diff --git a/docs/about/index.md b/docs/about/index.md
index c7b57b5..e2e9f38 100644
--- a/docs/about/index.md
+++ b/docs/about/index.md
@@ -15,7 +15,7 @@ schema:
---
{ align=right }
-**Anonymous Planet** are the maintainers of the [*Hitchhiker's Guide*](https://anonymousplanet.org/guide.html) and the [*PSA Community*](https://psa.anonymousplanet.org). It is responsible for maintaining the projects and code repositories.
+**Anonymous Planet** are the maintainers of the [_Hitchhiker's Guide_](https://anonymousplanet.org/guide.html) and the [_PSA Community_](https://psa.anonymousplanet.org). It is responsible for maintaining the projects and code repositories.
The purpose: providing an introduction to various online tracking techniques, online ID verification techniques, and detailed guidance to creating and maintaining (truly) anonymous online identities. It is written with the hopes that good people (e.g., activists, journalists, scientists, lawyers, whistle-blowers, etc.) will be able to fight oppression, censorship and harassment! The website and projects are free (as in freedom) and not affiliated with any donor or projects discussed.
@@ -33,9 +33,9 @@ The purpose: providing an introduction to various online tracking techniques, on
This guide is a non-profit open-source initiative, licensed under Creative Commons **Attribution-NonCommercial** 4.0 International ([cc-by-nc-4.0](https://creativecommons.org/licenses/by-nc/4.0/) [[Archive.org]](https://web.archive.org/web/https://creativecommons.org/licenses/by-nc/4.0/)).
-- For mirrors see [Mirrors](../mirrors/index.md) and the links at the bottom right of the page. You should see these on every page.
+- For mirrors see [Mirrors](../mirrors/index.md) and the links at the bottom right of the page. You should see these on every page.
-- For help in comparing versions see [Comparing versions](../guide/index.md#appendix-a7-comparing-versions)
+- For help in comparing versions see [Comparing versions](../guide/index.md#appendix-a7-comparing-versions)
Feel free to submit issues **(please do report anything wrong)** using GitHub Issues at: . We also accept Merge Requests (MR) from our Gitlab and many other places. Do not hesitate to report issues and suggestions!
@@ -49,15 +49,16 @@ Feel free to submit issues **(please do report anything wrong)** using GitHub Is
Follow us on:
-- Twitter at
+- Twitter at
-- Mastodon at
+- Mastodon at
To contact me, see the updated information on the website or send an e-mail to
-**Please consider [donating](../donate/index.md) if you enjoy the project and want to support the hosting fees or support the funding of initiatives like the hosting of Tor Exit Nodes.**
+**Please consider [donating](../guide/index.md#donations) if you enjoy the project and want to support the hosting fees or support the funding of initiatives like the hosting of Tor Exit Nodes.**
### Recommended Reading
+
Some of those resources may, in order to sustain their project, contain or propose:
- Sponsored commercial content
@@ -67,12 +68,11 @@ Some of those resources may, in order to sustain their project, contain or propo
- Premium content such as ad-free content or updated content
- Merchandising
-*Note that these websites could contain affiliate/sponsored content and/or merchandising. This guide does not endorse and is not sponsored by any commercial entity in any way.*
+_Note that these websites could contain affiliate/sponsored content and/or merchandising. This guide does not endorse and is not sponsored by any commercial entity in any way._
If you skipped those, you should really still consider viewing this YouTube playlist from the Techlore Go Incognito project ( [[Archive.org]](https://web.archive.org/web/https://github.com/techlore-official/go-incognito)) as an introduction before going further: [[Invidious]](https://yewtu.be/playlist?list=PL3KeV6Ui_4CayDGHw64OFXEPHgXLkrtJO). This guide will cover many of the topics in the videos of this playlist with more details and references as well as some added topics not covered within that series. This will just take you 2 or 3 hours to watch it all.
-
-*Anonymous Planet* **does not** participate in any sponsoring, endorsement, advertising, or other affiliate programs for any entity. We only rely on anonymous donations in a closed, transparent loop system.
+_Anonymous Planet_ **does not** participate in any sponsoring, endorsement, advertising, or other affiliate programs for any entity. We only rely on anonymous donations in a closed, transparent loop system.
??? Note "Privacy related"
@@ -100,7 +100,7 @@ If you skipped those, you should really still consider viewing this YouTube play
- Terms of Service, Didn't Read:
- Whonix Documentation:
-!!! Note "We are not affiliated with Anonymous or Riseup"
+??? Note "We are not affiliated with Anonymous or Riseup"
One or two of our community members uses or has used the resources of Riseup. We are not affiliated with Riseup in any manner.
diff --git a/docs/code/index.md b/docs/code/index.md
new file mode 100644
index 0000000..612dea8
--- /dev/null
+++ b/docs/code/index.md
@@ -0,0 +1,69 @@
+---
+title: Content Contributions
+---
+You can [submit bugs and feature requests](https://github.com/Anon-Planet/thgtoa/issues/new) with detailed information about your issue or idea:
+
+- If you'd like to propose an addition, please follow the standards outlined here.
+- If you're reporting an issue, please be sure to include the expected behaviour, the observed behaviour, and steps to reproduce the problem.
+- This can require technical knowledge, but you can also get involved in conversations about bug reports and feature requests. This is a great way to get involved without getting too overwhelmed!
+- [Help fellow committers test recently submitted pull requests](https://github.com/Anon-Planet/thgtoa/pulls). Simply by pulling down a pull request and testing it, you can help ensure our new code contributions for stability and quality.
+
+For those of you who are looking to add content to the guide, include the following:
+
+##### Pull Requests
+
+- **Do** create a [topic branch] to work on instead of working directly on `main`. This helps to:
+ + Protect the process.
+ + Ensures users are aware of commits on the branch being considered for merge.
+ + Allows for a location for more commits to be offered without mingling with other contributor changes.
+ + Allows contributors to make progress while a PR is still being reviewed.
+- **Do** follow the [50/72 rule] for Git commit messages.
+- **Do** write "WIP" on your PR and/or open a [draft PR] if submitting unfinished changes..
+- **Do** make sure the title of a draft PR makes it immediately clear that it's a draft
+- **Do** target your pull request to the **main branch**.
+- **Do** specify a descriptive title to make searching for your pull request easier.
+- **Don't** leave your pull request description blank.
+- **Don't** abandon your pull request. Being responsive helps us land your changes faster.
+- **Don't** post questions in older closed PRs.
+- **Do** stick to the guide to find common style issues.
+- **Don't** make mass changes (such as replacing "I" with "we") using automated serach/replace functionality.
+ + Search/replace doesn't understand context, and as such, will inevitably cause inconsistencies and make the guide harder to read.
+ + If it's part of a larger PR, it'll also make the reviewer's life harder, as they'll have to go through manually and undo everything by hand.
+ + _If you're going to make mass changes, take the time to do it properly_. Otherwise we'll just have to undo it anyway.
+ + If your change contains backslashes (`\`), either escape them with another backslash (`\\`) or put them in a ```code block```.
+
+When reporting guide issues:
+
+- **Do** write a detailed description of your issue and use a descriptive title.
+- **Do** make it as detailed as possible and don't just submit 50 line changes without explaining.
+- **Don't** file duplicate reports; search for your bug before filing a new report.
+- **Don't** attempt to report issues on a closed PR.
+
+### Large PRs
+
+Please split large sets of changes into multiple PRs. For example, a PR that adds Windows 11 support, removes Windows AME references, and fixes typos can be split into 3 PRs. This makes PRs easier to review prior to merging.
+
+For an example of what _not_ to do, see: . This PR contains enough changes to split into multiple smaller and individually reviewable PRs.
+
+### Updating PRs
+
+While a PR is being reviewed, modifications may be made to it by the reviewer prior to merging. If this is the case, a new branch will be created for the PR's review. If you would like to submit a change to a PR that is in the process of being reviewed, _do not update the PR directly_. This will only cause merge conflicts and delay the PR from being merged. Instead, submit your changes to the PR's review branch.
+
+For an example of what _not_ to do, see: . Instead of submitting changes to the PR directly, they should have been submitted as changes to the PR's associated review branch.
+
+---
+
+**Thank you** for taking the few moments to read this far! You're already way ahead of the
+curve, so keep it up!
+
+[discussions]: https://github.com/Anon-Planet/thgtoa/discussions
+[issues]: https://github.com/Anon-Planet/thgtoa/issues
+[help fellow users with open issues]: https://github.com/Anon-Planet/thgtoa/issues
+[topic branch]: http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches
+[Qubes#7457]: https://github.com/QubesOS/qubes-issues/issues/7457
+[50/72 rule]: http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html
+[draft pr]: https://help.github.com/en/articles/about-pull-requests#draft-pull-requests
+[console output]: https://docs.github.com/en/free-pro-team@latest/github/writing-on-github/creating-and-highlighting-code-blocks#fenced-code-blocks
+[verification steps]: https://docs.github.com/en/free-pro-team@latest/github/writing-on-github/basic-writing-and-formatting-syntax#task-lists
+[reference associated issues]: https://github.com/blog/1506-closing-issues-via-pull-requests
+[help fellow committers test recently submitted pull requests]: https://github.com/Anon-Planet/thgtoa/pulls
diff --git a/docs/donate/index.md b/docs/contribute/index.md
similarity index 85%
rename from docs/donate/index.md
rename to docs/contribute/index.md
index fdb782a..48b9fb9 100644
--- a/docs/donate/index.md
+++ b/docs/contribute/index.md
@@ -1,109 +1,111 @@
----
-title: How to Get Involved
----
-Donations to support this project are welcome. Those donations are mainly used to pay for Tor onion hosting (VPS), mail hosting, domain name registration, and to maintain/run Tor exit nodes. **No profit is ever being made**. All donations and spendings are being logged here below for transparency.
-
-**Current project donation goals:**
-
-- Funding for a VPS for hosting our .onion website: **done**
-- Funding for extending our domain name: **Recovery of original domain secured until 2029**
-- Funding for a decent mail hosting
-- Funding for a VPS for hosting various services
-
-#### Donate using Monero (XMR)
-
-Total Monero donations received: **7.101317184263 XMR**
-Total Monero remaining: **2.059336719397 XMR**
-
-Here is the address for the main project:
-
-```46crzj54eL493BA68pPT4A1MZyKQxrpZu9tVNsfsoa5nT85QqCt8cDTfy1fcTH1oyjdtUbhmpZ4QcVtfEXB337Ng6PS21ML```
-
-![][1]
-
-#### Donate using Bitcoin (BTC)
-
-Total Bitcoin donations received: **1.89353 mBTC**
-Total Bitcoin remaining: **0 mBTC**
-
-Here are the addresses for the main project:
-
-SegWit address: ```bc1qp9g2c6dquh5lnvft50esxsl97kupdpyqyd4kkv```
-Legacy address: ```1BBgBSVe6w4DWq2BewUQhDEjsNovhfPswD```
-
-![][2]_____________________![][3]
-
-
-**Thank you for any contribution. All donations will be mentioned on this page.**
-
-#### Donations log
-
-- 2021-02-06 16:48: 0.1 XMR
-- 2021-03-15 00:09: 1.24869 mBTC
-- 2021-03-15 08:41: 0.07896 mBTC
-- 2021-03-31 16:28: 1 XMR (Special thanks for this very generous donation)
-- 2021-04-03 22:31: 0.5 XMR (Special thanks for this very generous donation)
-- 2021-05-07 06:22: 0.010433355105 XMR
-- 2021-06-16 03:05: 0.03 XMR
-- 2021-06-27 18:39: 0.05 XMR
-- 2021-07-12 07:24: 0.02 XMR
-- 2021-07-16 14:31: 0.1 mBTC
-- 2021-07-20 21:01: 0.058981 XMR
-- 2021-07-24 15:16: 0.000000000001 XMR
-- 2021-07-25 02:37: 0.000000000001 XMR
-- 2021-08-03 00:17: 0.04119191113 XMR
-- 2021-08-07 15:05: 0.206328241262 XMR
-- 2021-08-10 11:42: 0.21 mBTC
-- 2021-08-13 00:25: 0.25 XMR
-- 2021-08-14 04:58: 0.25588 mBTC
-- 2021-08-30 17:32: 0.000000000001 XMR
-- 2021-09-17 14:34: 0.018 XMR
-- 2021-10-01 06:23: 0.000000002137 XMR
-- 2021-10-02 19:16: 1 XMR (Special thanks for this very generous donation)
-- 2021-10-17 15:40: 0.02 XMR
-- 2021-10-18 16:06: 0.1958 XMR
-- 2021-11-12 20:42: 0.02 XMR
-- 2021-11-14 18:28: 0.018 XMR
-- 2021-12-03 21:38: 0.10134722595 XMR
-- 2021-12-16 01:16: 1 XMR (Special thanks for this very generous donation)
-- 2021-12-16 18:06: 0.017 XMR
-- 2022-01-09 17:54: 0.045918219893 XMR
-- 2022-01-15 17:35: 0.014 XMR
-- 2022-01-24 21:08: 0.010786 XMR
-- 2022-01-26 12:07: 0.010391 XMR
-- 2022-02-03 19:59: 0.013013984 XMR
-- 2022-02-18 17:27: 0.019 XMR
-- 2022-03-14 10:25: 0.0139887 XMR
-- 2022-07-30 03:51: 0.0222 XMR
-- 2022-09-28 05:13: 2 XMR
-- 2022-08-19: SimpleLogin.io Lifetime Premium
-- 2022-09-19: 0.345024603905 XMR (Special thanks to a previous maintainer)
-
-#### Spendings log
-
-- 2021-03-12: 0.08181086 XMR (+fees) for domain anonymousplanet.org (1 year)
-- 2021-03-16: 1.20179 mBTC (+fees) for domain anonymousplanet.org renewal (extension 3 years totalling 4 years)
-- 2021-04-01: 0.8317 XMR (+fees) for basic VPS for Tor Mirror hosting
-- 2021-04-05: 0.99367 mBTC (+fees +exchange from XMR to BTC) for Mail Hosting (1 year): **Lost**
-- 2021-04-13: 0.71895 mBTC (+fees +exchange from XMR to BTC) for Mail Hosting (extension to 2 years): **Lost**
-- 2021-04-25: 0.02892 mBTC (Wallet to Wallet transfer fee)
-- 2021-07-13: 0.78463 mBTC (+fees +exchange from BTC to XMR) for consolidation
-- 2021-07-13: 0.067261698061 XMR (+fees) for a Tor Exit Node (01) Hosting (3 months): **Lost**
-- 2021-07-15: 0.151959953047 XMR (+fees) for a Tor Exit Node (02) Hosting (6 months): **Lost**
-- 2021-08-16: 0.253331471239 XMR (+fees) for a Tor Exit Node (03) Hosting (12 months): **Lost**
-- 2021-08-18: AtomicSwap conversion from remaining mBTC (-0.56588) to XMR (+0.081904862179)
-- 2021-08-19: 0.0644 XMR (+fees) for Mail Hosting extension: **Lost**
-- 2021-09-18: 0.246971511836 XMR (+fees) for renewal 1 year of Tor Exit Node 01: **Lost**
-- 2021-10-04: 0.26954 XMR (+fees) for domain anonymousplanet.org extension until 2029
-- 2021-10-06: 0.236073464623 XMR (+fees) for a Tor Exit Node (04) Hosting (12 months): **Lost**
-- 2021-10-18: 0.01952 XMR (+fees) for testing a new VPS hosting provider (Privex.io) for one month: **Ended**
-- 2021-10-30: 0.240787814495 XMR (+fees) for a Synapse Hosting VPS (12 months) with bots to help grow the community. This is a test program that will be converted into a Tor Exit Node in case of failure: **Lost**
-- 2022-01-01: 0.28055816111 XMR (+fees) for renewal 1 year of Tor Exit Node 02: **Lost**
-- 2022-02-02: 0.966793601024 XMR (+fees) to sponsor a special project (w/ Universal Declaration of Human Rights): **Lost**
-- 2022-07-11: 0.503232784687 XMR (+fees) for 1984.is VPS (12 months): **Ended**
-- 2022-09-19: 0.345024603905 XMR (+fees) for upgrading VPS RAM/Disk: **Ended**
-
-
-[1]: ../media/monero.png
-[2]: ../media/bitcoin-segwit.png
-[3]: ../media/bitcoin-legacy.png
+---
+title: How to Get Involved
+---
+There are multiple ways you can add to the guide. Donations to support this project are welcome but are entirely optional. Those donations are mainly used to pay for Tor onion hosting (VPS), mail hosting, domain name registration, and to maintain/run Tor exit nodes. **No profit is ever being made**. All donations and spendings are being logged here below for transparency. Some costs for load balancer servers have been omitted for privacy reasons, but are not paid for with existing Anonymous Planet finances.
+
+**Current project donation goals:**
+
+- Funding for a VPS for hosting our .onion website: **done**
+- Funding for extending our domain name: **Recovery of original domain secured until 2029**
+- Funding for a decent mail hosting
+- Funding for a VPS for hosting various services
+
+## Donate using Monero (XMR)
+
+Total Monero donations received: **7.101317184263 XMR**
+Total Monero remaining: **2.059336719397 XMR**
+
+Here is the address for the main project:
+
+```46crzj54eL493BA68pPT4A1MZyKQxrpZu9tVNsfsoa5nT85QqCt8cDTfy1fcTH1oyjdtUbhmpZ4QcVtfEXB337Ng6PS21ML```
+
+![][1]
+
+## Donate using Bitcoin (BTC)
+
+Total Bitcoin donations received: **1.89353 mBTC**
+Total Bitcoin remaining: **0 mBTC**
+
+Here are the addresses for the main project:
+
+SegWit address: ```bc1qp9g2c6dquh5lnvft50esxsl97kupdpyqyd4kkv```
+Legacy address: ```1BBgBSVe6w4DWq2BewUQhDEjsNovhfPswD```
+
+![][2]_____________________![][3]
+
+## Content Contributions
+
+You can easily contribute code or information suggestions at our code repositories listed at the bottom of the website and on the [Mirrors](../mirrors/index.md) tab above. We have many options that are easily accessible. Please follow our [contributing guidelines](../code/index.md) and use good PR syntax.
+
+**Thank you for any contribution. All donations will be mentioned on this page.**
+
+### Donations log
+
+- 2021-02-06 16:48: 0.1 XMR
+- 2021-03-15 00:09: 1.24869 mBTC
+- 2021-03-15 08:41: 0.07896 mBTC
+- 2021-03-31 16:28: 1 XMR (Special thanks for this very generous donation)
+- 2021-04-03 22:31: 0.5 XMR (Special thanks for this very generous donation)
+- 2021-05-07 06:22: 0.010433355105 XMR
+- 2021-06-16 03:05: 0.03 XMR
+- 2021-06-27 18:39: 0.05 XMR
+- 2021-07-12 07:24: 0.02 XMR
+- 2021-07-16 14:31: 0.1 mBTC
+- 2021-07-20 21:01: 0.058981 XMR
+- 2021-07-24 15:16: 0.000000000001 XMR
+- 2021-07-25 02:37: 0.000000000001 XMR
+- 2021-08-03 00:17: 0.04119191113 XMR
+- 2021-08-07 15:05: 0.206328241262 XMR
+- 2021-08-10 11:42: 0.21 mBTC
+- 2021-08-13 00:25: 0.25 XMR
+- 2021-08-14 04:58: 0.25588 mBTC
+- 2021-08-30 17:32: 0.000000000001 XMR
+- 2021-09-17 14:34: 0.018 XMR
+- 2021-10-01 06:23: 0.000000002137 XMR
+- 2021-10-02 19:16: 1 XMR (Special thanks for this very generous donation)
+- 2021-10-17 15:40: 0.02 XMR
+- 2021-10-18 16:06: 0.1958 XMR
+- 2021-11-12 20:42: 0.02 XMR
+- 2021-11-14 18:28: 0.018 XMR
+- 2021-12-03 21:38: 0.10134722595 XMR
+- 2021-12-16 01:16: 1 XMR (Special thanks for this very generous donation)
+- 2021-12-16 18:06: 0.017 XMR
+- 2022-01-09 17:54: 0.045918219893 XMR
+- 2022-01-15 17:35: 0.014 XMR
+- 2022-01-24 21:08: 0.010786 XMR
+- 2022-01-26 12:07: 0.010391 XMR
+- 2022-02-03 19:59: 0.013013984 XMR
+- 2022-02-18 17:27: 0.019 XMR
+- 2022-03-14 10:25: 0.0139887 XMR
+- 2022-07-30 03:51: 0.0222 XMR
+- 2022-09-28 05:13: 2 XMR
+- 2022-08-19: SimpleLogin.io Lifetime Premium
+- 2022-09-19: 0.345024603905 XMR (Special thanks to a previous maintainer)
+
+#### Spendings log
+
+- 2021-03-12: 0.08181086 XMR (+fees) for domain anonymousplanet.org (1 year)
+- 2021-03-16: 1.20179 mBTC (+fees) for domain anonymousplanet.org renewal (extension 3 years totalling 4 years)
+- 2021-04-01: 0.8317 XMR (+fees) for basic VPS for Tor Mirror hosting
+- 2021-04-05: 0.99367 mBTC (+fees +exchange from XMR to BTC) for Mail Hosting (1 year): **Lost**
+- 2021-04-13: 0.71895 mBTC (+fees +exchange from XMR to BTC) for Mail Hosting (extension to 2 years): **Lost**
+- 2021-04-25: 0.02892 mBTC (Wallet to Wallet transfer fee)
+- 2021-07-13: 0.78463 mBTC (+fees +exchange from BTC to XMR) for consolidation
+- 2021-07-13: 0.067261698061 XMR (+fees) for a Tor Exit Node (01) Hosting (3 months): **Lost**
+- 2021-07-15: 0.151959953047 XMR (+fees) for a Tor Exit Node (02) Hosting (6 months): **Lost**
+- 2021-08-16: 0.253331471239 XMR (+fees) for a Tor Exit Node (03) Hosting (12 months): **Lost**
+- 2021-08-18: AtomicSwap conversion from remaining mBTC (-0.56588) to XMR (+0.081904862179)
+- 2021-08-19: 0.0644 XMR (+fees) for Mail Hosting extension: **Lost**
+- 2021-09-18: 0.246971511836 XMR (+fees) for renewal 1 year of Tor Exit Node 01: **Lost**
+- 2021-10-04: 0.26954 XMR (+fees) for domain anonymousplanet.org extension until 2029
+- 2021-10-06: 0.236073464623 XMR (+fees) for a Tor Exit Node (04) Hosting (12 months): **Lost**
+- 2021-10-18: 0.01952 XMR (+fees) for testing a new VPS hosting provider (Privex.io) for one month: **Ended**
+- 2021-10-30: 0.240787814495 XMR (+fees) for a Synapse Hosting VPS (12 months) with bots to help grow the community. This is a test program that will be converted into a Tor Exit Node in case of failure: **Lost**
+- 2022-01-01: 0.28055816111 XMR (+fees) for renewal 1 year of Tor Exit Node 02: **Lost**
+- 2022-02-02: 0.966793601024 XMR (+fees) to sponsor a special project (w/ Universal Declaration of Human Rights): **Lost**
+- 2022-07-11: 0.503232784687 XMR (+fees) for 1984.is VPS (12 months): **Ended**
+- 2022-09-19: 0.345024603905 XMR (+fees) for upgrading VPS RAM/Disk: **Ended**
+
+[1]: ../media/monero.png
+[2]: ../media/bitcoin-segwit.png
+[3]: ../media/bitcoin-legacy.png
diff --git a/docs/guide/index.md b/docs/guide/index.md
index 20c42c8..7cd80f0 100644
--- a/docs/guide/index.md
+++ b/docs/guide/index.md
@@ -17,32 +17,32 @@ schema:
There are several ways you could read this guide:
-1. **You want to understand the current state of online privacy and anonymity, not necessarily get too technical about it.**
- - Read the [Introduction](#introduction), [Requirements](#requirements-limitations), understanding some basics beginning with [your network](#your-network), and [the final notes](#a-small-final-editorial-note).
+1. **You want to understand the current state of online privacy and anonymity, not necessarily get too technical about it.**
+ - Read the [Introduction](#introduction), [Requirements](#requirements-limitations), understanding some basics beginning with [your network](#your-network), and [the final notes](#a-small-final-editorial-note).
-2. **You want to do the above but also learn how to remove some online information about you.**
- - All of the items in no. 1 and [how to clean your identities from search engines and other platforms](#removing-your-identities-from-search-engines-and-other-platforms) to get a good idea of how to clean your data off the web.
+2. **You want to do the above but also learn how to remove some online information about you.**
+ - All of the items in no. 1 and [how to clean your identities from search engines and other platforms](#removing-your-identities-from-search-engines-and-other-platforms) to get a good idea of how to clean your data off the web.
-3. **You want to do the above and create online anonymous identities online safely and securely.**
- - Read the whole thing. A specific list of the most vital things to read in the guide will be coming later, but you shoudl read the whole thing.
+3. **You want to do the above and create online anonymous identities online safely and securely.**
+ - Read the whole thing. A specific list of the most vital things to read in the guide will be coming later, but you should read the whole thing.
Precautions while reading this guide and accessing the various links:
-- **Documents/Files** have a **[Archive.org]** link next to them for accessing content through Archive.org for increased privacy and in case the content goes missing. Some links are not yet archived or outdated on archive.org in which case we encourage you to ask for a new save if possible.
+- **Documents/Files** have a **[Archive.org]** link next to them for accessing content through Archive.org for increased privacy and in case the content goes missing. Some links are not yet archived or outdated on archive.org in which case we encourage you to ask for a new save if possible.
-- **YouTube Videos** have a **[Invidious]** link next to them for accessing content through an Invidious Instance (in this case yewtu.be hosted in the Netherlands) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://github.com/iv-org/invidious) for more information.
+- **YouTube Videos** have a **[Invidious]** link next to them for accessing content through an Invidious Instance (in this case yewtu.be hosted in the Netherlands) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://github.com/iv-org/invidious) for more information.
-- **Twitter** links have a **[Nitter]** link next to them for accessing content through a Nitter Instance (in this case nitter.net) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://github.com/zedeus/nitter) for more information.
+- **Twitter** links have a **[Nitter]** link next to them for accessing content through a Nitter Instance (in this case nitter.net) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://github.com/zedeus/nitter) for more information.
-- **Wikipedia** links have a **[Wikiless]** link next to them for accessing content through a Wikiless Instance (in this case Wikiless.org) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://codeberg.org/orenom/wikiless) for more information.
+- **Wikipedia** links have a **[Wikiless]** link next to them for accessing content through a Wikiless Instance (in this case Wikiless.org) for increased privacy. It is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://codeberg.org/orenom/wikiless) for more information.
-- **Medium** links have **[Scribe.rip]** link next to them for accessing content through a Scribe.rip Instance for increased privacy. Again, it is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://scribe.rip/) for more information.
+- **Medium** links have **[Scribe.rip]** link next to them for accessing content through a Scribe.rip Instance for increased privacy. Again, it is recommended to use these links when possible. See [[Archive.org]](https://web.archive.org/web/https://scribe.rip/) for more information.
You could also install the [LibRedirect](https://libredirect.github.io/) extension on your browser to ease the redirects. [[Archive.org]](https://web.archive.org/web/20220509220021/https://libredirect.github.io/):
-- Firefox:
+- Firefox:
-- Chromium-based browsers (Chrome, Brave, Edge):
+- Chromium-based browsers (Chrome, Brave, Edge):
**If you are having trouble accessing any of the many academic articles referenced in this guide due to paywalls, feel free to use Sci-Hub (** [[Wikiless]](https://wikiless.org/wiki/Sci-Hub) [[Archive.org]](https://web.archive.org/web/https://en.wikipedia.org/wiki/Sci-Hub)**) or LibGen (** [[Wikiless]](https://wikiless.org/wiki/Library_Genesis) [[Archive.org]](https://web.archive.org/web/https://en.wikipedia.org/wiki/Library_Genesis)**) for finding and reading them. Because Science should be free. All of it. If you are faced with a paywall accessing some resources, consider using .**
@@ -50,31 +50,31 @@ Finally note that this guide does mention and even recommends various commercial
## Requirements & Limitations
-- Understanding of the English language (in this case American English).
+- Understanding of the English language (in this case American English).
-- Be a permanent resident in Germany where the courts have upheld the legality of not using real names on online platforms (§13 VI of the German Telemedia Act of 2007[^1]'[^2]). **Alternatively, be a resident of any other country where you can confirm and verify the legality of this guide yourself.**
+- Be a permanent resident in Germany where the courts have upheld the legality of not using real names on online platforms (§13 VI of the German Telemedia Act of 2007[^1]'[^2]). **Alternatively, be a resident of any other country where you can confirm and verify the legality of this guide yourself.**
-- This guide will assume you already have access to some (Windows/Linux/macOS) laptop computer - ideally not a work/shared device - and a basic understanding of how computers work.
+- This guide will assume you already have access to some (Windows/Linux/macOS) laptop computer - ideally not a work/shared device - and a basic understanding of how computers work.
-- Have patience, as this process could take several weeks to complete if you want to go through all the content.
+- Have patience, as this process could take several weeks to complete if you want to go through all the content.
-- Have some free time on your hands to dedicate to this process (depending on which route you pick).
+- Have some free time on your hands to dedicate to this process (depending on which route you pick).
-- Be prepared to read a lot of references (do read them), guides (do not skip them), and tutorials thoroughly (do not skip them either).
+- Be prepared to read a lot of references (do read them), guides (do not skip them), and tutorials thoroughly (do not skip them either).
-- Don't be evil (for real this time)[^3].
+- Don't be evil (for real this time)[^3].
-- Understand that there is no common path that will be both quick and easy.
+- Understand that there is no common path that will be both quick and easy.
This guide is not intended for:
-- Creating bot accounts of any kind.
+- Creating bot accounts of any kind.
-- Creating impersonation accounts of existing people (such as identity theft).
+- Creating impersonation accounts of existing people (such as identity theft).
-- Helping malicious actors conduct unethical, criminal, or illicit activities (such as trolling, stalking, disinformation, misinformation, harassment, bullying, or fraud).
+- Helping malicious actors conduct unethical, criminal, or illicit activities (such as trolling, stalking, disinformation, misinformation, harassment, bullying, or fraud).
-- Use by minors.
+- Use by minors.
## Introduction
@@ -88,9 +88,9 @@ This guide aims to provide an introduction to various de-anonymization technique
It is important to understand that the purpose of this guide is anonymity and not just privacy but much of the guidance you will find here will also help you improve your privacy and security even if you are not interested in anonymity. There is an important overlap in techniques and tools used for privacy, security, and anonymity but they differ at some point:
-- **Privacy is about people knowing who you are but not knowing what you are doing.**
+- **Privacy is about people knowing who you are but not knowing what you are doing.**
-- **Anonymity is about people knowing what you are doing but not knowing who you are** [^8]**.**
+- **Anonymity is about people knowing what you are doing but not knowing who you are** [^8]**.**

@@ -120,27 +120,17 @@ If you want to go deeper into threat modeling, see [Appendix B3: Threat modeling
You might think this guide has no legitimate use but there are many[^16]'[^17]'[^18]'[^19]'[^20]'[^21]'[^22] such as:
-- Evading Online Censorship[^23]
+- Evading Online Censorship[^23]
+- Evading Online Oppression
+- Evading Online Stalking, Doxxing, and Harassment
+- Evading Online Unlawful Government Surveillance
+- Anonymous Online Whistle Blowing
+- Anonymous Online Activism
+- Anonymous Online Journalism
+- Anonymous Online Legal Practice
+- Anonymous Online Academic Activities (e.g., accessing country-blocked scientific research)
-- Evading Online Oppression
-
-- Evading Online Stalking, Doxxing, and Harassment
-
-- Evading Online Unlawful Government Surveillance
-
-- Anonymous Online Whistle Blowing
-
-- Anonymous Online Activism
-
-- Anonymous Online Journalism
-
-- Anonymous Online Legal Practice
-
-- Anonymous Online Academic Activities (For instance accessing scientific research where such resources are blocked). See note below.
-
-- ...
-
-This guide is written with hope for those **good-intended individuals** who might not be knowledgeable enough to consider the big picture of online anonymity and privacy.
+This guide is written with hope for those **good-intended individuals** who might not be knowledgeable enough to consider the big picture.
**Lastly, use it at your own risk. Anything in here is not legal advice and you should verify compliance with your local law before use (IANAL**[^24]**). "Trust but verify"**[^25] **all the information yourself (or even better, "Never Trust, always verify"**[^391]**). We strongly encourage you to inform yourself and do not hesitate to check any information in this guide with outside sources in case of doubt. Please do report any mistake you spot to us as we welcome criticism. Even harsh but sound criticism is welcome and will result in having the necessary corrections made as quickly as possible.**
@@ -158,49 +148,49 @@ Needless to say, that most platforms (such as social networks) will also keep (s
Here are some online resources you can use to find some information about your current **public IP** right now:
-- Find your IP:
+- Find your IP:
- -
+ -
- - (Bonus, check your IP for DNS leaks)
+ - (Bonus, check your IP for DNS leaks)
-- Find your IP location or the location of any IP:
+- Find your IP location or the location of any IP:
- -
+ -
-- Find if an IP is "suspicious" (in blacklists) or has downloaded "things" on some public resources:
+- Find if an IP is "suspicious" (in blacklists) or has downloaded "things" on some public resources:
- -
+ -
- -
+ -
- - (Take this with a grain of salt, it might not show anything interesting and has limited data sources. This is more for fun than anything serious.)
+ - (Take this with a grain of salt, it might not show anything interesting and has limited data sources. This is more for fun than anything serious.)
-- Registration information of an IP (most likely your ISP or the ISP of your connection who most likely know who is using that IP at any time):
+- Registration information of an IP (most likely your ISP or the ISP of your connection who most likely know who is using that IP at any time):
- -
+ -
-- Check for open-services or open devices on an IP (especially if there are leaky Smart Devices on it):
+- Check for open-services or open devices on an IP (especially if there are leaky Smart Devices on it):
- - (replace the IP by your IP or any other, or change in the search box, this example IP is a Tor Exit node)
+ - (replace the IP by your IP or any other, or change in the search box, this example IP is a Tor Exit node)
-- Various tools to check your IP such as block-lists checkers and more:
+- Various tools to check your IP such as block-lists checkers and more:
- -
+ -
- -
+ -
-- Would you like to know if you are connected through Tor?
+- Would you like to know if you are connected through Tor?
- -
+ -
For those reasons, you will need to obfuscate and hide that origin IP (the one tied to your identification) or hide it through a combination of various means:
-- Using a public Wi-Fi service (free).
+- Using a public Wi-Fi service (free).
-- Using the Tor Anonymity Network[^28] (free).
+- Using the Tor Anonymity Network[^28] (free).
-- Using VPN[^29] services anonymously (anonymously paid with cash or Monero).
+- Using VPN[^29] services anonymously (anonymously paid with cash or Monero).
Do note that, unfortunately, these solutions are not perfect, and you will experience performance issues[^30].
@@ -232,27 +222,27 @@ Unfortunately, the TLS protocol used in most HTTPS connections in most Browsers
In addition to limited browser support, only web Services and CDNs[^43] behind Cloudflare CDN support ECH/eSNI at this stage[^44]. This means that ECH and eSNI are not supported (as of the writing of this guide) by most mainstream platforms such as:
-- Amazon (including AWS, Twitch...)
+- Amazon (including AWS, Twitch...)
-- Microsoft (including Azure, OneDrive, Outlook, Office 365...)
+- Microsoft (including Azure, OneDrive, Outlook, Office 365...)
-- Google (including Gmail, Google Cloud...)
+- Google (including Gmail, Google Cloud...)
-- Apple (including iCloud, iMessage...)
+- Apple (including iCloud, iMessage...)
-- Reddit
+- Reddit
-- YouTube
+- YouTube
-- Facebook
+- Facebook
-- Instagram
+- Instagram
-- Twitter
+- Twitter
-- GitHub
+- GitHub
-- ...
+- ...
Some countries like Russia[^45] and China[^46] might (unverified despite the articles) block ECH/eSNI handshakes at the network level to allow snooping and prevent bypassing censorship. Meaning you will not be able to establish an HTTPS connection with a service if you do not allow them to see what it was.
@@ -264,14 +254,14 @@ Here is an illustration of the issue you could encounter on Firefox-based browse

-Finally, even if you use a custom encrypted DNS server (DoH or DoT) with ECH/eSNI support and OCSP stapling, it might still not be enough as traffic analysis studies[^52] have shown it is still possible to reliably fingerprint and block unwanted requests. Only DNS over Tor was able to show efficient DNS Privacy in recent studies but even that can still be defeated by other means (see [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]).
+Finally, even if you use a custom encrypted DNS server (DoH or DoT) with ECH/eSNI support and OCSP stapling, it might still not be enough as traffic analysis studies[^52] have shown it is still possible to reliably fingerprint and block unwanted requests. Only DNS over Tor was able to show efficient DNS Privacy in recent studies but even that can still be defeated by other means (see [Your Anonymized Tor/VPN traffic](#traffic-anonymization).
One could also decide to use a Tor Hidden DNS Service or ODoH (Oblivious DNS over HTTPS[^53]) to further increase privacy/anonymity but **unfortunately**, as far as we know, these methods are only provided by Cloudflare as of this writing ( [[Archive.org]](https://web.archive.org/web/https://blog.cloudflare.com/welcome-hidden-resolver/), [[Archive.org]](https://web.archive.org/web/https://blog.cloudflare.com/oblivious-dns/)). These are workable and reasonably secure technical options but there is also a moral choice if you want to use Cloudflare or not (despite the risk posed by some researchers[^54]).
**Note that Oblivious DNS addresses an adversary that eavesdrops on one of the connections listed here but not all. It does not address a global passive adversary (GPA) who can eavesdrop on many or all of these connections**:
-- traffic between the client resolver and the recursive resolver
-- the recursive resolver and the ODNS resolver
-- the ODNS resolver and an authoritative server.
+- traffic between the client resolver and the recursive resolver
+- the recursive resolver and the ODNS resolver
+- the ODNS resolver and an authoritative server.
Lastly, there is also this new possibility called DoHoT which stands for DNS over HTTPS over Tor which could also further increase your privacy/anonymity and which you could consider if you are more skilled with Linux. See [[Archive.org]](https://web.archive.org/web/https://github.com/alecmuffett/dohot). This guide will not help you with this one at this stage, but it might be coming soon.
@@ -283,7 +273,7 @@ As for your normal daily use (non-sensitive), remember that only Firefox-based b
But the story does not stop there right. Now because after all this, even if you encrypt your DNS and use all possible mitigations. Simple IP requests to any server will probably allow an adversary to still detect which site you are visiting. And this is simply because the majority of websites have unique IPs tied to them as explained here: [[Archive.org]](https://web.archive.org/web/https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an-ip-address/). This means that an adversary can create a dataset of known websites for instance including their IPs and then match this dataset against the IP you ask for. In most cases, this will result in a correct guess of the website you are visiting. This means that despite OCSP stapling, despite ECH/eSNI, despite using Encrypted DNS ... An adversary can still guess the website you are visiting anyway.
-Therefore, to mitigate all these issues (as much as possible and as best as we can), this guide will later recommend two solutions: Using Tor and a virtualized (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) multi-layered solution of VPN over Tor solution (DNS over VPN over Tor or DNS over TOR). Other options will also be explained (Tor over VPN, VPN only, No Tor/VPN) but are less recommended.
+Therefore, to mitigate all these issues (as much as possible and as best as we can), this guide will later recommend two solutions: Using Tor and a virtualized (See [Appendix W: Virtualization](#appendix-w-virtualization)) multi-layered solution of VPN over Tor solution (DNS over VPN over Tor or DNS over TOR). Other options will also be explained (Tor over VPN, VPN only, No Tor/VPN) but are less recommended.
### Your RFID enabled devices
@@ -291,23 +281,14 @@ RFID stands for Radio-frequency identification[^55], it is the technology used f
But unfortunately, this is not limited to your smartphone, and you also probably carry some amount of RFID enabled device with you all the time such as:
-- Your contactless-enabled credit/debit cards
-
-- Your store loyalty cards
-
-- Your transportation payment cards
-
-- Your work-related access cards
-
-- Your car keys
-
-- Your national ID or driver license
-
-- Your passport
-
-- The price/anti-theft tags on object/clothing
-
-- ...
+- Your contactless-enabled credit/debit cards
+- Your store loyalty cards
+- Your transportation payment cards
+- Your work-related access cards
+- Your car keys
+- Your national ID or driver license
+- Your passport
+- The price/anti-theft tags on object/clothing
While all these cannot be used to de-anonymize you from a remote online adversary, they can be used to narrow down a search if your approximate location at a certain time is known. For instance, you cannot rule out that some stores will effectively scan (and log) all RFID chips passing through the door. They might be looking for their loyalty cards but are also logging others along the way. Such RFID tags could be traced to your identity and allow for de-anonymization.
@@ -315,7 +296,7 @@ More information over at Wikipedia:
+- HOPE 2020,
-- YouTube, Hak5, Wi-Fi Pineapple Mark VII [[Invidious]](https://yewtu.be/watch?v=7v3JR4Wlw4Q)
+- YouTube, Hak5, Wi-Fi Pineapple Mark VII [[Invidious]](https://yewtu.be/watch?v=7v3JR4Wlw4Q)
These devices can fit in a small bag and can take over the Wi-Fi environment of any place within their range. For instance, a Bar/Restaurant/Café/Hotel Lobby. These devices can force Wi-Fi clients to disconnect from their current Wi-Fi (using de-authentication, disassociation attacks[^66]) while spoofing the normal Wi-Fi networks at the same location. They will continue to perform this attack until your computer, or you decide to try to connect to the rogue AP.
@@ -361,7 +342,7 @@ Once you are connected through the Rogue AP, this AP will be able to execute var
This can be useful when you know someone you want to de-anonymize is in a crowded place, but you do not know who. This would allow such an adversary to possibly fingerprint any website you visit despite the use of HTTPS, DoT, DoH, ODoH, VPN, or Tor using traffic analysis as pointed above in the DNS section.
-These can also be used to carefully craft and serve you advanced phishing webpages that would harvest your credentials or try to make you install a malicious certificate allowing them to see your encrypted traffic.
+These techniques can also be employed to design sophisticated phishing websites aimed at capturing your credentials or persuading you to install a malicious certificate. Such a certificate could enable attackers to intercept and decrypt your encrypted traffic.
How to mitigate those? If you do connect to a public wi-fi access point, use Tor, or use a VPN and then Tor (Tor over VPN) or even (VPN over Tor) to obfuscate your traffic from the rogue AP while still using it.
@@ -371,29 +352,29 @@ In addition, you should see the BlackHat USA conference talk, [Surveilling the M
Tor and VPNs are not silver bullets. Many advanced techniques have been developed and studied to de-anonymize encrypted Tor traffic over the years[^68]. Most of those techniques are Correlation attacks that will correlate your network traffic in one way or another to logs or datasets. Here are some examples:
-- **Correlation Fingerprinting Attack:** As illustrated (simplified) below, this attack will fingerprint your encrypted Tor traffic (like the websites you visited) based on the analysis of your encrypted traffic without decrypting it. Some of those methods can do so with a 96% success rate **in a closed-world setting**. **The efficacy of those methods in a real open-world setting** **has not been demonstrated yet and would probably require tremendous resources computing power making it very unlikely that such techniques would be used by a local adversary in the near future.** Such techniques could however hypothetically be used by an advanced and probably global adversary with access to your source network to determine some of your activity. Examples of those attacks are described in several research papers[^69]'[^70]'[^71] as well as their limitations[^72]. The Tor Project itself published an article about these attacks with some mitigations: [[Archive.org]](https://web.archive.org/web/https://blog.torproject.org/new-low-cost-traffic-analysis-attacks-mitigations).
+- **Correlation Fingerprinting Attack:** As illustrated (simplified) below, this attack will fingerprint your encrypted Tor traffic (like the websites you visited) based on the analysis of your encrypted traffic without decrypting it. Some of those methods can do so with a 96% success rate **in a closed-world setting**. **The efficacy of those methods in a real open-world setting** **has not been demonstrated yet and would probably require tremendous resources computing power making it very unlikely that such techniques would be used by a local adversary in the near future.** Such techniques could however hypothetically be used by an advanced and probably global adversary with access to your source network to determine some of your activity. Examples of those attacks are described in several research papers[^69]'[^70]'[^71] as well as their limitations[^72]. The Tor Project itself published an article about these attacks with some mitigations: [[Archive.org]](https://web.archive.org/web/https://blog.torproject.org/new-low-cost-traffic-analysis-attacks-mitigations).

-- **Correlation Timing Attacks:** As illustrated (simplified) below, an adversary that has access to network connection logs (IP or DNS for instance, remember that most VPN servers and most Tor nodes are known and publicly listed) at the source and the destination could correlate the timings to de-anonymize you without requiring any access to the Tor or VPN network in between. A real use case of this technique was done by the FBI in 2013 to de-anonymize[^73] a bomb threat hoax at Harvard University.
+- **Correlation Timing Attacks:** As illustrated (simplified) below, an adversary that has access to network connection logs (IP or DNS for instance, remember that most VPN servers and most Tor nodes are known and publicly listed) at the source and the destination could correlate the timings to de-anonymize you without requiring any access to the Tor or VPN network in between. A real use case of this technique was done by the FBI in 2013 to de-anonymize[^73] a bomb threat hoax at Harvard University.

-- **Correlation Counting Attacks:** As illustrated (simplified) below, an adversary that has no access to detailed connection logs (cannot see that you used Tor or Netflix) but has access to data counting logs could see that you have downloaded 600MB on a specific time/date that matches the 600MB upload at the destination. This correlation can then be used to de-anonymize you over time.
+- **Correlation Counting Attacks:** As illustrated (simplified) below, an adversary that has no access to detailed connection logs (cannot see that you used Tor or Netflix) but has access to data counting logs could see that you have downloaded 600MB on a specific time/date that matches the 600MB upload at the destination. This correlation can then be used to de-anonymize you over time.

There are ways to mitigate these such as:
-- Do not use Tor/VPNs to access services that are on the same network (ISP) as the destination service. For example, do not connect to Tor from your University Network to access a University Service anonymously. Instead, use a different source point (such as a public Wi-Fi) that cannot be correlated easily by an adversary.
+- Do not use Tor/VPNs to access services that are on the same network (ISP) as the destination service. For example, do not connect to Tor from your University Network to access a University Service anonymously. Instead, use a different source point (such as a public Wi-Fi) that cannot be correlated easily by an adversary.
-- Do not use Tor/VPN from an obviously heavily monitored network (such as a corporate/governmental network) but instead try to find an unmonitored network such as a public Wi-Fi or a residential Wi-Fi.
+- Do not use Tor/VPN from an obviously heavily monitored network (such as a corporate/governmental network) but instead try to find an unmonitored network such as a public Wi-Fi or a residential Wi-Fi.
-- Consider the use of multiple layers (such as what will be recommended in this guide later: VPN over Tor) so that an adversary might be able to see that someone connected to the service through Tor but will not be able to see that it was you because you were connected to a VPN and not the Tor Network.
+- Consider the use of multiple layers (such as what will be recommended in this guide later: VPN over Tor) so that an adversary might be able to see that someone connected to the service through Tor but will not be able to see that it was you because you were connected to a VPN and not the Tor Network.
Be aware again that this might not be enough against a motivated global adversary[^74] with wide access to global mass surveillance. Such an adversary might have access to logs no matter where you are and could use those to de-anonymize you. Usually, these attacks are part of what is called a Sybil Attack[^75]. **These adversaries are out of the scope of this guide.**
-Be also aware that all the other methods described in this guide such as Behavioral analysis can also be used to deanonymize Tor users indirectly (see further [Your Digital Footprint](#your-digital-footprint).
+Be also aware that all the other methods described in this guide such as Behavioral analysis can also be used to deanonymize Tor users indirectly (also see [Your Digital Footprint](#your-digital-footprint).
I also strongly recommend reading this very good, complete, and thorough (and more detailed) guide on most known Attack Vectors on Tor: [[Archive.org]](https://web.archive.org/web/https://github.com/Attacks-on-Tor/Attacks-on-Tor) as well as this recent research publication [[Archive.org]](https://web.archive.org/web/https://www.researchgate.net/publication/323627387_Shedding_Light_on_the_Dark_Corners_of_the_Internet_A_Survey_of_Tor_Research)
@@ -407,22 +388,21 @@ This guide will later propose some mitigations to such attacks by changing your
**Disclaimer: it should also be noted that Tor is not designed to protect against a global adversary. For more information see [[Archive.org]](https://web.archive.org/web/https://svn-archive.torproject.org/svn/projects/design-paper/tor-design.pdf) and specifically, "Part 3. Design goals and assumptions.".**
-
### Some Devices can be tracked even when offline
You have seen this in action/spy/Sci-Fi movies and shows, the protagonists always remove the battery of their phones to make sure it cannot be used. Most people would think that's overkill. Well, unfortunately, no, this is now becoming true at least for some devices:
-- iPhones and iPads (IOS 13 and above)[^78]'[^79]
+- iPhones and iPads (IOS 13 and above)[^78]'[^79]
-- Samsung Phones (Android 10 and above)[^80]
+- Samsung Phones (Android 10 and above)[^80]
-- MacBooks (macOS 10.15 and above)[^81]
+- MacBooks (macOS 10.15 and above)[^81]
Such devices will continue to broadcast identity information to nearby devices even when offline using Bluetooth Low-Energy[^82]. They do not have access to the devices directly (which are not connected to the internet) but instead use BLE to find them through other nearby devices[^83]. They are using peer-to-peer short-range Bluetooth communication to broadcast their status through nearby online devices.
They could now find such devices and keep the location in some database that could then be used by third parties or themselves for various purposes (including analytics, advertising, or evidence/intelligence gathering).
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
TLDR: Do not take such devices with you when conducting sensitive activities.
@@ -440,23 +420,23 @@ Today, giving away your (real) phone number is the same or better than giving aw
The IMEI and IMSI can be traced back to you in at least six ways:
-- The mobile operator subscriber logs will usually store the IMEI along with the IMSI and their subscriber information database. If you use a prepaid anonymous SIM (anonymous IMSI but with a known IMEI), they could see this cell belongs to you if you used that cell phone before with a different SIM card (different anonymous IMSI but same known IMEI).
+- The mobile operator subscriber logs will usually store the IMEI along with the IMSI and their subscriber information database. If you use a prepaid anonymous SIM (anonymous IMSI but with a known IMEI), they could see this cell belongs to you if you used that cell phone before with a different SIM card (different anonymous IMSI but same known IMEI).
-- The mobile operator antenna logs will conveniently keep a log of which IMEI. IMSI also keep some connection data. They know and log for instance that a phone with this IMEI/IMSI combination connected to a set of mobile antennas and how powerful the signal to each of those antennas were, allowing easy triangulation/geolocation of the signal. They also know which other phones (your real one for instance) connected at the same time to the same antennas with the same signal. This makes it possible to know precisely that this "burner phone" was always connected at the same place/time than this other "known phone" which shows up every time the burner phone is being used. This information can/is used by various third parties to geolocate/track you quite precisely[^89]'[^90].
+- The mobile operator antenna logs will conveniently keep a log of which IMEI. IMSI also keep some connection data. They know and log for instance that a phone with this IMEI/IMSI combination connected to a set of mobile antennas and how powerful the signal to each of those antennas were, allowing easy triangulation/geolocation of the signal. They also know which other phones (your real one for instance) connected at the same time to the same antennas with the same signal. This makes it possible to know precisely that this "burner phone" was always connected at the same place/time than this other "known phone" which shows up every time the burner phone is being used. This information can/is used by various third parties to geolocate/track you quite precisely[^89]'[^90].
-- The manufacturer of the Phone can trace back the sale of the phone using the IMEI if that phone was bought in a non-anonymous way. Indeed, they will have logs of each phone sale (including serial number and IMEI), to which shop/person to whom it was sold. And if you are using a phone that you bought online (or from someone that knows you). It can be traced to you using that information. Even if they do not find you on CCTV[^91] and you bought the phone using cash, they can still find what other phone (your real one in your pocket) was there (in that shop) at that time/date by using the antenna logs.
+- The manufacturer of the Phone can trace back the sale of the phone using the IMEI if that phone was bought in a non-anonymous way. Indeed, they will have logs of each phone sale (including serial number and IMEI), to which shop/person to whom it was sold. And if you are using a phone that you bought online (or from someone that knows you). It can be traced to you using that information. Even if they do not find you on CCTV[^91] and you bought the phone using cash, they can still find what other phone (your real one in your pocket) was there (in that shop) at that time/date by using the antenna logs.
-- The IMSI alone can be used to find you as well because most countries now require customers to provide an ID when buying a SIM card (subscription or pre-paid). The IMSI is then tied to the identity of the buyer of the card. In the countries where the SIM can still be bought with cash (like the UK), they still know where (which shop) it was bought and when. This information can then be used to retrieve information from the shop itself (such as CCTV footage as for the IMEI case). Or again the antenna logs can also be used to figure out which other phone was there at the moment of the sale.
+- The IMSI alone can be used to find you as well because most countries now require customers to provide an ID when buying a SIM card (subscription or pre-paid). The IMSI is then tied to the identity of the buyer of the card. In the countries where the SIM can still be bought with cash (like the UK), they still know where (which shop) it was bought and when. This information can then be used to retrieve information from the shop itself (such as CCTV footage as for the IMEI case). Or again the antenna logs can also be used to figure out which other phone was there at the moment of the sale.
-- The smartphone OS makers (Google/Apple for Android/IOs) also keep logs of IMEI/IMSI identifications tied to Google/Apple accounts and which user has been using them. They too can trace back the history of the phone and to which accounts it was tied in the past[^92].
+- The smartphone OS makers (Google/Apple for Android/IOs) also keep logs of IMEI/IMSI identifications tied to Google/Apple accounts and which user has been using them. They too can trace back the history of the phone and to which accounts it was tied in the past[^92].
-- Government agencies around the world interested in your phone number can and do use[^93] special devices called "IMSI catchers"[^94] like the Stingray[^95] or more recently the Nyxcell[^96]. These devices can impersonate (to spoof) a cell phone Antenna and force a specific IMSI (your phone) to connect to it to access the cell network. Once they do, they will be able to use various MITM[^97] (Man-In-The-Middle Attacks) that will allow them to:
+- Government agencies around the world interested in your phone number can and do use[^93] special devices called "IMSI catchers"[^94] like the Stingray[^95] or more recently the Nyxcell[^96]. These devices can impersonate (to spoof) a cell phone Antenna and force a specific IMSI (your phone) to connect to it to access the cell network. Once they do, they will be able to use various MITM[^97] (Man-In-The-Middle Attacks) that will allow them to:
- - Tap your phone (voice calls and SMS).
+ - Tap your phone (voice calls and SMS).
- - Sniff and examine your data traffic.
+ - Sniff and examine your data traffic.
- - Impersonate your phone number without controlling your phone.
+ - Impersonate your phone number without controlling your phone.
Here is also a good YouTube video on this topic: DEFCON Safe Mode - Cooper Quintin - Detecting Fake 4G Base Stations in Real-Time [[Invidious]](https://yewtu.be/watch?v=siCk4pGGcqA)
@@ -464,7 +444,7 @@ Here is also a good YouTube video on this topic: DEFCON Safe Mode - Cooper Quint
While there are some smartphones manufacturers like Purism with their Librem series[^98] who claim to have your privacy in mind, they still do not allow IMEI randomization which we believe is a key anti-tracking feature that should be provided by such manufacturers. While this measure will not prevent IMSI tracking within the SIM card, it would at least allow you to keep the same "burner phone" and only switch SIM cards instead of having to switch both for privacy.
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
### Your Wi-Fi or Ethernet MAC address
@@ -478,7 +458,7 @@ Some commercial devices will keep a record of MAC addresses roaming around for v
**So, it is important again not to bring your phone along when/where you conduct sensitive activities. If you use your own laptop, then it is crucial to hide that MAC address (and Bluetooth address) anywhere you use it and be extra careful not to leak any information. Thankfully many recent OSes now feature or allow the possibility to randomize MAC addresses (Android, IOS, Linux, and Windows 10/11)** with the notable exception of macOS which does not support this feature even in its latest Big Sur version.
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
### Your Bluetooth MAC address
@@ -492,7 +472,7 @@ On Windows 10, you will need to disable and enable the Bluetooth device in the d
In general, this should not be too much of a concern compared to MAC Addresses. BT Addresses are randomized quite often.
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
## Your CPU
@@ -506,13 +486,13 @@ There are some not so straightforward ways[^107] to disable the Intel IME on som
Note that, to AMD's defense, there were no security vulnerabilities found for ASP and no backdoors either. See [[Invidious]](https://yewtu.be/watch?v=bKH5nGLgi08&t=2834s). In addition, AMD PSP does not provide any remote management capabilities contrary to Intel IME.
-If you are feeling a bit more adventurous, you could install your own BIOS using Coreboot [^108] or Libreboot (a distribution of Coreboot) if your laptop supports it. Coreboot allows users to add their own microcode or other firmware blobs in order for the machine to function, but this is based upon user choice, and as of Dec 2022, Libreboot has adopted a similar pragmatic approach in order to support newer devices in the Coreboot tree. (Thanks, kind Anon who corrected previous information in this paragraph.)
+If you are feeling a bit more adventurous, you could install your own BIOS using Coreboot[^108] or Libreboot (a distribution of Coreboot) if your laptop supports it. Coreboot allows users to add their own microcode or other firmware blobs in order for the machine to function, but this is based upon user choice, and as of Dec 2022, Libreboot has adopted a similar pragmatic approach in order to support newer devices in the Coreboot tree. (Thanks, kind Anon who corrected previous information in this paragraph.)
Check yourself:
-- If you are using Linux you can check the vulnerability status of your CPU to Spectre/Meltdown attacks by using [[Archive.org]](https://web.archive.org/web/https://github.com/speed47/spectre-meltdown-checker) which is available as a package for most Linux distros including Whonix. Spectre is a transient execution attack. There is also PoC code for Spectre v1 and v2 on iPhone devices here: [[Archive.org]](https://web.archive.org/web/20220814122148/https://github.com/cispa/BranchDifferent) and here [[Archive.org]](https://web.archive.org/web/20220814122652/https://misc0110.net/files/applespectre_dimva22.pdf)
+- If you are using Linux you can check the vulnerability status of your CPU to Spectre/Meltdown attacks by using [[Archive.org]](https://web.archive.org/web/https://github.com/speed47/spectre-meltdown-checker) which is available as a package for most Linux distros including Whonix. Spectre is a transient execution attack. There is also PoC code for Spectre v1 and v2 on iPhone devices here: [[Archive.org]](https://web.archive.org/web/20220814122148/https://github.com/cispa/BranchDifferent) and here [[Archive.org]](https://web.archive.org/web/20220814122652/https://misc0110.net/files/applespectre_dimva22.pdf)
-- If you are using Windows, you can check the vulnerability status of your CPU using inSpectre [[Archive.org]](https://web.archive.org/web/https://www.grc.com/inspectre.htm)
+- If you are using Windows, you can check the vulnerability status of your CPU using inSpectre [[Archive.org]](https://web.archive.org/web/https://www.grc.com/inspectre.htm)
Some CPUs have unfixable flaws (especially Intel CPUs) that could be exploited by various malware. Here is a good current list of such vulnerabilities affecting recent widespread CPUs: [[Wikiless]](https://wikiless.org/wiki/Transient_execution_CPU_vulnerability) [[Archive.org]](https://web.archive.org/web/https://en.wikipedia.org/wiki/Transient_execution_CPU_vulnerability)
@@ -524,9 +504,21 @@ We will mitigate some of these issues in this guide by recommending the use of v
**In addition, we recommend the use of AMD CPUs instead of Intel CPUs. See [Appendix B5: Types of CPU attacks](#appendix-b5-types-of-cpu-attacks) for more information.**
-- CPU vulnerabilities found in the past few years:
+- CPU vulnerabilities found in the past few years:
- - [Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)), [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)), [Æpic](https://aepicleak.com/), [SGAxe](https://en.wikipedia.org/wiki/Software_Guard_Extensions#SGAxe), [LVI](https://en.wikipedia.org/wiki/Software_Guard_Extensions#LVI), [Plundervolt](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Plundervolt), [MicroScope replay attack](https://en.wikipedia.org/wiki/Software_Guard_Extensions#MicroScope_replay_attack), [Enclave](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Enclave_attack), [Prime+Probe](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Prime+Probe_attack), [Crosstalk](https://www.vusec.net/projects/crosstalk/), [Hertzbleed](https://en.wikipedia.org/wiki/Hertzbleed), [Squip attack](https://www.securityweek.com/amd-processors-expose-sensitive-data-new-squip-attack/), [Zenbleed](https://lock.cmpxchg8b.com/zenbleed.html)
+ - [Meltdown](https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability))
+ - [Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability))
+ - [Æpic](https://aepicleak.com/)
+ - [SGAxe](https://en.wikipedia.org/wiki/Software_Guard_Extensions#SGAxe)
+ - [LVI](https://en.wikipedia.org/wiki/Software_Guard_Extensions#LVI)
+ - [Plundervolt](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Plundervolt)
+ - [MicroScope replay attack](https://en.wikipedia.org/wiki/Software_Guard_Extensions#MicroScope_replay_attack)
+ - [Enclave](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Enclave_attack)
+ - [Prime+Probe](https://en.wikipedia.org/wiki/Software_Guard_Extensions#Prime+Probe_attack)
+ - [Crosstalk](https://www.vusec.net/projects/crosstalk/)
+ - [Hertzbleed](https://en.wikipedia.org/wiki/Hertzbleed)
+ - [Squip attack](https://www.securityweek.com/amd-processors-expose-sensitive-data-new-squip-attack/)
+ - [Zenbleed](https://lock.cmpxchg8b.com/zenbleed.html)
## Your OS and App telemetry services
@@ -534,33 +526,33 @@ Whether it is Android, iOS, Windows, macOS, or even Ubuntu. Most popular Operati
Here are good overviews of what is being collected by those five popular OSes in their last versions:
-- Android/Google:
+- Android/Google:
- - Just have a read at their privacy policy [[Archive.org]](https://web.archive.org/web/https://policies.google.com/privacy)
+ - Just have a read at their privacy policy [[Archive.org]](https://web.archive.org/web/https://policies.google.com/privacy)
- - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google [[Archive.org]](https://web.archive.org/web/https://www.scss.tcd.ie/doug.leith/apple_google.pdf)
+ - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google [[Archive.org]](https://web.archive.org/web/https://www.scss.tcd.ie/doug.leith/apple_google.pdf)
-- IOS/Apple:
+- IOS/Apple:
- - More information at [[Archive.org]](https://web.archive.org/web/https://www.apple.com/legal/privacy/en-ww/) and [[Archive.org]](https://web.archive.org/web/https://support.apple.com/en-us/HT202100)
+ - More information at [[Archive.org]](https://web.archive.org/web/https://www.apple.com/legal/privacy/en-ww/) and [[Archive.org]](https://web.archive.org/web/https://support.apple.com/en-us/HT202100)
- - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google [[Archive.org]](https://web.archive.org/web/https://www.scss.tcd.ie/doug.leith/apple_google.pdf)
+ - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google [[Archive.org]](https://web.archive.org/web/https://www.scss.tcd.ie/doug.leith/apple_google.pdf)
- - Apple does claim[^109] that they anonymize this data using differential privacy[^110] but you will have to trust them on that.
+ - Apple does claim[^109] that they anonymize this data using differential privacy[^110] but you will have to trust them on that.
-- Windows/Microsoft:
+- Windows/Microsoft:
- - Full list of required diagnostic data: [[Archive.org]](https://web.archive.org/web/https://docs.microsoft.com/en-us/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004)
+ - Full list of required diagnostic data: [[Archive.org]](https://web.archive.org/web/https://docs.microsoft.com/en-us/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004)
- - Full list of optional diagnostic data: [[Archive.org]](https://web.archive.org/web/https://docs.microsoft.com/en-us/windows/privacy/windows-diagnostic-data)
+ - Full list of optional diagnostic data: [[Archive.org]](https://web.archive.org/web/https://docs.microsoft.com/en-us/windows/privacy/windows-diagnostic-data)
-- macOS:
+- macOS:
- - More details on [[Archive.org]](https://web.archive.org/web/https://support.apple.com/guide/mac-help/share-analytics-information-mac-apple-mh27990/mac)
+ - More details on [[Archive.org]](https://web.archive.org/web/https://support.apple.com/guide/mac-help/share-analytics-information-mac-apple-mh27990/mac)
-- Ubuntu:
+- Ubuntu:
- - Ubuntu despite being a Linux distribution also collects Telemetry Data nowadays. This data however is quite limited compared to the others. More details on [[Archive.org]](https://web.archive.org/web/https://ubuntu.com/desktop/statistics)
+ - Ubuntu despite being a Linux distribution also collects Telemetry Data nowadays. This data however is quite limited compared to the others. More details on [[Archive.org]](https://web.archive.org/web/https://ubuntu.com/desktop/statistics)
Not only are Operating Systems gathering telemetry services but so are Apps themselves like Browsers, Mail Clients, and Social Networking Apps installed on your system.
@@ -570,51 +562,51 @@ This does not mean for example that Apple devices are terrible choices for good
Later in this guide, we will use all the means at our disposal to disable and block as much telemetry as possible to mitigate this attack vector in the Operating Systems supported in this guide. These will include Windows, macOS, and even Linux in some regard.
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
## Your Smart Devices
You got it; your smartphone is an advanced spying/tracking device that:
-- Records everything you say at any time ("Hey Siri", "Hey Google").
+- Records everything you say at any time ("Hey Siri", "Hey Google").
-- Records your location everywhere you go.
+- Records your location everywhere you go.
-- Always records other devices around you (Bluetooth devices, Wi-Fi Access points).
+- Always records other devices around you (Bluetooth devices, Wi-Fi Access points).
-- Records your habits and health data (steps, screen time, exposure to diseases, connected devices data)
+- Records your habits and health data (steps, screen time, exposure to diseases, connected devices data)
-- Records all your network locations.
+- Records all your network locations.
-- Records all your pictures and videos (and most likely where they were taken).
+- Records all your pictures and videos (and most likely where they were taken).
-- Has most likely access to most of your known accounts including social media, messaging, and financial accounts.
+- Has most likely access to most of your known accounts including social media, messaging, and financial accounts.
Data is being transmitted even if you opt-out[^112], processed, and stored indefinitely (most likely unencrypted[^113]) by various third parties[^114].
But that is not all, this section is not called "Smartphones" but "Smart devices" because it is not only your smartphone spying on you. It is also every other smart device you could have:
-- Your Smart Watch? (Apple Watch, Android Smartwatch ...)
+- Your Smart Watch? (Apple Watch, Android Smartwatch ...)
-- Your Fitness Devices and Apps[^115]'[^116]? (Strava[^117]'[^118], Fitbit[^119], Garmin, Polar[^120], ...)
+- Your Fitness Devices and Apps[^115]'[^116]? (Strava[^117]'[^118], Fitbit[^119], Garmin, Polar[^120], ...)
-- Your Smart Speaker? (Amazon Alexa[^121], Google Echo, Apple Homepod ...)
+- Your Smart Speaker? (Amazon Alexa[^121], Google Echo, Apple Homepod ...)
-- Your Smart Transportation? (Car? Scooter?)
+- Your Smart Transportation? (Car? Scooter?)
-- Your Smart Tags? (Apple AirTag, Galaxy SmartTag, Tile...)
+- Your Smart Tags? (Apple AirTag, Galaxy SmartTag, Tile...)
-- Your Car? (Yes, most modern cars have advanced logging/tracking features these days[^122])
+- Your Car? (Yes, most modern cars have advanced logging/tracking features these days[^122])
-- Any other Smart device? There are even convenient search engines dedicated to finding them online:
+- Any other Smart device? There are even convenient search engines dedicated to finding them online:
- -
+ -
- -
+ -
- -
+ -
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
Conclusion: Do not bring your smart devices with you when conducting sensitive activities.
@@ -638,7 +630,7 @@ Have you heard of Edward Snowden[^134]? Now is the time to google him and read h
See "We kill people based on Metadata"[^142] or this famous tweet from the IDF [[Archive.org]](https://web.archive.org/web/https://twitter.com/idf/status/1125066395010699264) [[Nitter]](https://nitter.net/idf/status/1125066395010699264).
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
### Your Digital Footprint
@@ -654,13 +646,13 @@ While these methods are usually used for marketing purposes and advertising, the
Here are some examples:
-- Specialized companies are selling to, for example, law enforcement agencies products for analyzing social network activities such as [[Archive.org]](https://web.archive.org/web/https://mediasonar.com/)
+- Specialized companies are selling to, for example, law enforcement agencies products for analyzing social network activities such as [[Archive.org]](https://web.archive.org/web/https://mediasonar.com/)
-- For example, as a basis of authentication, a user's typing speed, keystroke depressions, patterns of error (say accidentally hitting an "l" instead of a "k" on three out of every seven transactions) and mouse movements establish that person's unique pattern of behavior[^152]. Some commercial services such as TypingDNA ( [[Archive.org]](https://web.archive.org/web/https://www.typingdna.com/)) even offer such analysis as a replacement for two-factor authentications.
+- For example, as a basis of authentication, a user's typing speed, keystroke depressions, patterns of error (say accidentally hitting an "l" instead of a "k" on three out of every seven transactions) and mouse movements establish that person's unique pattern of behavior[^152]. Some commercial services such as TypingDNA ( [[Archive.org]](https://web.archive.org/web/https://www.typingdna.com/)) even offer such analysis as a replacement for two-factor authentications.
-- This technology is also widely used in CAPTCHAS[^371] services to verify that you are "human" and can be used to fingerprint a user.
+- This technology is also widely used in CAPTCHAS[^371] services to verify that you are "human" and can be used to fingerprint a user.
-- See [Appendix A4: Counteracting Forensic Linguistics].
+- See [Appendix A4: Counteracting Forensic Linguistics](#appendix-a4-counteracting-forensic-linguistics).
Analysis algorithms could then be used to match these patterns with other users and match you to a different known user. It is unclear whether such data is already used or not by Governments and Law Enforcement agencies, but it might be in the future. And while this is mostly used for advertising/marketing/captchas purposes now. It could and probably will be used for investigations in the short or mid-term future to deanonymize users.
@@ -670,35 +662,35 @@ Here is also a recent example just showing what Google Chrome collects on you: <
Here are some other resources on the topic if you cannot see this documentary:
-- 2017, Behavior Analysis in Social Networks, [[Archive.org]](https://web.archive.org/web/https://link.springer.com/10.1007/978-1-4614-7163-9_110198-1)
+- 2017, Behavior Analysis in Social Networks, [[Archive.org]](https://web.archive.org/web/https://link.springer.com/10.1007/978-1-4614-7163-9_110198-1)
-- 2017, Social Networks and Positive and Negative Affect [[Archive.today]](https://archive.ph/iuowI)
+- 2017, Social Networks and Positive and Negative Affect [[Archive.today]](https://archive.ph/iuowI)
-- 2015, Using Social Networks Data for Behavior and Sentiment Analysis [[Archive.org]](https://web.archive.org/web/https://www.researchgate.net/publication/300562034_Using_Social_Networks_Data_for_Behavior_and_Sentiment_Analysis)
+- 2015, Using Social Networks Data for Behavior and Sentiment Analysis [[Archive.org]](https://web.archive.org/web/https://www.researchgate.net/publication/300562034_Using_Social_Networks_Data_for_Behavior_and_Sentiment_Analysis)
-- 2016, A Survey on User Behavior Analysis in Social Networks [[Archive.org]](https://web.archive.org/web/https://www.academia.edu/30936118/A_Survey_on_User_Behaviour_Analysis_in_Social_Networks)
+- 2016, A Survey on User Behavior Analysis in Social Networks [[Archive.org]](https://web.archive.org/web/https://www.academia.edu/30936118/A_Survey_on_User_Behaviour_Analysis_in_Social_Networks)
-- 2017, DEF CON 25 presentation: [DEF CON 25 - Svea Eckert, Andreas Dewes - Dark Data](https://www.youtube.com/watch?v=1nvYGi7-Lxo) [[Invidious]](https://yewtu.be/watch?v=1nvYGi7-Lxo)
+- 2017, DEF CON 25 presentation: [DEF CON 25 - Svea Eckert, Andreas Dewes - Dark Data](https://www.youtube.com/watch?v=1nvYGi7-Lxo) [[Invidious]](https://yewtu.be/watch?v=1nvYGi7-Lxo)
-- 2019, Influence and Behavior Analysis in Social Networks and Social Media [[Archive.org]](https://web.archive.org/web/https://web.archive.org/web/https://sci-hub.se/10.1007/978-3-030-02592-2)
+- 2019, Influence and Behavior Analysis in Social Networks and Social Media [[Archive.org]](https://web.archive.org/web/https://web.archive.org/web/https://sci-hub.se/10.1007/978-3-030-02592-2)
So, how can you mitigate these?
-- This guide will provide some technical mitigations using Fingerprinting resistant tools but those might not be sufficient.
+- This guide will provide some technical mitigations using Fingerprinting resistant tools but those might not be sufficient.
-- You should apply common sense and try to find your own patterns in your behavior and behave differently when using anonymous identities. This includes:
+- You should apply common sense and try to find your own patterns in your behavior and behave differently when using anonymous identities. This includes:
- - The way you type (speed, accuracy...).
+ - The way you type (speed, accuracy...).
- - The words you use (be careful with your usual expressions).
+ - The words you use (be careful with your usual expressions).
- - The type of response you use (if you are sarcastic by default, try to have a different approach with your identities).
+ - The type of response you use (if you are sarcastic by default, try to have a different approach with your identities).
- - The way you use your mouse and click (try to solve the Captchas differently than your usual way)
+ - The way you use your mouse and click (try to solve the Captchas differently than your usual way)
- - The habits you have when using some Apps or visiting some Websites (do not always use the same menus/buttons/links to reach your content).
+ - The habits you have when using some Apps or visiting some Websites (do not always use the same menus/buttons/links to reach your content).
- - ...
+ - ...
You need to act and fully adopt a role as an actor would do for a performance. You need to become a different person, think, and act like that person. This is not a technical mitigation but a human one. You can only rely on yourself for that.
@@ -716,13 +708,13 @@ There are also a few cases involving OSINT at Bellingcat[^154]. Have a look at t
You can also view some convenient lists of some available OSINT tools here if you want to try them on yourself for example:
-- [[Archive.org]](https://web.archive.org/web/https://github.com/jivoi/awesome-osint)
+- [[Archive.org]](https://web.archive.org/web/https://github.com/jivoi/awesome-osint)
--
+-
--
+-
--
+-
As well as this interesting Playlist on YouTube: [[Invidious]](https://yewtu.be/playlist?list=PLrFPX1Vfqk3ehZKSFeb9pVIHqxqrNW8Sy)
@@ -742,25 +734,25 @@ If you are walking in a touristy place, you will most likely appear in someone's
Here are a few resources for even trying this yourself:
-- Bellingcat, Guide To Using Reverse Image Search For Investigations: [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2019/12/26/guide-to-using-reverse-image-search-for-investigations/)
+- Bellingcat, Guide To Using Reverse Image Search For Investigations: [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2019/12/26/guide-to-using-reverse-image-search-for-investigations/)
-- Bellingcat, Using the New Russian Facial Recognition Site SearchFace [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2019/02/19/using-the-new-russian-facial-recognition-site-searchface-ru/)
+- Bellingcat, Using the New Russian Facial Recognition Site SearchFace [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2019/02/19/using-the-new-russian-facial-recognition-site-searchface-ru/)
-- Bellingcat, Dali, Warhol, Boshirov: Determining the Time of an Alleged Photograph from Skripal Suspect Chepiga [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2018/10/24/dali-warhol-boshirov-determining-time-alleged-photograph-skripal-suspect-chepiga/)
+- Bellingcat, Dali, Warhol, Boshirov: Determining the Time of an Alleged Photograph from Skripal Suspect Chepiga [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2018/10/24/dali-warhol-boshirov-determining-time-alleged-photograph-skripal-suspect-chepiga/)
-- Bellingcat, Advanced Guide on Verifying Video Content [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2017/06/30/advanced-guide-verifying-video-content/)
+- Bellingcat, Advanced Guide on Verifying Video Content [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/how-tos/2017/06/30/advanced-guide-verifying-video-content/)
-- Bellingcat, Using the Sun and the Shadows for Geolocation [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/2020/12/03/using-the-sun-and-the-shadows-for-geolocation/)
+- Bellingcat, Using the Sun and the Shadows for Geolocation [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/resources/2020/12/03/using-the-sun-and-the-shadows-for-geolocation/)
-- Bellingcat, Navalny Poison Squad Implicated in Murders of Three Russian Activists [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/news/uk-and-europe/2021/01/27/navalny-poison-squad-implicated-in-murders-of-three-russian-activists/)
+- Bellingcat, Navalny Poison Squad Implicated in Murders of Three Russian Activists [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/news/uk-and-europe/2021/01/27/navalny-poison-squad-implicated-in-murders-of-three-russian-activists/)
-- Bellingcat, Berlin Assassination: New Evidence on Suspected FSB Hitman Passed to German Investigators [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/news/2021/03/19/berlin-assassination-new-evidence-on-suspected-fsb-hitman-passed-to-german-investigators/)
+- Bellingcat, Berlin Assassination: New Evidence on Suspected FSB Hitman Passed to German Investigators [[Archive.org]](https://web.archive.org/web/https://www.bellingcat.com/news/2021/03/19/berlin-assassination-new-evidence-on-suspected-fsb-hitman-passed-to-german-investigators/)
-- Bellingcat, Digital Research Tutorial: Investigating a Saudi-Led Coalition Bombing of a Yemen Hospital [[Invidious]](https://yewtu.be/watch?v=cAVZaPiVArA)
+- Bellingcat, Digital Research Tutorial: Investigating a Saudi-Led Coalition Bombing of a Yemen Hospital [[Invidious]](https://yewtu.be/watch?v=cAVZaPiVArA)
-- Bellingcat, Digital Research Tutorial: Using Facial Recognition in Investigations [[Invidious]](https://yewtu.be/watch?v=awY87q2Mr0E)
+- Bellingcat, Digital Research Tutorial: Using Facial Recognition in Investigations [[Invidious]](https://yewtu.be/watch?v=awY87q2Mr0E)
-- Bellingcat, Digital Research Tutorial: Geolocating (Allegedly) Corrupt Venezuelan Officials in Europe [[Invidious]](https://yewtu.be/watch?v=bS6gYWM4kzY)
+- Bellingcat, Digital Research Tutorial: Geolocating (Allegedly) Corrupt Venezuelan Officials in Europe [[Invidious]](https://yewtu.be/watch?v=bS6gYWM4kzY)
### Gait Recognition and Other Long-Range Biometrics
@@ -780,13 +772,13 @@ Other things than can be used to identify you include your earlobes, which are a
Those platforms (Google/Facebook) already know who you are for a few reasons:
-- Because you have or had a profile with them, and you identified yourself.
+- Because you have or had a profile with them, and you identified yourself.
-- Even if you never made a profile on those platforms, you still have one without even knowing it[^170]'[^171]'[^172]'[^173]'[^174].
+- Even if you never made a profile on those platforms, you still have one without even knowing it[^170]'[^171]'[^172]'[^173]'[^174].
-- Because other people have tagged you or identified you in their holidays/party pictures.
+- Because other people have tagged you or identified you in their holidays/party pictures.
-- Because other people have put a picture of you in their contact list which they then shared with them.
+- Because other people have put a picture of you in their contact list which they then shared with them.
Here is also an insightful demo of Microsoft Azure you can try for yourself at where you can detect emotions and compare faces from different pictures.
@@ -794,9 +786,9 @@ Governments already know who you are because they have your ID/Passport/Driving
Here are some resources detailing some techniques used by Law Enforcement today:
-- CCC video explaining current Law Enforcement surveillance capabilities: [[Archive.org]](https://web.archive.org/web/https://media.ccc.de/v/rc3-11406-spot_the_surveillance)
+- CCC video explaining current Law Enforcement surveillance capabilities: [[Archive.org]](https://web.archive.org/web/https://media.ccc.de/v/rc3-11406-spot_the_surveillance)
-- EFF SLS: [[Archive.org]](https://web.archive.org/web/https://www.eff.org/sls)
+- EFF SLS: [[Archive.org]](https://web.archive.org/web/https://www.eff.org/sls)
Apple is making FaceID mainstream and pushing its use to log you into many services including the Banking systems.
@@ -814,15 +806,15 @@ See this demo: [[Invidious]](
At this time, there are a few steps[^198] you can use to mitigate (and only mitigate) face recognition when conducting sensitive activities where CCTV might be present:
-- Wear a facemask as they have been proven to defeat some face recognition technologies[^199] but not all[^200].
+- Wear a facemask as they have been proven to defeat some face recognition technologies[^199] but not all[^200].
-- Wear a baseball cap or hat to mitigate identification from high-angle CCTVs (filming from above) from recording your face. Remember this will not help against front-facing cameras.
+- Wear a baseball cap or hat to mitigate identification from high-angle CCTVs (filming from above) from recording your face. Remember this will not help against front-facing cameras.
-- Wear sunglasses in addition to the facemask and baseball cap to mitigate identification from your eye's features.
+- Wear sunglasses in addition to the facemask and baseball cap to mitigate identification from your eye's features.
-- Consider wearing special sunglasses (expensive, unfortunately) called "Reflectacles" [[Archive.org]](https://web.archive.org/web/https://www.reflectacles.com/). There was a small study showing their efficiency against IBM and Amazon facial recognition[^201].
+- Consider wearing special sunglasses (expensive, unfortunately) called "Reflectacles" [[Archive.org]](https://web.archive.org/web/https://www.reflectacles.com/). There was a small study showing their efficiency against IBM and Amazon facial recognition[^201].
-- All that might still be useless because of gait recognition mentioned earlier but there might be hope here if you have a 3D Printer: [[Archive.org]](https://web.archive.org/web/https://gitlab.com/FG-01/fg-01)
+- All that might still be useless because of gait recognition mentioned earlier but there might be hope here if you have a 3D Printer: [[Archive.org]](https://web.archive.org/web/https://gitlab.com/FG-01/fg-01)
(see [Gait Recognition and Other Long-Range Biometrics])
@@ -854,13 +846,13 @@ These could be exploiting a vulnerability in an outdated format or an outdated r
See these good videos for more explanations on the matter:
-- What is a File Format? [[Invidious]](https://yewtu.be/watch?v=VVdmmN0su6E)
+- What is a File Format? [[Invidious]](https://yewtu.be/watch?v=VVdmmN0su6E)
-- Ange Albertini: Funky File Formats: [[Invidious]](https://yewtu.be/watch?v=hdCs6bPM4is)
+- Ange Albertini: Funky File Formats: [[Invidious]](https://yewtu.be/watch?v=hdCs6bPM4is)
-You should always use extreme caution. To mitigate these attacks, this guide will later recommend the use of virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) to mitigate leaking any information even in case of opening such a malicious file.
+You should always use extreme caution. See [Appendix W: Virtualization](#appendix-w-virtualization) to mitigate leaking any information even in case of opening such a malicious file.
-If you want to learn how to try detecting such malware, see [Appendix T: Checking files for malware]
+If you want to learn how to try detecting such malware, see [Appendix T: Checking files for malware](#appendix-t-checking-files-for-malware)
### Malware and Exploits in your apps and services
@@ -874,25 +866,23 @@ There are countless examples of malicious browser extensions, smartphone apps, a
Here are some steps to mitigate this type of attack:
-- You should never have 100% trust in the apps you are using.
+- You should never have 100% trust in the apps you are using.
+- You should always check that you are using the updated version of such apps before use and ideally validate each download using their signature if available.
+- You should not use such apps directly from a hardware system but instead, use a Virtual Machine for compartmentalization.
-- You should always check that you are using the updated version of such apps before use and ideally validate each download using their signature if available.
-
-- You should not use such apps directly from a hardware system but instead, use a Virtual Machine for compartmentalization.
-
-To reflect these recommendations, this guide will therefore later guide you in the use of Virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) so that even if your Browser/Apps get compromised by a skilled adversary, that adversary will find himself stuck in a sandbox[^212] without being able to access identifying information or compromise your system.
+To reflect these recommendations, this guide will therefore later guide you in the use of Virtualization (See [Appendix W: Virtualization](#appendix-w-virtualization) so that even if your Browser/Apps get compromised by a skilled adversary, that adversary will find himself stuck in a sandbox[^212] without being able to access identifying information or compromise your system.
### Malicious USB devices
There are readily available commercial and cheap "badUSB" [^213]devices that can take deploy malware, log your typing, geolocate you, listen to you or gain control of your laptop just by plugging them in. Here are some examples that you can already buy yourself:
-- Hak5, USB Rubber Ducky [[Archive.org]](https://web.archive.org/web/https://shop.hak5.org/products/usb-rubber-ducky-deluxe)
+- Hak5, USB Rubber Ducky [[Archive.org]](https://web.archive.org/web/https://shop.hak5.org/products/usb-rubber-ducky-deluxe)
-- Hak5, O.MG Cable [[Invidious]](https://yewtu.be/watch?v=V5mBJHotZv0)
+- Hak5, O.MG Cable [[Invidious]](https://yewtu.be/watch?v=V5mBJHotZv0)
-- Keelog [[Archive.org]](https://web.archive.org/web/https://www.keelog.com/)
+- Keelog [[Archive.org]](https://web.archive.org/web/https://www.keelog.com/)
-- AliExpress [[Archive.org]](https://web.archive.org/web/https://www.aliexpress.com/i/4000710369016.html)
+- AliExpress [[Archive.org]](https://web.archive.org/web/https://www.aliexpress.com/i/4000710369016.html)
Such devices can be implanted anywhere (charging cable, mouse, keyboard, USB key ...) by an adversary and can be used to track you or compromise your computer or smartphone. The most notable example of such attacks is probably Stuxnet[^214] in 2005.
@@ -1010,7 +1000,6 @@ There are some cryptocurrencies with privacy/anonymity in mind like Monero but e
Use of "private" mixers, tumblers[^244] (centralized services that specialize in "anonymizing" cryptocurrencies by "mixing them") and coinjoiners are risky as you don't know what's happening on them[^245] and can be trivially de-mixed[^246]. Their centrally-controlled nature could also put you in trouble as they are more susceptible to money-laundering laws[^247].
-
This does not mean you cannot use Bitcoin anonymously at all. You can actually use Bitcoin anonymously as long as you do not convert it to actual currency, use a Bitcoin wallet from a safe anonymous network, and do not reuse addresses or consolidate outputs that were used when spending at different merchants. Meaning you should avoid KYC/AML regulations by various exchanges, avoid using the Bitcoin network from any known IP address, and use a wallet that provides privacy-preserving tools. See [Appendix Z: Online anonymous payments using cryptocurrencies][Appendix Z: Online anonymous payments using cryptocurrencies].
**Overall, the best option for using Crypto with reasonable anonymity and privacy is still Monero and you should ideally not use any other for sensitive transactions unless you are aware of the limitations and risks involved. Please do read** [Appendix B2: Monero Disclaimer]**.**
@@ -1029,13 +1018,13 @@ There are specialized commercial forensics solutions available (Magnet Axiom[^24
Notable Examples:
-- Apple iCloud: [[Archive.org]](https://web.archive.org/web/https://support.apple.com/en-us/HT202303) : "Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on**, your backup includes a copy of the key protecting your Messages**. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. ".
+- Apple iCloud: [[Archive.org]](https://web.archive.org/web/https://support.apple.com/en-us/HT202303) : "Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on**, your backup includes a copy of the key protecting your Messages**. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. ".
-- Google Drive and WhatsApp: [[Archive.org]](https://web.archive.org/web/https://faq.whatsapp.com/android/chats/about-google-drive-backups/): "**Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive**. ". Do however note that Facebook/Whatsapp have announced the rollout of encrypted backups on October 14^th^ 2021 ( [[Archive.org]](https://web.archive.org/web/https://about.fb.com/news/2021/10/end-to-end-encrypted-backups-on-whatsapp/)) which should solve this issue.
+- Google Drive and WhatsApp: [[Archive.org]](https://web.archive.org/web/https://faq.whatsapp.com/android/chats/about-google-drive-backups/): "**Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive**. ". Do however note that Facebook/Whatsapp have announced the rollout of encrypted backups on October 14^th^ 2021 ( [[Archive.org]](https://web.archive.org/web/https://about.fb.com/news/2021/10/end-to-end-encrypted-backups-on-whatsapp/)) which should solve this issue.
-- Dropbox: [[Archive.org]](https://web.archive.org/web/https://www.dropbox.com/privacy) "To provide these and other features, **Dropbox accesses, stores, and scans Your Stuff**. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with".
+- Dropbox: [[Archive.org]](https://web.archive.org/web/https://www.dropbox.com/privacy) "To provide these and other features, **Dropbox accesses, stores, and scans Your Stuff**. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with".
-- Microsoft OneDrive: [[Archive.org]](https://web.archive.org/web/https://privacy.microsoft.com/en-us/privacystatement): Productivity and communications products, "When you use OneDrive, we collect data about your usage of the service, as well as the content you store, to provide, improve, and protect the services. **Examples include indexing the contents of your OneDrive documents so that you can search for them later and using location information to enable you to search for photos based on where the photo was taken**".
+- Microsoft OneDrive: [[Archive.org]](https://web.archive.org/web/https://privacy.microsoft.com/en-us/privacystatement): Productivity and communications products, "When you use OneDrive, we collect data about your usage of the service, as well as the content you store, to provide, improve, and protect the services. **Examples include indexing the contents of your OneDrive documents so that you can search for them later and using location information to enable you to search for photos based on where the photo was taken**".
You should not trust cloud providers with your (not previously and locally encrypted) sensitive data and you should be wary of their privacy claims. In most cases, they can access your data and provide it to a third party if they want to[^250].
@@ -1063,18 +1052,18 @@ Attacks such as invisible iframes and media elements can be avoided by blocking
Installing the [NoScript](https://noscript.net/) extension will prevent the attack **by default only in private Windows** using their new "TabGuard feature". But can be enabled in the NoScript options to work on all Windows. See:
-- Release tweet: [[Archive.org]](https://web.archive.org/web/https://twitter.com/ma1/status/1557751019945299969)
-- User explanation: [[Archive.org]](https://web.archive.org/web/https://noscript.net/usage/#crosstab-identity-leak-protection)
-- Tor Project Forum Post: [[Archive.org]](https://web.archive.org/web/https://forum.torproject.net/t/tor-browser-can-leak-your-identity-through-side-channel-attack/4005/2)
-- NoScript extension for Firefox (Firefox, and other Firefox-based browsers except Tor Browser):
-- NoScript extension for Chromium based browsers (Brave, Chrome, Edge, and other Chromium-based browsers):
+- Release tweet: [[Archive.org]](https://web.archive.org/web/https://twitter.com/ma1/status/1557751019945299969)
+- User explanation: [[Archive.org]](https://web.archive.org/web/https://noscript.net/usage/#crosstab-identity-leak-protection)
+- Tor Project Forum Post: [[Archive.org]](https://web.archive.org/web/https://forum.torproject.net/t/tor-browser-can-leak-your-identity-through-side-channel-attack/4005/2)
+- NoScript extension for Firefox (Firefox, and other Firefox-based browsers except Tor Browser):
+- NoScript extension for Chromium based browsers (Brave, Chrome, Edge, and other Chromium-based browsers):
### Alternative to NoScript for all other browsers
The researches who disclosed the issue also made an extension available below. Again, **nothing is required in Tor Browser**. This path is not our preferred path but is still available if you do not want to use NoScript.
-- Leakuidator+ extension for Chromium based browsers (Brave, Chrome, Edge, and other Chromium-based browsers):
-- Leakuidator+ extension for Firefox (Firefox, and other Firefox-based browsers except Tor Browser):
+- Leakuidator+ extension for Chromium based browsers (Brave, Chrome, Edge, and other Chromium-based browsers):
+- Leakuidator+ extension for Firefox (Firefox, and other Firefox-based browsers except Tor Browser):
Separating identities via separate browsers or even with VMs is not enough to avoid this attack. However, another solution is to make sure that when you start working with an anonymous identity, you entirely close all activities linked to other identities. The vulnerability only works if you're actively logged into a non-anonymous identity. The issue with this is that it can hinder effective workflow, as multitasking across multiple identities becomes impossible.
@@ -1088,19 +1077,19 @@ Forensics techniques are now very advanced and can reveal a staggering amount of
Here are some recent resources you should read about your smartphone:
-- UpTurn, The Widespread Power of U.S. Law Enforcement to Search Mobile Phones [[Archive.org]](https://web.archive.org/web/https://www.upturn.org/reports/2020/mass-extraction/)
+- UpTurn, The Widespread Power of U.S. Law Enforcement to Search Mobile Phones [[Archive.org]](https://web.archive.org/web/https://www.upturn.org/reports/2020/mass-extraction/)
-- New-York Times, The Police Can Probably Break Into Your Phone [[Archive.org]](https://web.archive.org/web/https://www.nytimes.com/2020/10/21/technology/iphone-encryption-police.html)
+- New-York Times, The Police Can Probably Break Into Your Phone [[Archive.org]](https://web.archive.org/web/https://www.nytimes.com/2020/10/21/technology/iphone-encryption-police.html)
-- Vice, Cops Around the Country Can Now Unlock iPhones, Records Show [[Archive.org]](https://web.archive.org/web/https://www.vice.com/en/article/vbxxxd/unlock-iphone-ios11-graykey-grayshift-police)
+- Vice, Cops Around the Country Can Now Unlock iPhones, Records Show [[Archive.org]](https://web.archive.org/web/https://www.vice.com/en/article/vbxxxd/unlock-iphone-ios11-graykey-grayshift-police)
I also highly recommend that you read some documents from a forensics examiner perspective such as:
-- EnCase Forensic User Guide, [[Archive.org]](https://web.archive.org/web/http://encase-docs.opentext.com/documentation/encase/forensic/8.07/Content/Resources/External%20Files/EnCase%20Forensic%20v8.07%20User%20Guide.pdf)
+- EnCase Forensic User Guide, [[Archive.org]](https://web.archive.org/web/http://encase-docs.opentext.com/documentation/encase/forensic/8.07/Content/Resources/External%20Files/EnCase%20Forensic%20v8.07%20User%20Guide.pdf)
-- FTK Forensic Toolkit, [[Archive.org]](https://web.archive.org/web/https://accessdata.com/products-services/forensic-toolkit-ftk)
+- FTK Forensic Toolkit, [[Archive.org]](https://web.archive.org/web/https://accessdata.com/products-services/forensic-toolkit-ftk)
-- SANS Digital Forensics and Incident Response Videos,
+- SANS Digital Forensics and Incident Response Videos,
And finally, here is this very instructive detailed paper on the current state of IOS/Android security from the John Hopkins University: https://securephones.io/main.html[^254].
@@ -1114,27 +1103,27 @@ And there are reasons[^255]'[^256]'[^257]'[^258] for that:
We would not want people discouraged from studying and innovating in the crypto field because of that adage. So instead, we would recommend people to be cautious with "Roll your own crypto" because it is not necessarily good crypto:
-- Good cryptography is not easy and usually takes years of research to develop and fine-tune.
+- Good cryptography is not easy and usually takes years of research to develop and fine-tune.
-- Good cryptography is transparent and not proprietary/closed source so it can be reviewed by peers.
+- Good cryptography is transparent and not proprietary/closed source so it can be reviewed by peers.
-- Good cryptography is developed carefully, slowly, and rarely alone.
+- Good cryptography is developed carefully, slowly, and rarely alone.
-- Good cryptography is usually presented and discussed in conferences and published in various journals.
+- Good cryptography is usually presented and discussed in conferences and published in various journals.
-- Good cryptography is extensively peer-reviewed before it is released for use in the wild.
+- Good cryptography is extensively peer-reviewed before it is released for use in the wild.
-- Using and implementing existing good cryptography correctly is already a challenge.
+- Using and implementing existing good cryptography correctly is already a challenge.
Yet, this is not stopping some from doing it anyway and publishing various production Apps/Services using their self-made cryptography or proprietary closed-source methods:
-- You should apply caution when using Apps/Services using closed-source or proprietary encryption methods. All the good crypto standards are public and peer-reviewed and there should be no issue disclosing the one you use.
+- You should apply caution when using Apps/Services using closed-source or proprietary encryption methods. All the good crypto standards are public and peer-reviewed and there should be no issue disclosing the one you use.
-- You should be wary of Apps/Services using a "modified" or proprietary cryptographic method[^259].
+- You should be wary of Apps/Services using a "modified" or proprietary cryptographic method[^259].
-- By default, you should not trust any "Roll your own crypto" until it was audited, peer-reviewed, vetted, and accepted by the cryptography community[^260]'[^261].
+- By default, you should not trust any "Roll your own crypto" until it was audited, peer-reviewed, vetted, and accepted by the cryptography community[^260]'[^261].
-- There is no such thing as "military-grade crypto"[^262]'[^263]'[^264].
+- There is no such thing as "military-grade crypto"[^262]'[^263]'[^264].
Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization.
@@ -1144,70 +1133,69 @@ So, what to prefer and what to avoid as of 2021? You will have to look up for yo
Here are some examples:
-- Hashes:
+- Hashes:
- - Prefer: SHA-3 or BLAKE2[^265]
+ - Prefer: SHA-3 or BLAKE2[^265]
- - Still relatively ok to use: SHA-2 (such as the widely used SHA-256 or SHA-512)
+ - Still relatively ok to use: SHA-2 (such as the widely used SHA-256 or SHA-512)
- - Avoid: SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used)
+ - Avoid: SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used)
-- File/Disk Encryption:
+- File/Disk Encryption:
- - Prefer:
+ - Prefer:
- - Hardware Accelerated[^266]: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.
+ + Hardware Accelerated[^266]: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3.
- - Non-Hardware Accelerated: Same as accelerated above or if available consider:
+ + Non-Hardware Accelerated: Same as accelerated above or if available consider:
- - ChaCha20[^267] or XChaCha20 (You can use ChaCha20 with Kryptor , unfortunately, it is not available with Veracrypt).
+ * ChaCha20[^267] or XChaCha20 (You can use ChaCha20 with Kryptor , unfortunately, it is not available with Veracrypt).
- - Serpent[^268]
+ * Serpent[^268]
- - TwoFish[^269]
+ * TwoFish[^269]
- - Avoid: Pretty much anything else
+ - Avoid: Pretty much anything else
-- Password Storage:
+- Password Storage:
- - Prefer: Argon2, scrypt
- - If these aren't options, use bcrypt, or if not possible at least PBKDF2 (only as a last resort)
- - Be skeptical of Argon2d, as it's vulnerable to some forms of side-channels. Prefer Argon2i or Argon2id
+ - Prefer: Argon2, scrypt
+ - If these aren't options, use bcrypt, or if not possible at least PBKDF2 (only as a last resort)
+ - Be skeptical of Argon2d, as it's vulnerable to some forms of side-channels. Prefer Argon2i or Argon2id
- - Avoid: SHA-3, SHA-2, SHA-1, MD5
+ - Avoid: SHA-3, SHA-2, SHA-1, MD5
+- Browser Security (HTTPS):
-- Browser Security (HTTPS):
+ - Prefer: TLS 1.3 (ideally TLS 1.3 with ECH/eSNI support) or at least TLS 1.2 (widely used)
- - Prefer: TLS 1.3 (ideally TLS 1.3 with ECH/eSNI support) or at least TLS 1.2 (widely used)
+ - Avoid: Anything Else (TLS =<1.1, SSL =<3)
- - Avoid: Anything Else (TLS =<1.1, SSL =<3)
+- Signing messages/files with GnuPG (GPG):
-- Signing messages/files with GnuPG (GPG):
+ - Prefer ECDSA (ed25519)+ECDH (ec25519) or RSA 4096 Bits*
- - Prefer ECDSA (ed25519)+ECDH (ec25519) or RSA 4096 Bits*
+ + **Consider a more modern**[^270] **alternative to PGP/GPG: Minisign ** [[Archive.org]](https://web.archive.org/web/https://jedisct1.github.io/minisign/)
- - **Consider a more modern**[^270] **alternative to PGP/GPG: Minisign ** [[Archive.org]](https://web.archive.org/web/https://jedisct1.github.io/minisign/)
+ - Avoid: RSA 2048 bits
- - Avoid: RSA 2048 bits
+- SSH keys:
-- SSH keys:
+ - ED25519 (preferred) or RSA 4096 Bits*
- - ED25519 (preferred) or RSA 4096 Bits*
+ - Avoid: RSA 2048 bits
- - Avoid: RSA 2048 bits
-
-* **Warning: RSA and ED25519 are unfortunately not seen as "Quantum Resistant"**[^271] **and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.**
+- **Warning: RSA and ED25519 are unfortunately not seen as "Quantum Resistant"**[^271] **and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.**
Here are some real cases of issues bad cryptography:
-- Telegram: [[Archive.org]](https://web.archive.org/web/https://democratic-europe.eu/2021/07/20/cryptographers-uncover-four-vulnerabilities-in-telegram/)
+- Telegram: [[Archive.org]](https://web.archive.org/web/https://democratic-europe.eu/2021/07/20/cryptographers-uncover-four-vulnerabilities-in-telegram/)
-- Telegram: [[Archive.org]](https://web.archive.org/web/https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/)
+- Telegram: [[Archive.org]](https://web.archive.org/web/https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/)
-- Cryptocat:
+- Cryptocat:
-- Some other examples can be found here: [[Archive.org]](https://web.archive.org/web/https://www.cryptofails.com/)
+- Some other examples can be found here: [[Archive.org]](https://web.archive.org/web/https://www.cryptofails.com/)
Later this guide will not recommend "bad cryptography" and that should hopefully be enough to protect you?
@@ -1217,23 +1205,23 @@ Many people have the idea that privacy-oriented services such as VPN or E-Mail p
Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order[^272] or a national security letter[^273]) log your activity to de-anonymize you. There have been several recent examples of those:
-- 2021, Proton, Proton logged IP address of French activist after an order by Swiss authorities (source link unavailable).
+- 2021, Proton, Proton logged IP address of French activist after an order by Swiss authorities (source link unavailable).
-- 2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities[^275].
+- 2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities[^275].
-- 2021, DoubleVPN servers, logs, and account info seized by law enforcement[^276].
+- 2021, DoubleVPN servers, logs, and account info seized by law enforcement[^276].
-- 2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months[^277].
+- 2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months[^277].
-- 2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user[^278] (they did not decrypt the stored e-mail).
+- 2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user[^278] (they did not decrypt the stored e-mail).
-- 2017, PureVPN was forced to disclose information of one user to the FBI[^279].
+- 2017, PureVPN was forced to disclose information of one user to the FBI[^279].
-- 2014, an EarthVPN user was arrested based on logs provider to the Dutch Police[^280].
+- 2014, an EarthVPN user was arrested based on logs provider to the Dutch Police[^280].
-- 2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order[^281].
+- 2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order[^281].
-- 2011, HideMyAss user was de-anonymized, and logs were provided to the FBI[^282].
+- 2011, HideMyAss user was de-anonymized, and logs were provided to the FBI[^282].
Some providers have implemented the use of a Warrant Canary[^283] that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know.
@@ -1253,119 +1241,119 @@ If the VPN provider knows nothing about you, it should mitigate any issue due to
Many advanced techniques can be used by skilled adversaries[^287] to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here [[Archive.org]](https://web.archive.org/web/https://cyber.bgu.ac.il/advanced-cyber/airgap) (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report [[Archive.org]](https://web.archive.org/web/https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf) (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include:
-- Attacks requiring malware implants:
+- Attacks requiring malware implants:
- - Exfiltration of Data through a Malware infected Router: [[Invidious]](https://yewtu.be/watch?v=mSNt4h7EDKo)
+ - Exfiltration of Data through a Malware infected Router: [[Invidious]](https://yewtu.be/watch?v=mSNt4h7EDKo)
- - Exfiltration of Data through observation of Light variation in a Backlit keyboard with a compromised camera: [[Invidious]](https://yewtu.be/watch?v=1kBGDHVr7x0)
+ - Exfiltration of Data through observation of Light variation in a Backlit keyboard with a compromised camera: [[Invidious]](https://yewtu.be/watch?v=1kBGDHVr7x0)
- - Exfiltration of Data through a compromised Security Camera (that could first use the previous attack) [[Invidious]](https://yewtu.be/watch?v=om5fNqKjj2M)
+ + Exfiltration of Data through a compromised Security Camera (that could first use the previous attack) [[Invidious]](https://yewtu.be/watch?v=om5fNqKjj2M)
- - Communication from outsider to compromised Security Cameras through IR light signals: [[Invidious]](https://yewtu.be/watch?v=auoYKSzdOj4)
+ + Communication from outsider to compromised Security Cameras through IR light signals: [[Invidious]](https://yewtu.be/watch?v=auoYKSzdOj4)
- - Exfiltration of data from a compromised air-gapped computer through acoustic analysis of the FAN noises with a smartphone [[Invidious]](https://yewtu.be/watch?v=v2_sZIfZkDQ)
+ - Exfiltration of data from a compromised air-gapped computer through acoustic analysis of the FAN noises with a smartphone [[Invidious]](https://yewtu.be/watch?v=v2_sZIfZkDQ)
- - Exfiltration of data from a malware-infected air-gapped computer through HD LEDs with a Drone [[Invidious]](https://yewtu.be/watch?v=4vIu8ld68fc)
+ - Exfiltration of data from a malware-infected air-gapped computer through HD LEDs with a Drone [[Invidious]](https://yewtu.be/watch?v=4vIu8ld68fc)
- - Exfiltration of data from a USB malware on an air-gapped computer through electromagnetic interferences [[Invidious]](https://yewtu.be/watch?v=E28V1t-k8Hk)
+ - Exfiltration of data from a USB malware on an air-gapped computer through electromagnetic interferences [[Invidious]](https://yewtu.be/watch?v=E28V1t-k8Hk)
- - Exfiltration of data from a malware-infected HDD drive through covert acoustic noise [[Invidious]](https://yewtu.be/watch?v=H7lQXmSLiP8)
+ - Exfiltration of data from a malware-infected HDD drive through covert acoustic noise [[Invidious]](https://yewtu.be/watch?v=H7lQXmSLiP8)
- - Exfiltration of data through GSM frequencies from a compromised (with malware) air-gapped computer [[Invidious]](https://yewtu.be/watch?v=RChj7Mg3rC4)
+ - Exfiltration of data through GSM frequencies from a compromised (with malware) air-gapped computer [[Invidious]](https://yewtu.be/watch?v=RChj7Mg3rC4)
- - Exfiltration of data through electromagnetic emissions from a compromised Display device [[Invidious]](https://yewtu.be/watch?v=2OzTWiGl1rM&t=20s)
+ - Exfiltration of data through electromagnetic emissions from a compromised Display device [[Invidious]](https://yewtu.be/watch?v=2OzTWiGl1rM&t=20s)
- - Exfiltration of data through magnetic waves from a compromised air-gapped computer to a Smartphone stored inside a Faraday bag [[Invidious]](https://yewtu.be/watch?v=yz8E5n1Tzlo)
+ - Exfiltration of data through magnetic waves from a compromised air-gapped computer to a Smartphone stored inside a Faraday bag [[Invidious]](https://yewtu.be/watch?v=yz8E5n1Tzlo)
- - Communication between two compromised air-gapped computers using ultrasonic soundwaves [[Invidious]](https://yewtu.be/watch?v=yz8E5n1Tzlo)
+ - Communication between two compromised air-gapped computers using ultrasonic soundwaves [[Invidious]](https://yewtu.be/watch?v=yz8E5n1Tzlo)
- - Exfiltration of Bitcoin Wallet from a compromised air-gapped computer to a smartphone [[Invidious]](https://yewtu.be/watch?v=2WtiHZNeveY)
+ - Exfiltration of Bitcoin Wallet from a compromised air-gapped computer to a smartphone [[Invidious]](https://yewtu.be/watch?v=2WtiHZNeveY)
- - Exfiltration of Data from a compromised air-gapped computer using display brightness [[Invidious]](https://yewtu.be/watch?v=ZrkZUO2g4DE)
+ - Exfiltration of Data from a compromised air-gapped computer using display brightness [[Invidious]](https://yewtu.be/watch?v=ZrkZUO2g4DE)
- - Exfiltration of Data from a compromised air-gapped computer through vibrations [[Invidious]](https://yewtu.be/watch?v=XGD343nq1dg)
+ - Exfiltration of Data from a compromised air-gapped computer through vibrations [[Invidious]](https://yewtu.be/watch?v=XGD343nq1dg)
- - Exfiltration of Data from a compromised air-gapped computer by turning RAM into a Wi-Fi emitter [[Invidious]](https://yewtu.be/watch?v=vhNnc0ln63c)
+ - Exfiltration of Data from a compromised air-gapped computer by turning RAM into a Wi-Fi emitter [[Invidious]](https://yewtu.be/watch?v=vhNnc0ln63c)
- - Exfiltration of Data from a compromised air-gapped computer through power lines [[Archive.org]](https://web.archive.org/web/https://arxiv.org/pdf/1804.04014.pdf)
+ - Exfiltration of Data from a compromised air-gapped computer through power lines [[Archive.org]](https://web.archive.org/web/https://arxiv.org/pdf/1804.04014.pdf)
-- **Attacks not requiring malware:**
+- **Attacks not requiring malware:**
- - Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing[^288]. Publication with demonstration: [[Archive.org]](https://web.archive.org/web/http://wallcamera.csail.mit.edu/)
+ - Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing[^288]. Publication with demonstration: [[Archive.org]](https://web.archive.org/web/http://wallcamera.csail.mit.edu/)
- - Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room[^289]. Publication with photographic examples: [[Archive.org]](https://web.archive.org/web/https://arxiv.org/pdf/2001.04642.pdf)
+ - Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room[^289]. Publication with photographic examples: [[Archive.org]](https://web.archive.org/web/https://arxiv.org/pdf/2001.04642.pdf)
- - Measuring floor vibrations to identify individuals and determine their health condition and mood[^290]. Publication with demonstration: [[Archive.org]](https://web.archive.org/web/https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html)
+ - Measuring floor vibrations to identify individuals and determine their health condition and mood[^290]. Publication with demonstration: [[Archive.org]](https://web.archive.org/web/https://engineering.cmu.edu/news-events/news/2020/02/17-mauraders-map.html)
- - Observing a light bulb from a distance to listen to the sound in the room[^291] **without any malware**: Demonstration: [[Invidious]](https://yewtu.be/watch?v=t32QvpfOHqw). It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013[^292] and that you can even buy devices to perform this yourself such as here: [[Archive.org]](https://web.archive.org/web/http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html)
+ - Observing a light bulb from a distance to listen to the sound in the room[^291] **without any malware**: Demonstration: [[Invidious]](https://yewtu.be/watch?v=t32QvpfOHqw). It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013[^292] and that you can even buy devices to perform this yourself such as here: [[Archive.org]](https://web.archive.org/web/http://www.gcomtech.com/ccp0-prodshow/laser-surveillance-laser-listening.html)
Here is also a good video from the same authors to explain those topics: Black Hat, The Air-Gap Jumpers [[Invidious]](https://yewtu.be/watch?v=YKRtFgunyj4)
**Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle**[^293]**, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:**
-- Do not conduct sensitive activity while connected to an untrusted/unsecured power line to prevent power line leaks.
+- Do not conduct sensitive activity while connected to an untrusted/unsecured power line to prevent power line leaks.
-- Do not use your devices in front of a camera that could be compromised.
+- Do not use your devices in front of a camera that could be compromised.
-- Use your devices in a soundproofed room to prevent sound leaks.
+- Use your devices in a soundproofed room to prevent sound leaks.
-- Use your devices in a Faraday cage to prevent electromagnetic leaks.
+- Use your devices in a Faraday cage to prevent electromagnetic leaks.
-- Do not talk about sensitive information where lightbulbs could be seen from outside.
+- Do not talk about sensitive information where lightbulbs could be seen from outside.
-- Buy your devices from different/unpredictable/offline places (shops) where the probability of them being infected with such malware is lower.
+- Buy your devices from different/unpredictable/offline places (shops) where the probability of them being infected with such malware is lower.
-- Do not let anyone access your air-gapped computers except trusted people.
+- Do not let anyone access your air-gapped computers except trusted people.
## Some bonus resources
-- Have a look at the Whonix Documentation concerning Data Collection techniques here: [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Data_Collection_Techniques)
+- Have a look at the Whonix Documentation concerning Data Collection techniques here: [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Data_Collection_Techniques)
-- You might also enjoy looking at this service [[Archive.org]](https://web.archive.org/web/https://tosdr.org/) (Terms of Services, Didn't Read) that will give you a good overview of the various ToS of many services.
+- You might also enjoy looking at this service [[Archive.org]](https://web.archive.org/web/https://tosdr.org/) (Terms of Services, Didn't Read) that will give you a good overview of the various ToS of many services.
-- Have a look at [[Archive.org]](https://web.archive.org/web/https://www.eff.org/issues/privacy) for some more resources.
+- Have a look at [[Archive.org]](https://web.archive.org/web/https://www.eff.org/issues/privacy) for some more resources.
-- Have a look at [[Wikiless]](https://wikiless.org/wiki/List_of_government_mass_surveillance_projects) [[Archive.org]](https://web.archive.org/web/https://en.wikipedia.org/wiki/List_of_government_mass_surveillance_projects) to have an overview of all known mass-surveillance projects, current, and past.
+- Have a look at [[Wikiless]](https://wikiless.org/wiki/List_of_government_mass_surveillance_projects) [[Archive.org]](https://web.archive.org/web/https://en.wikipedia.org/wiki/List_of_government_mass_surveillance_projects) to have an overview of all known mass-surveillance projects, current, and past.
-- Have a look at [[Archive.org]](https://web.archive.org/web/https://www.gwern.net/Death-Note-Anonymity) (even if you don't know about Death Note).
+- Have a look at [[Archive.org]](https://web.archive.org/web/https://www.gwern.net/Death-Note-Anonymity) (even if you don't know about Death Note).
-- Consider finding and reading Michael Bazzell's book "Open-Source Intelligence Techniques" (eighth edition as of this writing to find out more about recent OSINT techniques)
+- Consider finding and reading Michael Bazzell's book "Open-Source Intelligence Techniques" (eighth edition as of this writing to find out more about recent OSINT techniques)
-- Finally, check [[Archive.org]](https://web.archive.org/web/https://www.freehaven.net/anonbib/date.html) for the latest academic papers related to Online Anonymity.
+- Finally, check [[Archive.org]](https://web.archive.org/web/https://www.freehaven.net/anonbib/date.html) for the latest academic papers related to Online Anonymity.
**Notes**
If you still do not think such information can be used by various actors to track you, you can see some statistics for yourself for some platforms and keep in mind those are only accounting for the lawful data requests and will not count things like PRISM, MUSCULAR, SORM or XKEYSCORE explained earlier:
-- Google Transparency Report [[Archive.org]](https://web.archive.org/web/https://transparencyreport.google.com/user-data/overview)
+- Google Transparency Report [[Archive.org]](https://web.archive.org/web/https://transparencyreport.google.com/user-data/overview)
-- Facebook Transparency Report [[Archive.org]](https://web.archive.org/web/https://transparency.facebook.com/)
+- Facebook Transparency Report [[Archive.org]](https://web.archive.org/web/https://transparency.facebook.com/)
-- Apple Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.apple.com/legal/transparency/)
+- Apple Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.apple.com/legal/transparency/)
-- Cloudflare Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.cloudflare.com/transparency/)
+- Cloudflare Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.cloudflare.com/transparency/)
-- Snapchat Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.snap.com/en-US/privacy/transparency)
+- Snapchat Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.snap.com/en-US/privacy/transparency)
-- Telegram Transparency Report [[Archive.org]](https://web.archive.org/web/https://t.me/transparency) (requires telegram installed)
+- Telegram Transparency Report [[Archive.org]](https://web.archive.org/web/https://t.me/transparency) (requires telegram installed)
-- Microsoft Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report)
+- Microsoft Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report)
-- Amazon Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.amazon.com/gp/help/customer/display.html?nodeId=GYSDRGWQ2C2CRYEF)
+- Amazon Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.amazon.com/gp/help/customer/display.html?nodeId=GYSDRGWQ2C2CRYEF)
-- Dropbox Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.dropbox.com/transparency)
+- Dropbox Transparency Report [[Archive.org]](https://web.archive.org/web/https://www.dropbox.com/transparency)
-- Discord Transparency Report [[Archive.org]](https://web.archive.org/web/20220812051950/https://discord.com/blog/discord-transparency-report-q1-2022)
+- Discord Transparency Report [[Archive.org]](https://web.archive.org/web/20220812051950/https://discord.com/blog/discord-transparency-report-q1-2022)
-- GitHub Transparency Report [[Archive.org]](https://web.archive.org/web/https://github.blog/2021-02-25-2020-transparency-report/)
+- GitHub Transparency Report [[Archive.org]](https://web.archive.org/web/https://github.blog/2021-02-25-2020-transparency-report/)
-- Snapchat Transparency Report [[Archive.org]](https://web.archive.org/web/20220806141853/https://www.snap.com/en-US/privacy/transparency)
+- Snapchat Transparency Report [[Archive.org]](https://web.archive.org/web/20220806141853/https://www.snap.com/en-US/privacy/transparency)
-- TikTok Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054600/https://www.tiktok.com/transparency/en/information-requests-2021-2/)
+- TikTok Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054600/https://www.tiktok.com/transparency/en/information-requests-2021-2/)
-- Reddit Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054736/https://www.redditinc.com/policies/transparency-report-2021)
+- Reddit Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054736/https://www.redditinc.com/policies/transparency-report-2021)
-- Twitter Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054839/https://transparency.twitter.com/)
+- Twitter Transparency Report [[Archive.org]](https://web.archive.org/web/20220812054839/https://transparency.twitter.com/)
# General Preparations
@@ -1375,9 +1363,9 @@ Zero-Trust Security[^391] ("Never trust, always verify").
Here are some various resources about what Zero-Trust Security is:
-- DEFCON, Zero Trust a Vision for Securing Cloud, [[Invidious]](https://yewtu.be/watch?v=euSsqXO53GY)
+- DEFCON, Zero Trust a Vision for Securing Cloud, [[Invidious]](https://yewtu.be/watch?v=euSsqXO53GY)
-- From the NSA themselves, Embracing a Zero Trust Security Model, [[Archive.org]](https://web.archive.org/web/https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF)
+- From the NSA themselves, Embracing a Zero Trust Security Model, [[Archive.org]](https://web.archive.org/web/https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF)
## Picking your route
@@ -1387,79 +1375,79 @@ First, here is a small basic UML diagram showing your available options accordin
### Timing limitations
-- You have no time at all:
+- You have no time at all:
- - **Go for the Tor Browser route.**
+ - **Go for the Tor Browser route.**
-- You have extremely limited time to learn and need a fast-working solution:
+- You have extremely limited time to learn and need a fast-working solution:
- - **Your best option is to go for the Tails route (excluding the persistent plausible deniability section).**
+ - **Your best option is to go for the Tails route (excluding the persistent plausible deniability section).**
-- You have time and more importantly motivation to learn:
+- You have time and more importantly motivation to learn:
- - **Go with any route.**
+ - **Go with any route.**
### Budget & Material limitations
-- You have no budget and even accessing a laptop is complicated or you only have your smartphone:
+- You have no budget and even accessing a laptop is complicated or you only have your smartphone:
- - **Go for the Tor Browser route.**
+ - **Go for the Tor Browser route.**
-- You only have one laptop available and cannot afford anything else. You use this laptop for either work, family, or your personal stuff (or both):
+- You only have one laptop available and cannot afford anything else. You use this laptop for either work, family, or your personal stuff (or both):
- - **Your best option is to go for the Tails route.**
+ - **Your best option is to go for the Tails route.**
-- You can afford a spare dedicated unsupervised/unmonitored laptop for your sensitive activities:
+- You can afford a spare dedicated unsupervised/unmonitored laptop for your sensitive activities:
- - But it is old, slow, and has bad specs (less than 6GB of RAM, less than 250GB disk space, old/slow CPU):
+ - But it is old, slow, and has bad specs (less than 6GB of RAM, less than 250GB disk space, old/slow CPU):
- - **You should go for the Tails route.**
+ + **You should go for the Tails route.**
- - It is not that old, and it has decent specs (at least 8GB of RAM, 250GB of disk space or more, decent CPU):
+ - It is not that old, and it has decent specs (at least 8GB of RAM, 250GB of disk space or more, decent CPU):
- - **You could go for Tails, Whonix routes.**
+ + **You could go for Tails, Whonix routes.**
- - It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):
+ - It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU):
- - **You could go for any route, but we would recommend Qubes OS if your threat model allows it. Please see the requirements.[^363]**
+ + **You could go for any route, but we would recommend Qubes OS if your threat model allows it. Please see the requirements.[^363]**
- - If it is an ARM-based M1/M2 Mac:
+ - If it is an ARM-based M1/M2 Mac:
- - **Not possible currently for these reasons:**
+ + **Not possible currently for these reasons:**
- - Virtualization of Intel x86 images on ARM (M1/M2) hosts is still limited to commercial software (e.g., Parallels, Fusion) which are mostly not supported by Whonix, yet. They are very buggy and for advanced people only. Please seek this information yourself.
+ * Virtualization of Intel x86 images on ARM (M1/M2) hosts is still limited to commercial software (e.g., Parallels, Fusion) which are mostly not supported by Whonix, yet. They are very buggy and for advanced people only. Please seek this information yourself.
- - [Virtualbox is now available natively for ARM64 architecture](https://osxdaily.com/2022/10/22/you-can-now-run-virtualbox-on-apple-silicon-m1-m2/) in a package as of October 2022. Download the ["Developer preview for macOS/Arm64 (M1/M2) hosts"](https://www.virtualbox.org/wiki/Downloads).
+ * [Virtualbox is now available natively for ARM64 architecture](https://osxdaily.com/2022/10/22/you-can-now-run-virtualbox-on-apple-silicon-m1-m2/) in a package as of October 2022. Download the ["Developer preview for macOS/Arm64 (M1/M2) hosts"](https://www.virtualbox.org/wiki/Downloads).
- - Whonix does not support macOS easily. "You need to build Whonix using the build script to get it running on Apple Silicon." [See the forum thread](https://www.whonix.org/wiki/MacOS#M1).
+ * Whonix does not support macOS easily. "You need to build Whonix using the build script to get it running on Apple Silicon." [See the forum thread](https://www.whonix.org/wiki/MacOS#M1).
- - Tails is not supported on ARM64 architecture yet. [See this thread](https://gitlab.tails.boum.org/tails/blueprints/-/wikis/ARM_platforms/) for more information (keep in mind this page hasn't been updated recently).
+ * Tails is not supported on ARM64 architecture yet. [See this thread](https://gitlab.tails.boum.org/tails/blueprints/-/wikis/ARM_platforms/) for more information (keep in mind this page hasn't been updated recently).
- - Qubes OS is not supported on ARM64 architecture yet, but there is work being done to make it available on aarch64, which may be delayed for the unforseeable future..
+ * Qubes OS is not supported on ARM64 architecture yet, but there is work being done to make it available on aarch64, which may be delayed for the unforseeable future..
**The general advice in this guide regarding virtualization software is that it's costly. That said, you should probably get a dedicated laptop, capable of running virtualization software, preferably a 64-bit architecture, to be used for more sensitive activities and testing.**
### Skills
-- Do you have no IT skills at all the content of this guide look like an alien language to you? Consider:
+- Do you have no IT skills at all the content of this guide look like an alien language to you? Consider:
- - **The Tor Browser route (simplest of all)**
+ - **The Tor Browser route (simplest of all)**
- - **The Tails route (excluding the persistent plausible deniability section).**
+ - **The Tails route (excluding the persistent plausible deniability section).**
-- You have some IT skills and mostly understand this guide so far, consider:
+- You have some IT skills and mostly understand this guide so far, consider:
- - **The Tails route (with the optional persistent plausible deniability section).**
+ - **The Tails route (with the optional persistent plausible deniability section).**
- - **The Whonix route.**
+ - **The Whonix route.**
-- You have moderate to high IT skills, and you are already familiar with some of the content of this guide, consider:
+- You have moderate to high IT skills, and you are already familiar with some of the content of this guide, consider:
- - **Any route (Qubes OS is preferred if you can afford it).**
+ - **Any route (Qubes OS is preferred if you can afford it).**
-- You are an l33T hacker, "there is no spoon", "the cake is a lie", you have been using "doas" for years, and "all your base is belong to us", and you have strong opinions on systemd.
+- You are an l33T hacker, "there is no spoon", "the cake is a lie", you have been using "doas" for years, and "all your base is belong to us", and you have strong opinions on systemd.
- - **This guide is not meant for you and will not help you with your HardenedBSD on your hardened Libreboot laptop ;-)**
+ - **This guide is not meant for you and will not help you with your HardenedBSD on your hardened Libreboot laptop ;-)**
### Adversarial considerations
@@ -1467,87 +1455,87 @@ Now that you know what is possible, you should also consider threats and adversa
#### Threats
-- If your main concern is a forensic examination of your devices, you should consider the Tor Browser route or the Tails route.
+- If your main concern is a forensic examination of your devices, you should consider the Tor Browser route or the Tails route.
-- If your main concerns are remote adversaries that might uncover your online identity on various platforms, you should consider the Tails, Whonix, or Qubes OS routes (listed in order of difficulty).
+- If your main concerns are remote adversaries that might uncover your online identity on various platforms, you should consider the Tails, Whonix, or Qubes OS routes (listed in order of difficulty).
-- If you want system-wide plausible deniability[^311]'[^294] despite the risks[^295]'[^314], consider the Tails route, including the persistent plausible deniability section (see [Persistent Plausible Deniability using Whonix within Tails][Persistent Plausible Deniability using Whonix within Tails:]).**
+- If you want system-wide plausible deniability[^311]'[^294] despite the risks[^295]'[^314], consider the Tails route, including the persistent plausible deniability section (see [Persistent Plausible Deniability using Whonix within Tails][Persistent Plausible Deniability using Whonix within Tails:]).**
-- If you are in a hostile environment where Tor/VPN usage alone is impossible/dangerous/suspicious, consider the Tails route (without actually using Tor), or more advanced routes like Whonix or Qubes OS.
+- If you are in a hostile environment where Tor/VPN usage alone is impossible/dangerous/suspicious, consider the Tails route (without actually using Tor), or more advanced routes like Whonix or Qubes OS.
#### Adversaries
-- Low skills:
+- Low skills:
- - Low resources:
+ - Low resources:
- - Any motivation: Any Route
+ + Any motivation: Any Route
- - Medium resources:
+ - Medium resources:
- - Low to Medium motivation: Any Route
+ + Low to Medium motivation: Any Route
- - High motivation: TAILS, Whonix, Qubes OS Routes
+ + High motivation: TAILS, Whonix, Qubes OS Routes
- - High resources:
+ - High resources:
- - Low motivation: Any route
+ + Low motivation: Any route
- - Medium to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Medium to High motivation: TAILS, Whonix, Qubes OS Routes
-- Intermediate skills:
+- Intermediate skills:
- - Low resources:
+ - Low resources:
- - Low motivation: Any Route
+ + Low motivation: Any Route
- - Medium to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Medium to High motivation: TAILS, Whonix, Qubes OS Routes
- - Medium resources:
+ - Medium resources:
- - Low motivation: Any Route
+ + Low motivation: Any Route
- - Medium to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Medium to High motivation: TAILS, Whonix, Qubes OS Routes
- - High resources:
+ - High resources:
- - Low to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Low to High motivation: TAILS, Whonix, Qubes OS Routes
-- Highly skilled:
+- Highly skilled:
- - Low resources:
+ - Low resources:
- - Low motivation: Any Route
+ + Low motivation: Any Route
- - Medium to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Medium to High motivation: TAILS, Whonix, Qubes OS Routes
- - Medium resources:
+ - Medium resources:
- - Low to High motivation: TAILS, Whonix, Qubes OS Routes
+ + Low to High motivation: TAILS, Whonix, Qubes OS Routes
- - High resources:
+ - High resources:
- - Low to High motivations: TAILS, Whonix, Qubes OS Routes **(but likely out of scope from this guide as this is probably a global adversary)**
+ + Low to High motivations: TAILS, Whonix, Qubes OS Routes **(but likely out of scope from this guide as this is probably a global adversary)**
In all cases, you should read these two pages from the Whonix documentation that will give you in-depth insight into your choices:
-- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Warning)
+- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Warning)
-- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Dev/Threat_Model)
+- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Dev/Threat_Model)
-- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Comparison_with_Others)
+- [[Archive.org]](https://web.archive.org/web/https://www.whonix.org/wiki/Comparison_with_Others)
You might be asking yourself: "How do I know if I'm in a hostile online environment where activities are actively monitored and blocked?"
-- First read more about it at the EFF here: [[Archive.org]](https://web.archive.org/web/https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship)
+- First read more about it at the EFF here: [[Archive.org]](https://web.archive.org/web/https://ssd.eff.org/en/module/understanding-and-circumventing-network-censorship)
-- Check some data yourself here on the Tor Project OONI[^296] (Open Observatory of Network Interference) website:
+- Check some data yourself here on the Tor Project OONI[^296] (Open Observatory of Network Interference) website:
-- Have a look at and see if they have data about your country.
+- Have a look at and see if they have data about your country.
-- Specific to China, look at and [[Archive.org]](https://web.archive.org/web/https://www.usenix.org/system/files/sec21-hoang.pdf)
+- Specific to China, look at and [[Archive.org]](https://web.archive.org/web/https://www.usenix.org/system/files/sec21-hoang.pdf)
-- Test for yourself using OONI (this can be risky in a hostile environment).
+- Test for yourself using OONI (this can be risky in a hostile environment).
## Steps for all routes
@@ -1565,7 +1553,7 @@ See [Appendix A2: Guidelines for passwords and passphrases].
This is rather easy. Leave your smartphone on and at home. Have some cash and go to some random flea market or small shop (ideally one without CCTV inside or outside and while avoiding being photographed/filmed) and just buy the cheapest phone you can find with cash and without providing any personal information. It only needs to be in working order.
-*A note regarding your current phone:* The point of leaving your smartphone on is to create avoid leaking the fact that you're not using the device. If a smartphone is turned off, this creates a metadata trail that can be used to correlate the time your smartphone was turned off with the activation of your burner. If possible, leave your phone doing something (for example, watching YouTube on auto-play) to obscure the metadata trail further. This will not make it impossible to correlate your inactivity, but may make it more difficult if your phone's usage patterns can look convincing while you buy your burner.
+_A note regarding your current phone:_ The point of leaving your smartphone on is to create avoid leaking the fact that you're not using the device. If a smartphone is turned off, this creates a metadata trail that can be used to correlate the time your smartphone was turned off with the activation of your burner. If possible, leave your phone doing something (for example, watching YouTube on auto-play) to obscure the metadata trail further. This will not make it impossible to correlate your inactivity, but may make it more difficult if your phone's usage patterns can look convincing while you buy your burner.
We would recommend getting an old "dumbphone" with a removable battery (old Nokia if your mobile networks still allow those to connect as some countries phased out 1G-2G completely). This is to avoid the automatic sending/gathering of any telemetry/diagnostic data on the phone itself. You should never connect that phone to any Wi-Fi.
@@ -1573,7 +1561,7 @@ We would recommend getting an old "dumbphone" with a removable battery (old Noki
It will also be crucial not to power on that burner phone ever (not even without the SIM card) in any geographical location that could lead to you (at your home/work for instance) and never at the same location as your other known smartphone (because that one has an IMEI/IMSI that will easily lead to you). This might seem like a big burden, but it is not as these phones are only being used during the setup/sign-up process and for verification from time to time.
-See [Appendix N: Warning about smartphones and smart devices]
+See [Appendix N: Warning about smartphones and smart devices](#appendix-n-warning-about-smartphones-and-smart-devices)
You should test that the phone is in working order before going to the next step. But we will repeat ourselves and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either.
@@ -1587,7 +1575,7 @@ So here is a list of places where you can still get them now: [[Tor Mirror]](http://cryptonx6nsmspsnpicuihgmbbz3qvro4na35od3eht4vojdo7glm6yd.onion) [[Archive.org]](https://web.archive.org/web/https://crypton.sh/)
+ - (Iceland based, accepts Monero) [[Tor Mirror]](http://cryptonx6nsmspsnpicuihgmbbz3qvro4na35od3eht4vojdo7glm6yd.onion) [[Archive.org]](https://web.archive.org/web/https://crypton.sh/)
- - (Ukraine based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://virtualsim.net/)
+ - (Ukraine based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://virtualsim.net/)
-- Do require identification (valid e-mail):
+- Do require identification (valid e-mail):
- - (US California based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://mobilesms.io/)
+ - (US California based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://mobilesms.io/)
- - (Germany based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://www.sms77.io/)
+ - (Germany based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://www.sms77.io/)
- - (Russia based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://onlinesim.ru/)
+ - (Russia based, accepts Monero) [[Archive.org]](https://web.archive.org/web/https://onlinesim.ru/)
There are some other possibilities listed here [[Archive.org]](https://web.archive.org/web/https://cryptwerk.com/companies/sms/xmr/). **Use at your own risk.**
Now, what if you have no money? Well, in that case, you will have to try your luck with free services and hope for the best. Here are some examples, **use at your own risk**:
--
+-
--
+-
--
+-
**Disclaimer: We cannot vouch for any of these providers. We recommend doing it yourself physically. In this case, you will have to rely on the anonymity of Monero and you should not use any service that requires any kind of identification using your real identity. Please do read [Appendix B2: Monero Disclaimer].**
@@ -1651,9 +1639,9 @@ This can be anywhere that will not be tied to you directly (your home/work) and
If you think Starbucks is a clever idea, you may reconsider:
-- They probably have CCTVs in all their shops and keep those recordings for an unknown amount of time.
+- They probably have CCTVs in all their shops and keep those recordings for an unknown amount of time.
-- You will need to buy a coffee to get the Wi-Fi access code in most. If you pay for this coffee with an electronic method, they will be able to tie your Wi-Fi access with your identity.
+- You will need to buy a coffee to get the Wi-Fi access code in most. If you pay for this coffee with an electronic method, they will be able to tie your Wi-Fi access with your identity.
Situational awareness is key, and you should be constantly aware of your surroundings and avoid touristy places like it was plagued by Ebola. You want to avoid appearing on any picture/video of anyone while someone is taking a selfie, making a TikTok video, or posting some travel pictures on their Instagram. If you do, remember chances are high that those pictures will end up online (publicly or privately) with full metadata attached to them (time/date/geolocation) and your face. Remember these can and will be indexed by Facebook/Google/Yandex/Apple and probably all three letters' agencies.
@@ -1685,77 +1673,77 @@ Please see [Appendix Y: Installing and using desktop Tor Browser].
"**Connection Assist** works by looking up and downloading an up-to-date list of country-specific options to try using your location (with your consent). It manages to do so without needing to connect to the Tor Network first by utilizing [moat](https://support.torproject.org/glossary/moat/) – the same domain-fronting tool that Tor Browser uses to request a bridge from torproject.org."
-- Head over to:
+- Head over to:
- - Play Store:
+ - Play Store:
- - F-Droid Store: It's not yet there but you can add it manually following the instructions at [[Archive.org]](https://web.archive.org/web/https://support.torproject.org/tormobile/tormobile-7/)
+ - F-Droid Store: It's not yet there but you can add it manually following the instructions at [[Archive.org]](https://web.archive.org/web/https://support.torproject.org/tormobile/tormobile-7/)
-- Install
+- Install
-- Launch Tor Browser
+- Launch Tor Browser
-- After launching, click the upper right **Settings** icon
+- After launching, click the upper right **Settings** icon
-- Select **Settings** > **Privacy and security** > **Tor network**
+- Select **Settings** > **Privacy and security** > **Tor network**
-- Select **Config Bridge**.
+- Select **Config Bridge**.
-- Read [Appendix X: Using Tor bridges in hostile environments].
+- Read [Appendix X: Using Tor bridges in hostile environments].
-- **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want:
+- **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want:
- - Obfs4
+ - Obfs4
- - Meek-Azure
+ - Meek-Azure
- - Snowflake
+ - Snowflake
-- **If your internet isn't censored**, consider running one of the bridge types to help the network!
+- **If your internet isn't censored**, consider running one of the bridge types to help the network!
- - Easy: Obsf4 - You can run your own Obsf4 easily with these instructions.
+ - Easy: Obsf4 - You can run your own Obsf4 easily with these instructions.
- - Medium: Snowflake - More about Snowflakes here.
+ - Medium: Snowflake - More about Snowflakes here.
- - Hard: Meek - This is the documentation. It's not as simple.
+ - Hard: Meek - This is the documentation. It's not as simple.
Personally, if you need to use a Bridge (this is not necessary for a non-hostile environment), you should pick a Meek-Azure. Those will probably work even if you are in China and want to bypass the Great Firewall. It is probably the best option to obfuscate your Tor activities if needed and Microsoft servers are usually not blocked.
-*Only available for Desktop Tor users: Recently, the Tor Project has made it incredibly simple to access Bridges with **Connection Assist**, and it is now automatically done in hostile or censored regions. Simply open the Tor Browser and the connection will be configured based on your needs on any hostile network. Previously, we had a list of options below this paragraph which were necessary to enable and configure bridges, but now that this is done automatically using [moat](https://support.torproject.org/glossary/moat/).* [[Archive.org]](https://web.archive.org/web/20220801151048/https://support.torproject.org/glossary/moat/)
+_Only available for Desktop Tor users: Recently, the Tor Project has made it incredibly simple to access Bridges with **Connection Assist**, and it is now automatically done in hostile or censored regions. Simply open the Tor Browser and the connection will be configured based on your needs on any hostile network. Previously, we had a list of options below this paragraph which were necessary to enable and configure bridges, but now that this is done automatically using [moat](https://support.torproject.org/glossary/moat/)._ [[Archive.org]](https://web.archive.org/web/20220801151048/https://support.torproject.org/glossary/moat/)
-- You are almost done
+- You are almost done
As with the desktop version, you need to know there are safety levels in Tor Browser. On Android, you can access these by following these steps:
-- Click the menu (bottom right)
+- Click the menu (bottom right)
-- Click **Settings**.
+- Click **Settings**.
-- Head over to the **Privacy and security** section.
+- Head over to the **Privacy and security** section.
-- Click **Security Settings**.
+- Click **Security Settings**.
You will find details about each level here: [[Archive.org]](https://web.archive.org/web/https://tb-manual.torproject.org/security-settings/) but here is a summary:
-- Standard (the default):
+- Standard (the default):
- - All features are enabled (including JavaScript)
+ - All features are enabled (including JavaScript)
-- Safer:
+- Safer:
- - JavaScript is disabled on non-HTTPS websites
+ - JavaScript is disabled on non-HTTPS websites
- - Some fonts and symbols are disabled
+ - Some fonts and symbols are disabled
- - Any media playback is "click to play" (disabled by default)
+ - Any media playback is "click to play" (disabled by default)
-- Safest:
+- Safest:
- - Javascript is disabled everywhere
+ - Javascript is disabled everywhere
- - Some fonts and symbols are disabled
+ - Some fonts and symbols are disabled
- - Any media playback is "click to play" (disabled by default)
+ - Any media playback is "click to play" (disabled by default)
We would recommend the "Safer" level for most cases. The Safest level should be enabled if you think you are accessing suspicious or dangerous websites and/or if you are extra paranoid.
@@ -1773,89 +1761,89 @@ Now, you are really done, and you can now surf the web anonymously from your And
While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project[^300].
-- Head over to
+- Head over to
-- Install
+- Install
-- Disable Wi-Fi and Mobile Data
+- Disable Wi-Fi and Mobile Data
-- Launch Onion Browser
+- Launch Onion Browser
-- After Launching, click the upper right Settings icon (Disabling Wi-Fi and Mobile Data previously were to prevent Onion Browser from connecting automatically and to allow access to these options).
+- After Launching, click the upper right Settings icon (Disabling Wi-Fi and Mobile Data previously were to prevent Onion Browser from connecting automatically and to allow access to these options).
-- Select "Bridge Configuration" and read [Appendix X: Using Tor bridges in hostile environments]
+- Select "Bridge Configuration" and read [Appendix X: Using Tor bridges in hostile environments]
-- **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want:
+- **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want:
- - Obfs4
+ - Obfs4
- - Snowflake
+ - Snowflake
- - (Meek-Azure is unfortunately not available on Onion Browser for iOS (See [commit 21bc18428](https://github.com/OnionBrowser/OnionBrowser/commit/21bc18428368224507b27ee58464ad352f4ec810) for more information.)
+ - (Meek-Azure is unfortunately not available on Onion Browser for iOS (See [commit 21bc18428](https://github.com/OnionBrowser/OnionBrowser/commit/21bc18428368224507b27ee58464ad352f4ec810) for more information.)
-- **If your internet isn't censored**, consider running one of the bridge types to help the network!
+- **If your internet isn't censored**, consider running one of the bridge types to help the network!
- - Easy: Obsf4 - You can run your own Obsf4 easily with these instructions.
+ - Easy: Obsf4 - You can run your own Obsf4 easily with these instructions.
- - Medium: Snowflake - More about Snowflakes here.
+ - Medium: Snowflake - More about Snowflakes here.
- - Hard: Meek - This is the documentation. It's not as simple.
+ - Hard: Meek - This is the documentation. It's not as simple.
Personally, if you need to use a Bridge (this is not necessary for a non-hostile environment), you should pick a Snowflake one (since Meek-Azure bridges are not available). Those will probably work even if you are in China and want to bypass the Great Firewall. It is probably the best option you have on iOS.
-- You are almost done
+- You are almost done
As with the desktop version, you need to know there are safety levels in Onion Browser. On iOS, you can access these by following these steps:
-- Click the shield icon (upper left)
+- Click the shield icon (upper left)
-- You will have three levels to pick from
+- You will have three levels to pick from
- - 1. Gold: Ideal if you are suspicious, paranoid, or accessing what you think are dangerous resources.
+ - 1. Gold: Ideal if you are suspicious, paranoid, or accessing what you think are dangerous resources.
- - JavaScript is disabled
+ + JavaScript is disabled
- - WebSockets, Geolocation, and XHR are disabled
+ + WebSockets, Geolocation, and XHR are disabled
- - No Video or Audio
+ + No Video or Audio
- - Links cannot open Apps
+ + Links cannot open Apps
- - WebRTC is blocked
+ + WebRTC is blocked
- - Mixed HTTP/HTTPS is blocked
+ + Mixed HTTP/HTTPS is blocked
- - Ads and Pop-Ups are blocked
+ + Ads and Pop-Ups are blocked
- - 2. Silver:
+ - 2. Silver:
- - JavaScript partially allowed
+ + JavaScript partially allowed
- - WebSockets, Geolocation, and XHR are disabled
+ + WebSockets, Geolocation, and XHR are disabled
- - No Video or Audio
+ + No Video or Audio
- - Links cannot open Apps
+ + Links cannot open Apps
- - WebRTC is blocked
+ + WebRTC is blocked
- - Mixed HTTP/HTTPS is blocked
+ + Mixed HTTP/HTTPS is blocked
- - Ads and Pop-Ups are blocked
+ + Ads and Pop-Ups are blocked
- - 3. Bronze (not recommended):
+ - 3. Bronze (not recommended):
- - JavaScript allowed
+ + JavaScript allowed
- - Audio and Video allowed
+ + Audio and Video allowed
- - Links cannot open Apps
+ + Links cannot open Apps
- - WebRTC is not blocked
+ + WebRTC is not blocked
- - Mixed HTTP/HTTPS is not blocked
+ + Mixed HTTP/HTTPS is not blocked
- - Ads and Pop-Ups are blocked
+ + Ads and Pop-Ups are blocked
We would recommend the "Silver" level for most cases. The Gold level should only be enabled if you think you are accessing suspicious or dangerous websites or if you are extra paranoid. The Gold mode will also most likely break many websites that rely actively on JavaScript.
@@ -1873,13 +1861,13 @@ If you have time and want to learn, we recommend going for other routes instead
This part of the guide will help you in setting up Tails if one of the following is true:
-- You cannot afford a dedicated laptop
+- You cannot afford a dedicated laptop
-- Your dedicated laptop is just too old and too slow
+- Your dedicated laptop is just too old and too slow
-- You have very low IT skills
+- You have very low IT skills
-- You decide to go with Tails anyway
+- You decide to go with Tails anyway
Tails[^301] stands for **The Amnesic Incognito Live System**. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network.
@@ -1891,17 +1879,17 @@ Tails is an amazingly straightforward way to get going in no time with what you
It does however have some drawbacks:
-- Tails uses Tor and therefore you will be using Tor to access any resource on the internet. This alone will make you suspicious to most platforms where you want to create anonymous accounts (this will be explained in more detail later).
+- Tails uses Tor and therefore you will be using Tor to access any resource on the internet. This alone will make you suspicious to most platforms where you want to create anonymous accounts (this will be explained in more detail later).
-- Your ISP (whether it is yours or some public Wi-Fi) will also see that you are using Tor, and this could make you suspicious in itself.
+- Your ISP (whether it is yours or some public Wi-Fi) will also see that you are using Tor, and this could make you suspicious in itself.
-- Tails does not include (natively) some of the software you might want to use later which will complicate things quite a bit if you want to run some specific things (Android Emulators for instance).
+- Tails does not include (natively) some of the software you might want to use later which will complicate things quite a bit if you want to run some specific things (Android Emulators for instance).
-- Tails uses Tor Browser which while it is very secure will be detected as well by most platforms and will hinder you in creating anonymous identities on many platforms.
+- Tails uses Tor Browser which while it is very secure will be detected as well by most platforms and will hinder you in creating anonymous identities on many platforms.
-- Tails will not protect you more from the 5$ wrench[^11].
+- Tails will not protect you more from the 5$ wrench[^11].
-- Tor in itself might not be enough to protect you from an adversary with enough resources as explained earlier.
+- Tor in itself might not be enough to protect you from an adversary with enough resources as explained earlier.
**Important Note: If your laptop is monitored/supervised and some local restrictions are in place, please read** [Appendix U: How to bypass (some) local restrictions on supervised computers]**.**
@@ -1919,25 +1907,25 @@ If you're having an issue accessing Tor due to censorship or other issues, you c
When using Tor Browser, you should click the little shield Icon (upper right, next to the Address bar) and select your Security level (see [[Archive.org]](https://web.archive.org/web/https://tb-manual.torproject.org/security-settings/) for details). Basically, there are three.
-- Standard (the default):
+- Standard (the default):
- - All features are enabled (including JavaScript)
+ - All features are enabled (including JavaScript)
-- Safer:
+- Safer:
- - JavaScript is disabled on non-HTTPS websites
+ - JavaScript is disabled on non-HTTPS websites
- - Some fonts and symbols are disabled
+ - Some fonts and symbols are disabled
- - Any media playback is "click to play" (disabled by default)
+ - Any media playback is "click to play" (disabled by default)
-- Safest:
+- Safest:
- - Javascript is disabled everywhere
+ - Javascript is disabled everywhere
- - Some fonts and symbols are disabled
+ - Some fonts and symbols are disabled
- - Any media playback is "click to play" (disabled by default)
+ - Any media playback is "click to play" (disabled by default)
We would recommend the "Safer" level for most cases. The Safest level should be enabled if you think you are accessing suspicious or dangerous websites or if you are extra paranoid. The Safest mode will also most likely break many websites that rely actively on JavaScript.
@@ -1961,11 +1949,11 @@ This would allow the creation of a hybrid system mixing Tails with the Virtualiz
In short:
-- You could run non-persistent Tails from one USB key (following their recommendations)
+- You could run non-persistent Tails from one USB key (following their recommendations)
-- You could store persistent VMs within a secondary container that could be encrypted normally or using the Veracrypt plausible deniability feature (these could be Whonix VMs for instance or any other).
+- You could store persistent VMs within a secondary container that could be encrypted normally or using the Veracrypt plausible deniability feature (these could be Whonix VMs for instance or any other).
-- You do benefit from the added Tor Stream Isolation feature (see [Tor over VPN] for more info about stream isolation).
+- You do benefit from the added Tor Stream Isolation feature (see [Tor over VPN] for more info about stream isolation).
In that case, as the project outlines it, there should be no traces of any of your activities on your computer and the sensitive work could be done from VMs stored into a Hidden container that should not be easily discoverable by a soft adversary.
@@ -1983,65 +1971,65 @@ Remember that encryption with or without plausible deniability is not a silver b
CAUTION: Please see [**Appendix K: Considerations for using external SSD drives**][Appendix K: Considerations for using external SSD drives] and [**Understanding HDD vs SSD**][Understanding HDD vs SSD:] sections if you consider storing such hidden VMs on an external SSD drive:
-- **Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt**[^303]**.**
+- **Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt**[^303]**.**
-- **Use instead file containers instead of encrypted volumes.**
+- **Use instead file containers instead of encrypted volumes.**
-- **Make sure you do know how to clean data from an external SSD drive properly.**
+- **Make sure you do know how to clean data from an external SSD drive properly.**
Here is my guide on how to achieve this:
**First Run**
-- Download the latest HiddenVM release from [[Archive.org]](https://web.archive.org/web/https://github.com/aforensics/HiddenVM/releases)
+- Download the latest HiddenVM release from [[Archive.org]](https://web.archive.org/web/https://github.com/aforensics/HiddenVM/releases)
-- Download the latest Whonix XFCE release from