://support.apple.com/en-gb/guide/security/sec28382c9ca/web [Archive.org]
This feature will mitigate the possibility for some adversaries to use hardware hacks to disable/bypass your firmware password. Note that this will also prevent Apple themselves from accessing the firmware in case of repair.
Physically Tamper protect your laptop:
-At some point, you will inevitably leave this laptop alone somewhere. You will not sleep with it and take it everywhere every single day. You should make it as hard as possible for anyone to tamper with it without you noticing it. This is mostly useful against some limited adversaries that will not use a 5$ wrench against you322.
+At some point, you will inevitably leave this laptop alone somewhere. You will not sleep with it and take it everywhere every single day. You should make it as hard as possible for anyone to tamper with it without you noticing it. This is mostly useful against some limited adversaries that will not use a 5$ wrench against you318.
It is important to know that it is trivially easy for some specialists to install a key logger in your laptop, or to just make a clone copy of your hard drive that could later allow them to detect the presence of encrypted data in it using forensic techniques (more on that later).
-Here is a good cheap method to make your laptop tamper-proof using Nail Polish (with glitter) https://mullvad.net/en/help/how-tamper-protect-laptop/ [Archive.org] 323 (with pictures).
+Here is a good cheap method to make your laptop tamper-proof using Nail Polish (with glitter) https://mullvad.net/en/help/how-tamper-protect-laptop/ [Archive.org] 319 (with pictures).
While this is a good cheap method, it could also raise suspicions as it is quite “noticeable” and might just reveal that you “have something to hide”. So, there are more subtle ways of achieving the same result. You could also for instance make a close-up macro photography of the back screws of your laptop or just use a small amount of candle wax within one of the screws that could just look like usual dirt. You could then check for tampering by comparing the photographs of the screws with new ones. Their orientation might have changed a bit if your adversary was not careful enough (Tightening them exactly the same way they were before). Or the wax within the bottom of a screw head might have been damaged compared to before.
image20 @@ -1904,20 +1882,20 @@In riskier environments, check your laptop for tampering before using it regularly.
The Whonix route:
Picking your Host OS (the OS installed on your laptop):
-This route will make extensive use of Virtual Machines324, they will require a host OS to run the Virtualization software. You have three recommended choices in this part of the guide:
+This route will make extensive use of Virtual Machines320, they will require a host OS to run the Virtualization software. You have three recommended choices in this part of the guide:
In addition, chances are high that your Mac is or has been tied to an Apple account (at the time of purchase or after signing-in) and therefore its unique hardware identifiers could lead back to you in case of hardware identifiers leak.
-Linux is also not necessarily the best choice for anonymity depending on your threat model. This is because using Windows will allow us to conveniently use Plausible Deniability325 (aka Deniable Encryption326) easily at the OS level. Windows is also unfortunately at the same time a privacy nightmare327 but is the only easy to set up option for using OS-wide plausible deniability. Windows telemetry and telemetry blocking are also widely documented which should mitigate many issues.
-So, what is Plausible Deniability? You can cooperate with an adversary requesting access to your device/data without revealing your true secret. All this using Deniable Encryption328.
-A soft lawful adversary could ask for your encrypted laptop password. At first, you could refuse to give out any password (using your “right to remain silent”, “right not to incriminate yourself”) but some countries are implementing laws329’330 to exempt this from such rights (because terrorists and “think of the children”). In that case, you might have to reveal the password or face jail time in contempt of court. This is where plausible deniability will come into play.
+Linux is also not necessarily the best choice for anonymity depending on your threat model. This is because using Windows will allow us to conveniently use Plausible Deniability321 (aka Deniable Encryption322) easily at the OS level. Windows is also unfortunately at the same time a privacy nightmare323 but is the only easy to set up option for using OS-wide plausible deniability. Windows telemetry and telemetry blocking are also widely documented which should mitigate many issues.
+So, what is Plausible Deniability? You can cooperate with an adversary requesting access to your device/data without revealing your true secret. All this using Deniable Encryption324.
+A soft lawful adversary could ask for your encrypted laptop password. At first, you could refuse to give out any password (using your “right to remain silent”, “right not to incriminate yourself”) but some countries are implementing laws325’326 to exempt this from such rights (because terrorists and “think of the children”). In that case, you might have to reveal the password or face jail time in contempt of court. This is where plausible deniability will come into play.
You could then reveal a password, but that password will only give access to “plausible data” (a decoy OS). The forensics will be well aware that it is possible for you to have hidden data but should not be able to prove this (if you do this right). You will have cooperated, and the investigators will have access to something but not what you actually want to hide. Since the burden of proof should lie on their side, they will have no options but to believe you unless they have proof that you have hidden data.
This feature can be used at the OS level (a plausible OS and a hidden OS) or at the files level where you will have an encrypted file container (similar to a zip file) where different files will be shown depending on the encryption password you use.
This also means you could set up your own advanced “plausible deniability” setup using any Host OS by storing for instance Virtual Machines on a Veracrypt hidden volume container (be careful of traces in the Host OS tho that would need to be cleaned if the host OS is persistent, see Some additional measures against forensics section later). There is a project for achieving this within Tails (https://github.com/aforensics/HiddenVM [Archive.org]) which would make your Host OS non-persistent and use plausible deniability within Tails.
-In the case of Windows, plausible deniability is also the reason you should ideally have Windows 10/11 Home (and not Pro). This is because Windows 10/11 Pro natively offers a full-disk encryption system (Bitlocker331) where Windows 10/11 Home offers no full-disk encryption at all. You will later use third-party open-source software for encryption that will allow full-disk encryption on Windows 10/11 Home. This will give you a good (plausible) excuse to use this software. While using this software on Windows 10/11 Pro would be suspicious.
+In the case of Windows, plausible deniability is also the reason you should ideally have Windows 10/11 Home (and not Pro). This is because Windows 10/11 Pro natively offers a full-disk encryption system (Bitlocker327) where Windows 10/11 Home offers no full-disk encryption at all. You will later use third-party open-source software for encryption that will allow full-disk encryption on Windows 10/11 Home. This will give you a good (plausible) excuse to use this software. While using this software on Windows 10/11 Pro would be suspicious.
Note about Linux: So, what about Linux and plausible deniability? Yes, it is possible to achieve plausible deniability with Linux too. More information within the Linux Host OS section later.
Unfortunately, encryption is not magic and there are some risks involved:
Threats with encryption:
@@ -1926,7 +1904,7 @@Plausible deniability is only effective against soft lawful adversaries that will not resort to physical means. Avoid, if possible, the use of plausible deniability-capable software (such as Veracrypt) if your threat model includes hard adversaries. So, Windows users should in that case install Windows Pro as a Host OS and use Bitlocker instead.
See https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis [Wikiless] [Archive.org]
Evil-Maid Attack:
-Evil Maid Attacks332 are conducted when someone tampers with your laptop while you are away. To install to clone your hard drive, install malware or a key logger. If they can clone your hard drive, they can compare one image of your hard drive at the time they took it while you were away with the hard drive when they seize it from you. If you used the laptop again in between, forensics examiners might be able to prove the existence of the hidden data by looking at the variations between the two images in what should be an empty/unused space. This could lead to compelling evidence of the existence of hidden data. If they install a key logger or malware within your laptop (software or hardware), they will be able to simply get the password from you for later use when they seize it. Such attacks can be done at your home, your hotel, a border crossing, or anywhere you leave your devices unattended.
+Evil Maid Attacks328 are conducted when someone tampers with your laptop while you are away. To install to clone your hard drive, install malware or a key logger. If they can clone your hard drive, they can compare one image of your hard drive at the time they took it while you were away with the hard drive when they seize it from you. If you used the laptop again in between, forensics examiners might be able to prove the existence of the hidden data by looking at the variations between the two images in what should be an empty/unused space. This could lead to compelling evidence of the existence of hidden data. If they install a key logger or malware within your laptop (software or hardware), they will be able to simply get the password from you for later use when they seize it. Such attacks can be done at your home, your hotel, a border crossing, or anywhere you leave your devices unattended.
You can mitigate this attack by doing the following (as recommended earlier):
Cold-Boot Attack:
-Cold Boot attacks333 are trickier than the Evil Maid Attack but can be part of an Evil Maid attack as it requires an adversary to come into possession of your laptop while you are actively using your device or shortly afterward.
-The idea is rather simple, as shown in this video334, an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and “cool down” the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.
-In the case of Plausible Deniability, there have been some forensics studies335 about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies336 and by the maintainer of Veracrypt337 so we would not worry too much about those yet.
+Cold Boot attacks329 are trickier than the Evil Maid Attack but can be part of an Evil Maid attack as it requires an adversary to come into possession of your laptop while you are actively using your device or shortly afterward.
+The idea is rather simple, as shown in this video330, an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and “cool down” the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these.
+In the case of Plausible Deniability, there have been some forensics studies331 about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies332 and by the maintainer of Veracrypt333 so we would not worry too much about those yet.
The same measures used to mitigate Evil Maid attacks should be in place for Cold Boot attacks with some added ones:
See also https://www.whonix.org/wiki/Cold_Boot_Attack_Defense [Archive.org] and https://www.whonix.org/wiki/Protection_Against_Physical_Attacks [Archive.org]
Here are also some interesting tools to consider for Linux users to defend against these:
@@ -1964,14 +1942,14 @@Here are some examples of such leaks:
Windows:
-
-
macOS:
-
-
For other distros, you will have to document yourself, but it will likely be similar. Encryption during install is just much easier in the context of this guide.
Note about plausible deniability on Linux:
-There are several ways to achieve plausible deniability on Linux343 and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux.
+There are several ways to achieve plausible deniability on Linux339 and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux.
The Detached Headers Way:
While not supported yet by this guide, it is possible to achieve a form of deniability on Linux using LUKS by using detached LUKS headers. For now, we will redirect you toward this page for more information: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header [Archive.org]
The Veracrypt Way:
@@ -2169,20 +2147,20 @@See Appendix B: Windows Additional Privacy Settings
Windows Host OS encryption:
If you intend to use system-wide plausible deniability:
-Veracrypt344 is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:
+Veracrypt340 is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for:
It is to my knowledge the only (convenient and usable by anyone) free, open-source, and openly audited345 encryption software that also provides plausible deniability for widespread use and it works with Windows Home Edition.
+It is to my knowledge the only (convenient and usable by anyone) free, open-source, and openly audited341 encryption software that also provides plausible deniability for widespread use and it works with Windows Home Edition.
Go ahead and download and install Veracrypt from: https://www.veracrypt.fr/en/Downloads.html [Archive.org]
After installation, please take a moment to review the following options that will help mitigate some attacks:
-
-
If you do not want to use encrypted memory (because performance might be an issue), you should at least enable hibernation instead of sleep. This will not clear the keys from memory (you are still vulnerable to cold boot attacks) but at least should mitigate them if your memory has enough time to decay.
@@ -2208,8 +2186,8 @@Encryption should now be started in the background (you can check by clicking the Bitlocker icon on the lower right side of the taskbar).
Later this guide will not recommend “bad cryptography” and that should hopefully be enough to protect you?
No logging but logging anyway policies:
Many people have the idea that privacy-oriented services such as VPN or E-Mail providers are safe due to their no-logging policies or their encryption schemes. Unfortunately, many of those same people forget that all those providers are legal commercial entities subject to the laws of the countries in which they operate.
-Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order280 or a national security letter281) log your activity to de-anonymize you. There have been several recent examples of those:
+Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order276 or a national security letter277) log your activity to de-anonymize you. There have been several recent examples of those:
Some providers have implemented the use of a Warrant Canary290 that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.
-Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story291 and Omnisec story292).
+Some providers have implemented the use of a Warrant Canary286 that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.
+Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story287 and Omnisec story288).
For these reasons, you mustn’t trust such providers for your privacy despite all their claims. In most cases, you will be the last person to know if any of your accounts were targeted by such orders and you might never know at all.
To mitigate this, in cases where you want to use a VPN, we will recommend the use of a cash/Monero-paid VPN provider over Tor to prevent the VPN service from knowing any identifiable information about you.
If the VPN provider knows nothing about you, it should mitigate any issue due to them not logging but logging anyway.
@@ -1255,8 +1233,8 @@
(Illustration: an excellent movie we highly recommend: Das Leben der Anderen293)
-Many advanced techniques can be used by skilled adversaries294 to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here https://cyber.bgu.ac.il/advanced-cyber/airgap [Archive.org] (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf [Archive.org] (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include:
+(Illustration: an excellent movie we highly recommend: Das Leben der Anderen289)
+Many advanced techniques can be used by skilled adversaries290 to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here https://cyber.bgu.ac.il/advanced-cyber/airgap [Archive.org] (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf [Archive.org] (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include:
Here is also a good video from the same authors to explain those topics: Black Hat, The Air-Gap Jumpers https://www.youtube.com/watch?v=YKRtFgunyj4 [Invidious]
-Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle300, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:
+Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle296, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:
General Preparations:
Personally, in the context of this guide, it is also interesting to have a look at your security model. And in this context,we only have one to recommend:
-Zero-Trust Security301 (“Never trust, always verify”).
+Zero-Trust Security297 (“Never trust, always verify”).
Here are some various resources about what Zero-Trust Security is:
Unfortunately, this is not enough. With this setup, your Bitlocker key can just be stored as-is in the TPM chip of your computer. This is rather problematic as the key can be extracted in some cases with ease348‘349’350’351.
-To mitigate this, you will have to enable a few more options as per the recommendations of Microsoft352:
+Unfortunately, this is not enough. With this setup, your Bitlocker key can just be stored as-is in the TPM chip of your computer. This is rather problematic as the key can be extracted in some cases with ease344‘345’346’347.
+To mitigate this, you will have to enable a few more options as per the recommendations of Microsoft348:
Click the Windows icon
Type Run
@@ -2321,7 +2299,7 @@
Requires Windows (this feature is not “easily” supported on Linux).
The danger of online Data leaks
Requires full wipe of your laptop
-No use with an SSD drive due to the requirement of disabling Trim353 Operations354. This will severely degrade the performance/health of your SSD drive over time.
+No use with an SSD drive due to the requirement of disabling Trim349 Operations350. This will severely degrade the performance/health of your SSD drive over time.
