# The Hitchhiker's Guide to Online Anonymity (Or "How I learned to start worrying and love ~~privacy~~ anonymity") Version 1.1.6-pre1, August 2022 by Anonymous Planet **Forever in memory of Lena, 1999-2022** #### **IMPORTANT RECOMMENDATION FOR UKRAINIANS. ВАЖЛИВА РЕКОМЕНДАЦІЯ ДЛЯ УКРАЇНЦІВ** Це послання до народу України. Ми настійно рекомендуємо вам використовувати Briar для спілкування. Ви можете знайти його тут: , Швидкий початок: -------------------------------------------------------------------------- This is a message for the people of Ukraine. We strongly recommend that you use Briar for communicating. You can find it here: With this application, you can communicate even when there is no internet. The manual is here: , quick-start guide here: -------------------------------------------------------------------------- **This guide is a work in progress**. While we are doing the best we can to correct issues, inaccuracies, and improve the content, general structure, and readability; it will probably never be "finished". **There might be some wrong or outdated information in this guide because no human is omniscient, and humans do make mistakes.** **Please do not take this guide as a definitive gospel or truth because it is not. Mistakes have been written in the guide in earlier versions and fixed later when discovered. There are likely still some mistakes in this guide at this moment (hopefully few). Those are fixed as soon as possible when discovered.** **This guide has been moved, due to recent unfortunate events. The old guide was at [anonymousplanet.org](https://web.archive.org/web/20220227172123/https://anonymousplanet.org/), but has since been moved to ** **Your experience may vary.** **Remember to check regularly for an updated version of this guide.** This guide is a non-profit open-source initiative, licensed under Creative Commons **Attribution-NonCommercial** 4.0 International ([cc-by-nc-4.0][] ^{[[Archive.org]][27]}). - For mirrors see [Appendix A6: Mirrors] - For help in comparing versions see [Appendix A7: Comparing versions] Feel free to submit issues **(please do report anything wrong)** using GitHub Issues at: Feel free to come to discuss ideas at: - Rules for our chatrooms: - Matrix/Element Room: ```#anonymity:matrix.org``` - Matrix Space regrouping several rooms with similar interests: ```#privacy-security-anonymity:matrix.org``` . Follow us on: - Twitter at - Mastodon at To contact me, see the updated information on the website or send an e-mail to **Please consider [donating][Donations:] if you enjoy the project and want to support the hosting fees or support the funding of initiatives like the hosting of Tor Exit Nodes.** There are several ways you could read this guide: - You want to understand the current state of online privacy and anonymity not necessarily get too technical about it: Just read the [Introduction][Introduction:], [Requirements][Pre-requisites and limitations:], [Understanding some basics of how some information can lead back to you and how to mitigate those][Understanding some basics of how some information can lead back to you and how to mitigate some:] and [A final editorial note][A small final editorial note:] sections. - You want to do the above but also learn how to remove some online information about you: Just read the above and add the [Removing some traces of your identities on search engines and various platforms.][Removing some traces of your identities on search engines and various platforms:] - You want to do the above and create online anonymous identities online safely and securely: Read the whole guide. Precautions while reading this guide and accessing the various links: - **Documents/Files** have a **[Archive.org]** link next to them for accessing content through Archive.org for increased privacy and in case the content goes missing. Some links are not yet archived or outdated on archive.org in which case we encourage you to ask for a new save if possible. - **YouTube Videos** have a **[Invidious]** link next to them for accessing content through an Invidious Instance (in this case yewtu.be hosted in the Netherlands) for increased privacy. It is recommended to use these links when possible. See ^{[[Archive.org]][29]} for more information. - **Twitter** links have a **[Nitter]** link next to them for accessing content through a Nitter Instance (in this case nitter.net) for increased privacy. It is recommended to use these links when possible. See ^{[[Archive.org]][30]} for more information. - **Wikipedia** links have a **[Wikiless]** link next to them for accessing content through a Wikiless Instance (in this case Wikiless.org) for increased privacy. It is recommended to use these links when possible. See ^{[[Archive.org]][31]} for more information. - **Medium** links have **[Scribe.rip]** link next to them for accessing content through a Scribe.rip Instance for increased privacy. Again, it is recommended to use these links when possible. See ^{[[Archive.org]][32]} for more information. - If you are reading this in PDF or ODT format, you will notice plenty of \`\`\` in place of double quotes (""). These \`\`\` are there to ease conversion into Markdown/HTML format for online viewing of code blocks on the website. If you do not want the hassle and use one of the browsers below, you could also just install the following extension on your browser: ^{[[Archive.org]][33]}: - Firefox: - Chromium-based browsers (Chrome, Brave, Edge): **If you are having trouble accessing any of the many academic articles referenced in this guide due to paywalls, feel free to use Sci-Hub (** ^{[[Wikiless]][34]} ^{[[Archive.org]][35]}**) or LibGen (** ^{[[Wikiless]][36]} ^{[[Archive.org]][37]}**) for finding and reading them. Because Science should be free. All of it. If you are faced with a paywall accessing some resources, consider using .** Finally note that this guide does mention and even recommends various commercial services (such as VPNs, CDNs, e-mail providers, hosting providers...) **but is not endorsed or sponsored by any of them in any way. There are no referral links and no commercial ties with any of these providers. This project is 100% non-profit and only relying on donations.** # Contents: - [Pre-requisites and limitations:] - [Pre-requisites:] - [Limitations:] - [Introduction:] - [Understanding some basics of how some information can lead back to you and how to mitigate some:] - [Your Network:] - [Your IP address:] - [Your DNS and IP requests:] - [Your RFID enabled devices:] - [The Wi-Fi and Bluetooth devices around you:] - [Malicious/Rogue Wi-Fi Access Points:] - [Your Anonymized Tor/VPN traffic:] - [Some Devices can be tracked even when offline:] - [Your Hardware Identifiers:] - [Your IMEI and IMSI (and by extension, your phone number):] - [Your Wi-Fi or Ethernet MAC address:] - [Your Bluetooth MAC address:] - [Your CPU:] - [Your Operating Systems and Apps telemetry services:] - [Your Smart devices in general:] - [Yourself:] - [Your Metadata including your Geo-Location:] - [Your Digital Fingerprint, Footprint, and Online Behavior:] - [Your Clues about your Real Life and OSINT:] - [Your Face, Voice, Biometrics, and Pictures:] - [Phishing and Social Engineering:] - [Malware, exploits, and viruses:] - [Malware in your files/documents/e-mails:] - [Malware and Exploits in your apps and services:] - [Malicious USB devices:] - [Malware and backdoors in your Hardware Firmware and Operating System:] - [Your files, documents, pictures, and videos:] - [Properties and Metadata:] - [Watermarking:] - [Pixelized or Blurred Information:] - [Your Cryptocurrencies transactions:] - [Your Cloud backups/sync services:] - [Your Browser and Device Fingerprints:] - [Microarchitectural Side-channel Deanonymization Attacks:] - [Local Data Leaks and Forensics:] - [Bad Cryptography:] - [No logging but logging anyway policies:] - [Some Advanced targeted techniques:] - [Some bonus resources:] - [Notes:] - [General Preparations:] - [Picking your route:] - [Timing limitations:] - [Budget/Material limitations:] - [Skills:] - [Adversarial considerations:] - [Steps for all routes:] - [Getting used to using better passwords:] - [Getting an anonymous Phone number:] - [Get a USB key:] - [Find some safe places with decent public Wi-Fi:] - [The Tor Browser route:] - [Windows, Linux, and macOS:] - [Android:] - [iOS:] - [Important Warning:] - [The Tails route:] - [Tor Browser settings on Tails:] - [Persistent Plausible Deniability using Whonix within Tails:] - [Steps for all other routes:] - [Get a dedicated laptop for your sensitive activities:] - [Some laptop recommendations:] - [Bios/UEFI/Firmware Settings of your laptop:] - [Physically Tamper protect your laptop:] - [The Whonix route:] - [Picking your Host OS (the OS installed on your laptop):] - [Linux Host OS:] - [macOS Host OS:] - [Windows Host OS:] - [Virtualbox on your Host OS:] - [Pick your connectivity method:] - [Getting an anonymous VPN/Proxy:] - [Whonix:] - [Tor over VPN:] - [Whonix Virtual Machines:] - [Pick your guest workstation Virtual Machine:] - [Linux Virtual Machine (Whonix or Linux):] - [Windows 10/11 Virtual Machine:] - [Android Virtual Machine:] - [macOS Virtual Machine:] - [KeepassXC:] - [VPN client installation (cash/Monero paid):] - [(Optional) Allowing only the VMs to access the internet while cutting off the Host OS to prevent any leak:] - [Final step:] - [The Qubes Route:] - [Pick your connectivity method:][1] - [Getting an anonymous VPN/Proxy:][2] - [Note about Plausible Deniability:] - [Installation:] - [Lid Closure Behavior:] - [Anti Evil Maid (AEM):] - [Connect to a Public Wi-Fi:] - [Updating Qubes OS:] - [Updating Whonix from version 15 to version 16:] - [Hardening Qubes OS:] - [Setup the VPN ProxyVM:] - [Setup a safe Browser within Qubes OS (optional but recommended):] - [Setup an Android VM:] - [KeePassXC:][3] - [Quick note: Correlation vs Attribution:] - [Creating your anonymous online identities:] - [Understanding the methods used to prevent anonymity and verify identity:] - [Captchas:] - [Phone verification:] - [E-Mail verification:] - [User details checking:] - [Proof of ID verification:] - [IP Filters:] - [Browser and Device Fingerprinting:] - [Human interaction:] - [User Moderation:] - [Behavioral Analysis:] - [Financial transactions:] - [Sign-in with some platform:] - [Live Face recognition and biometrics (again):] - [Manual reviews:] - [Getting Online:] - [Creating new identities:] - [Checking if your Tor Exit Node is terrible:] - [The Real-Name System:] - [About paid services:] - [Overview:] - [How to share files privately and/or chat anonymously:] - [How to share files publicly but anonymously:] - [Redacting Documents/Pictures/Videos/Audio safely:] - [Communicating sensitive information to various known organizations:] - [Maintenance tasks:] - [Backing up your work securely:] - [Offline Backups:] - [Selected Files Backups:] - [Full Disk/System Backups:] - [Online Backups:] - [Files:] - [Information:] - [Synchronizing your files between devices Online:] - [Covering your tracks:] - [Understanding HDD vs SSD:] - [Wear-Leveling.] - [Trim Operations:] - [Garbage Collection:] - [Conclusion:] - [How to securely wipe your whole Laptop/Drives if you want to erase everything:] - [Linux (all versions including Qubes OS):] - [Windows:] - [macOS:] - [How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives:] - [Windows:][4] - [Linux (non-Qubes OS):] - [Linux (Qubes OS):] - [macOS:][5] - [Some additional measures against forensics:] - [Removing Metadata from Files/Documents/Pictures:] - [Tails:] - [Whonix:][6] - [macOS:][7] - [Linux (Qubes OS):][8] - [Linux (non-Qubes):] - [Windows:][9] - [Removing some traces of your identities on search engines and various platforms:] - [Google:] - [Bing:] - [DuckDuckGo:] - [Yandex:] - [Qwant:] - [Yahoo Search:] - [Baidu:] - [Wikipedia:] - [Archive.today:] - [Internet Archive:] - [Others:] - [Some low-tech old-school tricks:] - [Hidden communications in plain sight:] - [How to spot if someone has been searching your stuff:] - [Some last OPSEC thoughts:] - [**If you think you got burned:**] - [If you have some time:] - [If you have no time:] - [A small final editorial note:] - [Donations:] - [Helping others staying anonymous:] - [Acknowledgments:] - [Appendix A: Windows Installation] - [Installation:][10] - [Privacy Settings:] - [Appendix B: Windows Additional Privacy Settings] - [Appendix C: Windows Installation Media Creation] - [Appendix D: Using System Rescue to securely wipe an SSD drive.] - [Appendix E: Clonezilla] - [Appendix F: Diskpart] - [Appendix G: Safe Browser on the Host OS] - [If you can use Tor:] - [If you cannot use Tor:] - [Appendix H: Windows Cleaning Tools] - [Appendix I: Using ShredOS to securely wipe an HDD drive:] - [Windows:][11] - [Linux:] - [Appendix J: Manufacturer tools for Wiping HDD and SSD drives:] - [Tools that provide a boot disk for wiping from boot:] - [Tools that provide only support from running OS (for external drives).] - [Appendix K: Considerations for using external SSD drives] - [Windows:][12] - [Trim Support:] - [ATA/NVMe Operations (Secure Erase/Sanitize):] - [Linux:][13] - [Trim Support:][14] - [ATA/NVMe Operations (Secure Erase/Sanitize):][15] - [macOS:][16] - [Trim Support:][17] - [ATA/NVMe Operations (Secure Erase/Sanitize):][18] - [Appendix L: Creating a mat2-web guest VM for removing metadata from files] - [Appendix M: BIOS/UEFI options to wipe disks in various Brands] - [Appendix N: Warning about smartphones and smart devices] - [Appendix O: Getting an anonymous VPN/Proxy] - [Cash/Monero-Paid VPN:] - [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] - [VPN VPS:] - [Socks Proxy VPS:] - [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] - [Appendix Q: Using long-range Antenna to connect to Public Wi-Fis from a safe distance:] - [Appendix R: Installing a VPN on your VM or Host OS.] - [Appendix S: Check your network for surveillance/censorship using OONI] - [Appendix T: Checking files for malware] - [Integrity (if available):] - [Authenticity (if available):] - [Security (checking for actual malware):] - [Anti-Virus Software:] - [Manual Reviews:][19] - [Appendix U: How to bypass (some) local restrictions on supervised computers] - [Portable Apps:] - [Bootable Live Systems:] - [Precautions:] - [Appendix V: What browser to use in your Guest VM/Disposable VM] - [Brave:] - [Ungoogled-Chromium:] - [Edge:] - [Safari:] - [Firefox:] - [Tor Browser:] - [Appendix V1: Hardening your Browsers:] - [Brave:][20] - [Ungoogled-Chromium:][21] - [Edge:][22] - [Safari:][23] - [Firefox:][24] - [Normal settings:] - [Advanced settings:] - [Addons to install/consider:] - [Bonus resources:] - [Appendix W: Virtualization] - [Appendix X: Using Tor bridges in hostile environments] - [Appendix Y: Installing and using desktop Tor Browser] - [Installation:][25] - [Usage and Precautions:] - [Appendix Z: Online anonymous payments using cryptocurrencies] - [Reasonably anonymous option:] - [Extra-Paranoid anonymous option:] - [Warning about special tumbling, mixing, coinjoining privacy wallets and services] - [When converting from BTC to Monero:] - [Appendix A1: Recommended VPS hosting providers] - [Appendix A2: Guidelines for passwords and passphrases] - [Appendix A3: Search Engines] - [Appendix A4: Counteracting Forensic Linguistics] - [Introduction:][26] - [What does an adversary look for when examining your writing?] - [Examples:] - [How to counteract the efforts of your adversary:] - [What different linguistic choices could say about you:] - [Emoticons:] - [Structural features:] - [Spelling slang and symbols:] - [Techniques to prevent writeprinting:] - [Spelling and grammar checking:] - [Translation technique:] - [Search and replace:] - [Final advice:] - [Bonus links:] - [Appendix A5: Additional browser precautions with JavaScript enabled] - [Appendix A6: Mirrors] - [Appendix A7: Comparing versions] - [Appendix A8: Crypto Swapping Services without Registration and KYC] - [General Crypto Swapping:] - [BTC to Monero only:] - [Appendix A9: Installing a Zcash wallet:] - [Debian 11 VM:] - [Ubuntu 20.04/21.04/21.10 VM:] - [Windows 10/11 VM:] - [Whonix Workstation 16 VM:] - [Appendix B1: Checklist of things to verify before sharing information:] - [Appendix B2: Monero Disclaimer] - [Appendix B3: Threat modeling resources] - [References:] # Pre-requisites and limitations: ## Pre-requisites: - Understanding of the English language (in this case US English). - Be a permanent resident in Germany where the courts have upheld the legality of not using real names on online platforms (§13 VI of the German Telemedia Act of 2007[^1]'[^2]). **Alternatively, be a resident of any other country where you can confirm and verify the legality of this guide yourself.** - This guide will assume you already have access to some (Windows/Linux/macOS) laptop computer (ideally not a work/shared device) and a basic understanding of how it works. - Have patience as this process could take several weeks to complete if you want to go through all the content. - Have some free time on your hands to dedicate to this process (or a lot depending on the route you pick). - Be prepared to read a lot of references (do read them), guides (do not skip them), and follow a lot of how-to tutorials thoroughly (do not skip them either). - Don't be evil (for real this time)[^3]. ## Limitations: This guide is not intended for: - Creating machine accounts of any kind (bots). - Creating impersonation accounts of existing people (such as identity theft). - Helping malicious actors conduct unethical, criminal, or illicit activities (such as trolling, stalking, disinformation, misinformation, harassment, bullying...). - Use by minors. # Introduction: **TLDR for the whole guide: "A strange game. The only winning move is not to play"** [^4]**.** Making a social media account with a pseudonym or artist/brand name is easy. And it is enough in most use cases to protect your identity as the next George Orwell. There are plenty of people using pseudonyms all over Facebook/Instagram/Twitter/LinkedIn/TikTok/Snapchat/Reddit/... But the vast majority of those are anything but anonymous and can easily be traced to their real identity by your local police officers, random people within the OSINT[^5] (Open-Source Intelligence) community, and trolls[^6] on 4chan[^7]. This is a good thing as most criminals/trolls are not tech-savvy and will usually be identified with ease. But this is also a terrible thing as most political dissidents, human rights activists and whistleblowers can also be tracked rather easily. This guide aims to provide an introduction to various de-anonymization techniques, tracking techniques, ID verification techniques, and optional guidance to creating and maintaining **reasonably and truly** online anonymous identities including social media accounts safely. This includes mainstream platforms and not only the privacy-friendly ones. It is important to understand that the purpose of this guide is anonymity and not just privacy but much of the guidance you will find here will also help you improve your privacy and security even if you are not interested in anonymity. There is an important overlap in techniques and tools used for privacy, security, and anonymity but they differ at some point: - **Privacy is about people knowing who you are but not knowing what you are doing.** - **Anonymity is about people knowing what you are doing but not knowing who you are** [^8]**.** ![][38] (Illustration from[^9]) Will this guide help you protect yourself from the NSA, the FSB, Mark Zuckerberg, or the Mossad if they are out to find you? Probably not ... Mossad will be doing "Mossad things" [^10] and will probably find you no matter how hard you try to hide[^11]. You must consider your threat model[^12] before going further. ![][39] (Illustration by Randall Munroe, xkcd.com, licensed under CC BY-NC 2.5) Will this guide help you protect your privacy from OSINT researchers like Bellingcat[^13], Doxing[^14] trolls on 4chan[^15], and others that have no access to the NSA toolbox? More likely. Tho we would not be so sure about 4chan. Here is a basic simplified threat model for this guide: ![][40] (Note that the "magical amulets/submarine/fake your own death" jokes are quoted from the excellent article "This World of Ours" by James Mickens, 2014above[^10]) Disclaimer: Jokes aside (magical amulet...). Of course, there are also advanced ways to mitigate attacks against such advanced and skilled adversaries but those are just out of the scope of this guide. It is crucially important that you understand the limits of the threat model of this guide. And therefore, this guide will not double in size to help with those advanced mitigations as this is just too complex and will require an exceedingly high knowledge and skill level that is not expected from the targeted audience of this guide. The EFF provides a few security scenarios of what you should consider depending on your activity. While some of those tips might not be within the scope of this guide (more about Privacy than Anonymity), they are still worth reading as examples. See ^{[[Archive.org]][41]}. If you want to go deeper into threat modeling, see [Appendix B3: Threat modeling resources]. You might think this guide has no legitimate use but there are many[^16]'[^17]'[^18]'[^19]'[^20]'[^21]'[^22] such as: - Evading Online Censorship[^23] - Evading Online Oppression - Evading Online Stalking, Doxxing, and Harassment - Evading Online Unlawful Government Surveillance - Anonymous Online Whistle Blowing - Anonymous Online Activism - Anonymous Online Journalism - Anonymous Online Legal Practice - Anonymous Online Academic Activities (For instance accessing scientific research where such resources are blocked). See note below. - ... This guide is written with hope for those **good-intended individuals** who might not be knowledgeable enough to consider the big picture of online anonymity and privacy. **Lastly, use it at your own risk. Anything in here is not legal advice and you should verify compliance with your local law before use (IANAL**[^24]**). "Trust but verify"**[^25] **all the information yourself (or even better, "Never Trust, always verify"**[^391]**). We strongly encourage you to inform yourself and do not hesitate to check any information in this guide with outside sources in case of doubt. Please do report any mistake you spot to us as we welcome criticism. Even harsh but sound criticism is welcome and will result in having the necessary corrections made as quickly as possible.** # Understanding some basics of how some information can lead back to you and how to mitigate some: There are many ways you can be tracked besides browser cookies and ads, your e-mail, and your phone number. And if you think only the Mossad or the NSA/FSB can find you, you would be wrong. First, you could also consider these more general resources on privacy and security to learn more basics: - The New Oil*: ^{[[Archive.org]][42]} - Techlore videos*: ^{[[Invidious]][43]} - Privacy Guides: ^{[[Archive.org]][44]} - Privacy Tools*: ^{[[Archive.org]][45]} *Note that these websites could contain affiliate/sponsored content and/or merchandising. This guide does not endorse and is not sponsored by any commercial entity in any way.* If you skipped those, you should really still consider viewing this YouTube playlist from the Techlore Go Incognito project ( ^{[[Archive.org]][46]}) as an introduction before going further: ^{[[Invidious]][47]}. This guide will cover many of the topics in the videos of this playlist with more details and references as well as some added topics not covered within that series. This will just take you 2 or 3 hours to watch it all. **Now, here is a non-exhaustive list of some of the many ways you could be tracked and de-anonymized:** ## Your Network: ### Your IP address: **Disclaimer: this whole paragraph is about your public-facing Internet IP and not your local network IP.** Your IP address[^26] is the most known and obvious way you can be tracked. That IP is the IP you are using at the source. This is where you connect to the internet. That IP is usually provided by your ISP (Internet Service Provider) (xDSL, Mobile, Cable, Fiber, Cafe, Bar, Friend, Neighbor). Most countries have data retention regulations[^27] that mandate keeping logs of who is using what IP at a certain time/date for up to several years or indefinitely. Your ISP can tell a third party that you were using a specific IP at a specific date and time, years after the fact. If that IP (the original one) leaks at any point for any reason, it can be used to track down you directly. In many countries, you will not be able to have internet access without providing some form of identification to the provider (address, ID, real name, e-mail ...). Needless to say, that most platforms (such as social networks) will also keep (sometimes indefinitely) the IP addresses you used to sign-up and sign into their services. Here are some online resources you can use to find some information about your current **public IP** right now: - Find your IP: - - (Bonus, check your IP for DNS leaks) - Find your IP location or the location of any IP: - - Find if an IP is "suspicious" (in blocklists) or has downloaded "things" on some public resources: - - - (Take this with a grain of salt, it might not show anything interesting and has limited data sources. This is more for fun than anything serious.) - Registration information of an IP (most likely your ISP or the ISP of your connection who most likely know who is using that IP at any time): - - Check for open-services or open devices on an IP (especially if there are leaky Smart Devices on it): - (replace the IP by your IP or any other, or change in the search box, this example IP is a Tor Exit node) - Various tools to check your IP such as block-lists checkers and more: - - - Would you like to know if you are connected through Tor? - For those reasons, you will need to obfuscate and hide that origin IP (the one tied to your identification) or hide it through a combination of various means: - Using a public Wi-Fi service (free). - Using the Tor Anonymity Network[^28] (free). - Using VPN[^29] services anonymously (anonymously paid with cash or Monero). Do note that, unfortunately, these solutions are not perfect, and you will experience performance issues[^30]. All those will be explained later in this guide. ### Your DNS and IP requests: DNS stands for "Domain Name System"[^31] and is a service used by your browser (and other apps) to find the IP addresses of a service. It is a huge "contact list" (phone book for older people) that works like asking it a name and it returns the number to call. Except it returns an IP instead. Every time your browser wants to access a certain service such as Google through www.google.com. Your Browser (Chrome or Firefox) will query a DNS service to find the IP addresses of the Google web servers. Here is a video explaining DNS visually if you are already lost: ^{[[Invidious]][48]} Usually, the DNS service is provided by your ISP and automatically configured by the network you are connecting to. This DNS service could also be subject to data retention regulations or will just keep logs for other reasons (data collection for advertising purposes for instance). Therefore, this ISP will be capable of telling everything you did online just by looking at those logs which can, in turn, be provided to an adversary. Conveniently this is also the easiest way for many adversaries to apply censoring or parental control by using DNS blocking[^32]. The provided DNS servers will give you a different address (than their real one) for some websites (like redirecting thepiratebay.org to some government website). Such blocking is widely applied worldwide for certain sites[^33]. Using a private DNS service or your own DNS service would mitigate these issues, but the other problem is that most of those DNS requests are by default still sent in clear text (unencrypted) over the network. Even if you browse PornHub in an incognito Window, using HTTPS and using a private DNS service, chances are exceedingly high that your browser will send a clear text unencrypted DNS request to some DNS servers asking basically "So what's the IP address of www.pornhub.com?". Because it is not encrypted, your ISP and/or any other adversary could still intercept (using a Man-in-the-middle attack[^97]) your request will know and possibly log what your IP was looking for. The same ISP can also tamper with the DNS responses even if you are using a private DNS. Rendering the use of a private DNS service useless. As a bonus, many devices and apps will use hardcoded DNS servers bypassing any system setting you could set. This is for example the case with most (70%) Smart TVs and a large part (46%) of Game Consoles[^34]. For these devices, you will have to force them[^35] to stop using their hardcoded DNS service which could make them stop working properly. A solution to this is to use encrypted DNS using DoH (DNS over HTTPS[^36]), DoT (DNS over TLS[^37]) with a private DNS server (this can be self-hosted locally with a solution like pi-hole[^38], remotely hosted with a solution like nextdns.io or using the solutions provided by your VPN provider or the Tor network). This should prevent your ISP or some go-between from snooping on your requests ... except it might not. Small in-between Disclaimer: **This guide does not necessarily endorse or recommend Cloudflare services even if it is mentioned several times in this section for technical understanding.** Unfortunately, the TLS protocol used in most HTTPS connections in most Browsers (Chrome/Brave among them) will leak the Domain Name again through SNI[^39] handshakes (this can be checked here at Cloudflare: ^{[[Archive.org]][49]} ). **As of the writing of this guide, only Firefox-based browsers supports ECH (Encrypted Client Hello**[^40] **previously known as eSNI**[^41]**) on some websites which will encrypt everything end to end (in addition to using a secure private DNS over TLS/HTTPS) and will allow you to hide your DNS requests from a third party**[^42]**.** And this option is not enabled by default either so you will have to enable it yourself. ![][50] In addition to limited browser support, only web Services and CDNs[^43] behind Cloudflare CDN support ECH/eSNI at this stage[^44]. This means that ECH and eSNI are not supported (as of the writing of this guide) by most mainstream platforms such as: - Amazon (including AWS, Twitch...) - Microsoft (including Azure, OneDrive, Outlook, Office 365...) - Google (including Gmail, Google Cloud...) - Apple (including iCloud, iMessage...) - Reddit - YouTube - Facebook - Instagram - Twitter - GitHub - ... Some countries like Russia[^45] and China[^46] might (unverified despite the articles) block ECH/eSNI handshakes at the network level to allow snooping and prevent bypassing censorship. Meaning you will not be able to establish an HTTPS connection with a service if you do not allow them to see what it was. The issues do not end here. Part of the HTTPS TLS validation is called OCSP[^47] and this protocol used by Firefox-based browsers will leak metadata in the form of the serial number of the certificate of the website you are visiting. An adversary can then easily find which website you are visiting by matching the certificate number[^48]. This issue can be mitigated by using OCSP stapling[^49]. Unfortunately, this is enabled but not enforced by default in Firefox/Tor Browser. But the website you are visiting must also be supporting it and not all do. Chromium-based browsers on the other hand use a different system called CRLSets[^50]'[^51] which is arguably better. Here is a list of how various browsers behave with OCSP: ^{[[Archive.org]][51]} Here is an illustration of the issue you could encounter on Firefox-based browsers: ![][52] Finally, even if you use a custom encrypted DNS server (DoH or DoT) with ECH/eSNI support and OCSP stapling, it might still not be enough as traffic analysis studies[^52] have shown it is still possible to reliably fingerprint and block unwanted requests. Only DNS over Tor was able to show efficient DNS Privacy in recent studies but even that can still be defeated by other means (see [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]). One could also decide to use a Tor Hidden DNS Service or ODoH (Oblivious DNS over HTTPS[^53]) to further increase privacy/anonymity but **unfortunately**, as far as we know, these methods are only provided by Cloudflare as of this writing ( ^{[[Archive.org]][53]}, ^{[[Archive.org]][54]}). These are workable and reasonably secure technical options but there is also a moral choice if you want to use Cloudflare or not (despite the risk posed by some researchers[^54]). **Note that Oblivious DNS addresses an adversary that eavesdrops on one of the connections listed here but not all. It does not address a global passive adversary (GPA) who can eavesdrop on many or all of these connections**: - traffic between the client resolver and the recursive resolver - the recursive resolver and the ODNS resolver - the ODNS resolver and an authoritative server. Lastly, there is also this new possibility called DoHoT which stands for DNS over HTTPS over Tor which could also further increase your privacy/anonymity and which you could consider if you are more skilled with Linux. See ^{[[Archive.org]][55]}. This guide will not help you with this one at this stage, but it might be coming soon. Here is an illustration showing the current state of DNS and HTTPS privacy based on our current knowledge. ![][56] As for your normal daily use (non-sensitive), remember that only Firefox-based browsers support ECH (formerly eSNI) so far and that it is only useful with websites hosted behind Cloudflare CDN at this stage. If you prefer a Chrome-based version (which is understandable for some due to some better-integrated features like on-the-fly Translation), then we would recommend the use of Brave instead which supports all Chrome extensions and offers much better privacy than Chrome. But the story does not stop there right. Now because after all this, even if you encrypt your DNS and use all possible mitigations. Simple IP requests to any server will probably allow an adversary to still detect which site you are visiting. And this is simply because the majority of websites have unique IPs tied to them as explained here: ^{[[Archive.org]][57]}. This means that an adversary can create a dataset of known websites for instance including their IPs and then match this dataset against the IP you ask for. In most cases, this will result in a correct guess of the website you are visiting. This means that despite OCSP stapling, despite ECH/eSNI, despite using Encrypted DNS ... An adversary can still guess the website you are visiting anyway. Therefore, to mitigate all these issues (as much as possible and as best as we can), this guide will later recommend two solutions: Using Tor and a virtualized (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) multi-layered solution of VPN over Tor solution (DNS over VPN over Tor or DNS over TOR). Other options will also be explained (Tor over VPN, VPN only, No Tor/VPN) but are less recommended. ### Your RFID enabled devices: RFID stands for Radio-frequency identification[^55], it is the technology used for instance for contactless payments and various identification systems. Of course, your smartphone is among those devices and has RFID contactless payment capabilities through NFC[^56]. As with everything else, such capabilities can be used for tracking by various actors. But unfortunately, this is not limited to your smartphone, and you also probably carry some amount of RFID enabled device with you all the time such as: - Your contactless-enabled credit/debit cards - Your store loyalty cards - Your transportation payment cards - Your work-related access cards - Your car keys - Your national ID or driver license - Your passport - The price/anti-theft tags on object/clothing - ... While all these cannot be used to de-anonymize you from a remote online adversary, they can be used to narrow down a search if your approximate location at a certain time is known. For instance, you cannot rule out that some stores will effectively scan (and log) all RFID chips passing through the door. They might be looking for their loyalty cards but are also logging others along the way. Such RFID tags could be traced to your identity and allow for de-anonymization. More information over at Wikipedia: ^{[[Wikiless]][58]} ^{[[Archive.org]][59]} and ^{[[Wikiless]][58]} ^{[[Archive.org]][59]} The only way to mitigate this problem is to have no RFID tags on you or to shield them again using a type of Faraday cage. You could also use specialized wallets/pouches that specifically block RFID communications. Many of those are now made by well-known brands such as Samsonite[^57]. You should just not carry such RFID devices while conducting sensitive activities. See [Appendix N: Warning about smartphones and smart devices] ### The Wi-Fi and Bluetooth devices around you: Geolocation is not only done by using mobile antennas triangulation. It is also done using the Wi-Fi and Bluetooth devices around you. Operating systems makers like Google (Android[^58]) and Apple (IOS[^59]) maintain a convenient database of most Wi-Fi access points, Bluetooth devices, and their location. When your Android smartphone or iPhone is on (and not in Plane mode), it will scan actively (unless you specifically disable this feature in the settings) Wi-Fi access points, and Bluetooth devices around you and will be able to geolocate you with more precision than when using a GPS. This active and continuous probing can then be sent back to Google/Apple/Microsoft as part of their Telemetry. The issue is that this probing is unique and can be used to uniquely identify a user and track such user. Shops, for example, can use this technique to fingerprint customers including when they return, where they go in the shop and how long they stay at a particular place. There are several papers[^60]'[^61] and articles[^62] describing this issue in depth. This allows them to provide accurate locations even when GPS is off, but it also allows them to keep a convenient record of all Wi-Fi Bluetooth devices all over the world. Which can then be accessed by them or third parties for tracking. Note: If you have an Android smartphone, Google probably knows where it is no matter what you do. You cannot really trust the settings. The whole operating system is built by a company that wants your data. Remember that if it is free then you are the product. But that is not what all those Wi-Fi access points can do. Recently developed techs could even allow someone to track your movements accurately just based on radio interferences. What this means is that it is possible to track your movement inside a room/building based on the radio signals passing through. This might seem like a tinfoil hat conspiracy theory claim but here are the references[^63] with demonstrations showing this tech in action: ^{[[Archive.org]][60]} and the video here: ^{[[Invidious]][61]} Other researchers have found a way to count the people in a defined space using only Wi-Fi, see ^{[[Archive.org]][62]} You could therefore imagine many use cases for such technologies like recording who enters specific buildings/offices (hotels, hospitals, or embassies for instance) and then discover who meets who and thereby tracking them from outside. Even if they have no smartphone on them. ![][63] Again, such an issue could only be mitigated by being in a room/building that would act as a Faraday cage. Here is another video of the same kind of tech in action: ^{[[Invidious]][64]} See [Appendix N: Warning about smartphones and smart devices] There is not much you can do about these. Besides being non-identifiable in the first place. ### Malicious/Rogue Wi-Fi Access Points: These have been used at least since 2008 using an attack called "Jasager"[^64] and can be done by anyone using self-built tools or using commercially available devices such as Wi-Fi Pineapple[^65]. Here are some videos explaining more about the topic: - HOPE 2020, - YouTube, Hak5, Wi-Fi Pineapple Mark VII ^{[[Invidious]][65]} These devices can fit in a small bag and can take over the Wi-Fi environment of any place within their range. For instance, a Bar/Restaurant/Café/Hotel Lobby. These devices can force Wi-Fi clients to disconnect from their current Wi-Fi (using de-authentication, disassociation attacks[^66]) while spoofing the normal Wi-Fi networks at the same location. They will continue to perform this attack until your computer, or you decide to try to connect to the rogue AP. These devices can then mimic a captive portal[^67] with the exact same layout as the Wi-Fi you are trying to access (for instance an Airport Wi-Fi registration portal). Or they could just give you unrestricted access internet that they will themselves get from the same place. Once you are connected through the Rogue AP, this AP will be able to execute various man-in-the-middle attacks to perform analysis on your traffic. These could be malicious redirections or simple traffic sniffing. These can then easily identify any client that would for instance try to connect to a VPN server or the Tor Network. This can be useful when you know someone you want to de-anonymize is in a crowded place, but you do not know who. This would allow such an adversary to possibly fingerprint any website you visit despite the use of HTTPS, DoT, DoH, ODoH, VPN, or Tor using traffic analysis as pointed above in the DNS section. These can also be used to carefully craft and serve you advanced phishing webpages that would harvest your credentials or try to make you install a malicious certificate allowing them to see your encrypted traffic. How to mitigate those? If you do connect to a public wi-fi access point, use Tor, or use a VPN and then Tor (Tor over VPN) or even (VPN over Tor) to obfuscate your traffic from the rogue AP while still using it. ### Your Anonymized Tor/VPN traffic: Tor and VPNs are not silver bullets. Many advanced techniques have been developed and studied to de-anonymize encrypted Tor traffic over the years[^68]. Most of those techniques are Correlation attacks that will correlate your network traffic in one way or another to logs or datasets. Here are some examples: - **Correlation Fingerprinting Attack:** As illustrated (simplified) below, this attack will fingerprint your encrypted Tor traffic (like the websites you visited) based on the analysis of your encrypted traffic without decrypting it. Some of those methods can do so with a 96% success rate **in a closed-world setting**. **The efficacy of those methods in a real open-world setting** **has not been demonstrated yet and would probably require tremendous resources computing power making it very unlikely that such techniques would be used by a local adversary in the near future.** Such techniques could however hypothetically be used by an advanced and probably global adversary with access to your source network to determine some of your activity. Examples of those attacks are described in several research papers[^69]'[^70]'[^71] as well as their limitations[^72]. The Tor Project itself published an article about these attacks with some mitigations: ^{[[Archive.org]][66]}. ![][67] - **Correlation Timing Attacks:** As illustrated (simplified) below, an adversary that has access to network connection logs (IP or DNS for instance, remember that most VPN servers and most Tor nodes are known and publicly listed) at the source and the destination could correlate the timings to de-anonymize you without requiring any access to the Tor or VPN network in between. A real use case of this technique was done by the FBI in 2013 to de-anonymize[^73] a bomb threat hoax at Harvard University. ![][68] - **Correlation Counting Attacks:** As illustrated (simplified) below, an adversary that has no access to detailed connection logs (cannot see that you used Tor or Netflix) but has access to data counting logs could see that you have downloaded 600MB on a specific time/date that matches the 600MB upload at the destination. This correlation can then be used to de-anonymize you over time. ![][69] There are ways to mitigate these such as: - Do not use Tor/VPNs to access services that are on the same network (ISP) as the destination service. For example, do not connect to Tor from your University Network to access a University Service anonymously. Instead, use a different source point (such as a public Wi-Fi) that cannot be correlated easily by an adversary. - Do not use Tor/VPN from an obviously heavily monitored network (such as a corporate/governmental network) but instead try to find an unmonitored network such as a public Wi-Fi or a residential Wi-Fi. - Consider the use of multiple layers (such as what will be recommended in this guide later: VPN over Tor) so that an adversary might be able to see that someone connected to the service through Tor but will not be able to see that it was you because you were connected to a VPN and not the Tor Network. Be aware again that this might not be enough against a motivated global adversary[^74] with wide access to global mass surveillance. Such an adversary might have access to logs no matter where you are and could use those to de-anonymize you. Usually, these attacks are part of what is called a Sybil Attack[^75]. **These adversaries are out of the scope of this guide.** Be also aware that all the other methods described in this guide such as Behavioral analysis can also be used to deanonymize Tor users indirectly (see further [Your Digital Fingerprint, Footprint, and Online Behavior][Your Digital Fingerprint, Footprint, and Online Behavior:]). I also strongly recommend reading this very good, complete, and thorough (and more detailed) guide on most known Attack Vectors on Tor: ^{[[Archive.org]][70]} as well as this recent research publication ^{[[Archive.org]][71]} As well as this great series of blog posts: ^{[[Archive.org]][72]} Recently, one of these attacks was attempted on the Tor Network with more information here: ^{[[Archive.org]][73]} Lastly, do remember that using Tor can already be considered suspicious activity[^76], and its use could be considered malicious by some[^77]. This guide will later propose some mitigations to such attacks by changing your origin from the start (using public wi-fi's for instance). Remember that such attacks are usually carried by highly skilled, highly resourceful, and motivated adversaries and are out of scope from this guide. It is also recommended that you learn about practical correlation attacks, as performed by intelligence agencies: ^{[[Archive.org]][1385]} **Disclaimer: it should also be noted that Tor is not designed to protect against a global adversary. For more information see ^{[[Archive.org]][74]} and specifically, "Part 3. Design goals and assumptions.".** ### Some Devices can be tracked even when offline: You have seen this in action/spy/Sci-Fi movies and shows, the protagonists always remove the battery of their phones to make sure it cannot be used. Most people would think that's overkill. Well, unfortunately, no, this is now becoming true at least for some devices: - iPhones and iPads (IOS 13 and above)[^78]'[^79] - Samsung Phones (Android 10 and above)[^80] - MacBooks (macOS 10.15 and above)[^81] Such devices will continue to broadcast identity information to nearby devices even when offline using Bluetooth Low-Energy[^82]. They do not have access to the devices directly (which are not connected to the internet) but instead use BLE to find them through other nearby devices[^83]. They are using peer-to-peer short-range Bluetooth communication to broadcast their status through nearby online devices. They could now find such devices and keep the location in some database that could then be used by third parties or themselves for various purposes (including analytics, advertising, or evidence/intelligence gathering). See [Appendix N: Warning about smartphones and smart devices] TLDR: Do not take such devices with you when conducting sensitive activities. ## Your Hardware Identifiers: ### Your IMEI and IMSI (and by extension, your phone number): The IMEI (International Mobile Equipment Identity[^84]) and the IMSI (International Mobile Subscriber Identity[^85]) are unique numbers created by cell phone manufacturers and cell phone operators. The IMEI is tied directly to the phone you are using. This number is known and tracked by the cell phone operators and known by the manufacturers. Every time your phone connects to the mobile network, it will register the IMEI on the network along with the IMSI (if a SIM card is inserted but that is not even needed). It is also used by many applications (Banking apps abusing the phone permission on Android for instance[^86]) and smartphone Operating Systems (Android/IOS) for identification of the device[^87]. It is possible but difficult (and not illegal in many jurisdictions[^88]) to change the IMEI on a phone but it is probably easier and cheaper to just find and buy some old (working) Burner phone for a few Euros (this guide is for Germany remember) at a flea market or some random small shop. The IMSI is tied directly to the mobile subscription or pre-paid plan you are using and is tied to your phone number by your mobile provider. The IMSI is hardcoded directly on the SIM card and cannot be changed. Remember that every time your phone connects to the mobile network, it will also register the IMSI on the network along with the IMEI. Like the IMEI, the IMSI is also being used by some applications and smartphone Operating systems for identification and is being tracked. Some countries in the EU for instance maintain a database of IMEI/IMSI associations for easy querying by Law Enforcement. Today, giving away your (real) phone number is the same or better than giving away your Social Security number/Passport ID/National ID. The IMEI and IMSI can be traced back to you in at least six ways: - The mobile operator subscriber logs will usually store the IMEI along with the IMSI and their subscriber information database. If you use a prepaid anonymous SIM (anonymous IMSI but with a known IMEI), they could see this cell belongs to you if you used that cell phone before with a different SIM card (different anonymous IMSI but same known IMEI). - The mobile operator antenna logs will conveniently keep a log of which IMEI. IMSI also keep some connection data. They know and log for instance that a phone with this IMEI/IMSI combination connected to a set of mobile antennas and how powerful the signal to each of those antennas were, allowing easy triangulation/geolocation of the signal. They also know which other phones (your real one for instance) connected at the same time to the same antennas with the same signal. This makes it possible to know precisely that this "burner phone" was always connected at the same place/time than this other "known phone" which shows up every time the burner phone is being used. This information can/is used by various third parties to geolocate/track you quite precisely[^89]'[^90]. - The manufacturer of the Phone can trace back the sale of the phone using the IMEI if that phone was bought in a non-anonymous way. Indeed, they will have logs of each phone sale (including serial number and IMEI), to which shop/person to whom it was sold. And if you are using a phone that you bought online (or from someone that knows you). It can be traced to you using that information. Even if they do not find you on CCTV[^91] and you bought the phone using cash, they can still find what other phone (your real one in your pocket) was there (in that shop) at that time/date by using the antenna logs. - The IMSI alone can be used to find you as well because most countries now require customers to provide an ID when buying a SIM card (subscription or pre-paid). The IMSI is then tied to the identity of the buyer of the card. In the countries where the SIM can still be bought with cash (like the UK), they still know where (which shop) it was bought and when. This information can then be used to retrieve information from the shop itself (such as CCTV footage as for the IMEI case). Or again the antenna logs can also be used to figure out which other phone was there at the moment of the sale. - The smartphone OS makers (Google/Apple for Android/IOs) also keep logs of IMEI/IMSI identifications tied to Google/Apple accounts and which user has been using them. They too can trace back the history of the phone and to which accounts it was tied in the past[^92]. - Government agencies around the world interested in your phone number can and do use[^93] special devices called "IMSI catchers"[^94] like the Stingray[^95] or more recently the Nyxcell[^96]. These devices can impersonate (to spoof) a cell phone Antenna and force a specific IMSI (your phone) to connect to it to access the cell network. Once they do, they will be able to use various MITM[^97] (Man-In-The-Middle Attacks) that will allow them to: - Tap your phone (voice calls and SMS). - Sniff and examine your data traffic. - Impersonate your phone number without controlling your phone. - ... Here is also a good YouTube video on this topic: DEFCON Safe Mode - Cooper Quintin - Detecting Fake 4G Base Stations in Real-Time ^{[[Invidious]][75]} **For these reasons, it is crucial to get dedicated an anonymous phone number and/or an anonymous burner phone with an anonymous pre-paid sim card that is not tied to you in any way (past or present) for conducting sensitive activities (See more practical guidance in [Getting an anonymous Phone number][Getting an anonymous Phone number:] section).** While there are some smartphones manufacturers like Purism with their Librem series[^98] who claim to have your privacy in mind, they still do not allow IMEI randomization which we believe is a key anti-tracking feature that should be provided by such manufacturers. While this measure will not prevent IMSI tracking within the SIM card, it would at least allow you to keep the same "burner phone" and only switch SIM cards instead of having to switch both for privacy. See [Appendix N: Warning about smartphones and smart devices] ### Your Wi-Fi or Ethernet MAC address: The MAC address[^99] is a unique identifier tied to your physical Network Interface (Wired Ethernet or Wi-Fi) and could of course be used to track you if it is not randomized. As it was the case with the IMEI, manufacturers of computers and network cards usually keep logs of their sales (usually including things like serial number, IMEI, Mac Addresses, ...) and it is possible again for them to track where and when the computer with the MAC address in question was sold and to whom. Even if you bought it with cash in a supermarket, the supermarket might still have CCTV (or a CCTV just outside that shop) and again the time/date of sale could be used to find out who was there using the Mobile Provider antenna logs at that time (IMEI/IMSI). Operating Systems makers (Google/Microsoft/Apple) will also keep logs of devices and their MAC addresses in their logs for device identification (Find my device type services for example). Apple can tell that the MacBook with this specific MAC address was tied to a specific Apple Account before. Maybe yours before you decided to use the MacBook for sensitive activities. Maybe to a different user who sold it to you but remembers your e-mail/number from when the sale happened. Your home router/Wi-Fi access point keeps logs of devices that are registered on the Wi-Fi, and these can be accessed too to find out who has been using your Wi-Fi. Sometimes this can be done remotely (and silently) by the ISP depending on if that router/Wi-Fi access point is being "managed" remotely by the ISP (which is often the case when they provide the router to their customers). Some commercial devices will keep a record of MAC addresses roaming around for various purposes such as road congestion[^100]. **So, it is important again not to bring your phone along when/where you conduct sensitive activities. If you use your own laptop, then it is crucial to hide that MAC address (and Bluetooth address) anywhere you use it and be extra careful not to leak any information. Thankfully many recent OSes now feature or allow the possibility to randomize MAC addresses (Android, IOS, Linux, and Windows 10/11)** with the notable exception of macOS which does not support this feature even in its latest Big Sur version. See [Appendix N: Warning about smartphones and smart devices] ### Your Bluetooth MAC address: Your Bluetooth MAC is like the earlier MAC address except it is for Bluetooth. Again, it can be used to track you as manufacturers and operating system makers keep logs of such information. It could be tied to a sale place/time/date or accounts and then could be used to track you with such information, the shop billing information, the CCTV, or the mobile antenna logs in correlation. Operating systems have protections in place to randomize those addresses but are still subject to vulnerabilities[^101]. For this reason, and unless you really need those, you should just disable Bluetooth completely in the BIOS/UEFI settings if possible or in the Operating System otherwise. On Windows 10, you will need to disable and enable the Bluetooth device in the device manager itself to force randomization of the address for next use and prevent tracking. In general, this should not be too much of a concern compared to MAC Addresses. BT Addresses are randomized quite often. See [Appendix N: Warning about smartphones and smart devices] ## Your CPU: All modern CPUs[^102] are now integrating hidden management platforms such as the now infamous Intel Management Engine[^103] and the AMD Platform Security Processor[^104]. Those management platforms are small operating systems running directly on your CPU as long as they have power. These systems have full access to your computer's network and could be accessed by an adversary to de-anonymize you in various ways (using direct access or using malware for instance) as shown in this enlightening video: BlackHat, How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine ^{[[Invidious]][76]}. These have already been affected by several security vulnerabilities in the past[^105] that allowed malware to gain control of target systems. These are also accused by many privacy actors including the EFF and Libreboot of being a backdoor into any system[^106]. There are some not so straightforward ways[^107] to disable the Intel IME on some CPUs and you should do so if you can. For some AMD laptops, you can disable it within the BIOS settings by disabling PSP. Note that to AMD's defense, so far and AFAIK, there were no security vulnerabilities found for ASP and no backdoors either: See ^{[[Invidious]][77]}. In addition, AMD PSP does not provide any remote management capabilities contrary to Intel IME. If you are feeling a bit more adventurous, you could install your own BIOS using Libreboot or Coreboot [^108] if your laptop supports it (be aware that Coreboot does contain some propriety code unlike its fork Libreboot). In addition, some CPUs have unfixable flaws (especially Intel CPUs) that could be exploited by various malware. Here is a good current list of such vulnerabilities affecting recent widespread CPUs: ^{[[Wikiless]][78]} ^{[[Archive.org]][79]} Check yourself: - If you are using Linux you can check the vulnerability status of your CPU to Spectre/Meltdown attacks by using ^{[[Archive.org]][80]} which is available as a package for most Linux distros including Whonix. - If you are using Windows, you can check the vulnerability status of your CPU using inSpectre ^{[[Archive.org]][81]} Some of these can be avoided using Virtualization Software settings that can mitigate such exploits. See this guide for more information ^{[[Archive.org]][82]} (warning: these can severely impact the performance of your VMs). We will therefore mitigate some of these issues in this guide by recommending the use of virtual machines on a dedicated anonymous laptop for your sensitive activities that will only be used from an anonymous public network. **In addition, we recommend the use of AMD CPUs instead of Intel CPUs.** ## Your Operating Systems and Apps telemetry services: Whether it is Android, iOS, Windows, macOS, or even Ubuntu. Most popular Operating Systems now collect telemetry information by default even if you never opt-in or opted-out[^112] from the start. Some like Windows will not even allow disabling telemetry completely without some technical tweaks. This information collection can be extensive and include a staggering number of details (metadata and data) on your devices and their usage. Here are good overviews of what is being collected by those five popular OSes in their last versions: - Android/Google: - Just have a read at their privacy policy ^{[[Archive.org]][83]} - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google ^{[[Archive.org]][84]} - IOS/Apple: - More information at ^{[[Archive.org]][85]} and ^{[[Archive.org]][86]} - School of Computer Science & Statistics, Trinity College Dublin, Ireland Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google ^{[[Archive.org]][84]} - Apple does claim[^109] that they anonymize this data using differential privacy[^110] but you will have to trust them on that. - Windows/Microsoft: - Full list of required diagnostic data: ^{[[Archive.org]][87]} - Full list of optional diagnostic data: ^{[[Archive.org]][88]} - macOS: - More details on ^{[[Archive.org]][89]} - Ubuntu: - Ubuntu despite being a Linux distribution also collects Telemetry Data nowadays. This data however is quite limited compared to the others. More details on ^{[[Archive.org]][90]} Not only are Operating Systems gathering telemetry services but so are Apps themselves like Browsers, Mail Clients, and Social Networking Apps installed on your system. It is important to understand that this telemetry data can be tied to your device and help de-anonymizing you and later can be used against you by an adversary that would get access to this data. This does not mean for example that Apple devices are terrible choices for good Privacy (tho this might be changing[^111]), but they are certainly not the best choices for (relative) Anonymity. They might protect you from third parties knowing what you are doing but not from themselves. In all likelihood, they certainly know who you are. Later in this guide, we will use all the means at our disposal to disable and block as much telemetry as possible to mitigate this attack vector in the Operating Systems supported in this guide. These will include Windows, macOS, and even Linux in some regard. See [Appendix N: Warning about smartphones and smart devices] ## Your Smart devices in general: You got it; your smartphone is an advanced spying/tracking device that: - Records everything you say at any time ("Hey Siri", "Hey Google"). - Records your location everywhere you go. - Always records other devices around you (Bluetooth devices, Wi-Fi Access points). - Records your habits and health data (steps, screen time, exposure to diseases, connected devices data) - Records all your network locations. - Records all your pictures and videos (and most likely where they were taken). - Has most likely access to most of your known accounts including social media, messaging, and financial accounts. Data is being transmitted even if you opt-out[^112], processed, and stored indefinitely (most likely unencrypted[^113]) by various third parties[^114]. But that is not all, this section is not called "Smartphones" but "Smart devices" because it is not only your smartphone spying on you. It is also every other smart device you could have: - Your Smart Watch? (Apple Watch, Android Smartwatch ...) - Your Fitness Devices and Apps[^115]'[^116]? (Strava[^117]'[^118], Fitbit[^119], Garmin, Polar[^120], ...) - Your Smart Speaker? (Amazon Alexa[^121], Google Echo, Apple Homepod ...) - Your Smart Transportation? (Car? Scooter?) - Your Smart Tags? (Apple AirTag, Galaxy SmartTag, Tile...) - Your Car? (Yes, most modern cars have advanced logging/tracking features these days[^122]) - Any other Smart device? There are even convenient search engines dedicated to finding them online: - - - See [Appendix N: Warning about smartphones and smart devices] Conclusion: Do not bring your smart devices with you when conducting sensitive activities. ## Yourself: ### Your Metadata including your Geo-Location: Your metadata is all the information about your activities without the actual content of those activities. For instance, it is like knowing you had a call from an oncologist before then calling your family and friends successively. You do not know what was said during the conversation, but you can guess what it was just from the metadata[^123]. This metadata will also often include your location that is being harvested by Smartphones, Operating Systems (Android[^124]/IOS), Browsers, Apps, Websites. Odds are several companies are knowing exactly where you are at any time[^125] because of your smartphone[^126]. This location data has been used in many judicial cases[^127] already as part of "geofencing warrants" [^128] that allow law enforcement to ask companies (such as Google/Apple) a list of all devices present at a certain location at a certain time. In addition, this location data is even sold by private companies to the military who can then use it conveniently[^129]. These warrants are becoming widely used by law enforcement[^130]'[^131]'[^132]. If you want to experience yourself what a "geofencing warrant" would look like, here is an example: . Now let us say you are using a VPN to hide your IP. The social media platform knows you were active on that account on November 4th from 8 am to 1 pm with that VPN IP. The VPN allegedly keeps no logs and cannot trace back that VPN IP to your IP. Your ISP however knows (or at least can know) you were connected to that same VPN provider on November 4th from 7:30 am to 2 pm but does not know what you were doing with it. The question is: Is there someone somewhere that would have both pieces of information available[^133] for correlation in a convenient database? Have you heard of Edward Snowden[^134]? Now is the time to google him and read his book[^135]. Also read about XKEYSCORE[^136]'[^137], MUSCULAR[^138], SORM[^139], Tempora[^140] , and PRISM[^141]. See "We kill people based on Metadata"[^142] or this famous tweet from the IDF ^{[[Archive.org]][91]} ^{[[Nitter]][92]}. See [Appendix N: Warning about smartphones and smart devices] ### Your Digital Fingerprint, Footprint, and Online Behavior: This is the part where you should watch the documentary "The Social Dilemma"[^143] on Netflix as they cover this topic much better than anyone else. This includes is the way you write (stylometry) [^144]'[^145], the way you behave[^146]'[^147]. The way you click. The way you browse. The fonts you use on your browser[^148]. Fingerprinting is being used to guess who someone is by the way that user is behaving. You might be using specific pedantic words or making specific spelling mistakes that could give you away using a simple Google search for similar features because you typed comparably on some Reddit post 5 years ago using a not so anonymous Reddit account[^149]. The words you type in a search engine alone can be used against you as the authorities now have warrants to find users who used specific keywords in search engines[^150]. Social Media platforms such as Facebook/Google can go a step further and can register your behavior in the browser itself. For instance, they can register everything you type even if you do not send it / save it. Think of when you draft an e-mail in Gmail. It is saved automatically as you type. They can register your clicks and cursor movements as well. All they need to achieve this in most cases is Javascript enabled in your browser (which is the case in most Browsers including Tor Browser by default). Even with Javascript disabled, there are still ways to fingerprint you[^151]. While these methods are usually used for marketing purposes and advertising, they can also be a useful tool for fingerprinting users. This is because your behavior is unique or unique enough that over time, you could be de-anonymized. Here are some examples: - Specialized companies are selling to, for example, law enforcement agencies products for analyzing social network activities such as ^{[[Archive.org]][93]} - For example, as a basis of authentication, a user's typing speed, keystroke depressions, patterns of error (say accidentally hitting an "l" instead of a "k" on three out of every seven transactions) and mouse movements establish that person's unique pattern of behavior[^152]. Some commercial services such as TypingDNA ( ^{[[Archive.org]][94]}) even offer such analysis as a replacement for two-factor authentications. - This technology is also widely used in CAPTCHAS[^371] services to verify that you are "human" and can be used to fingerprint a user. - See [Appendix A4: Counteracting Forensic Linguistics]. Analysis algorithms could then be used to match these patterns with other users and match you to a different known user. It is unclear whether such data is already used or not by Governments and Law Enforcement agencies, but it might be in the future. And while this is mostly used for advertising/marketing/captchas purposes now. It could and probably will be used for investigations in the short or mid-term future to deanonymize users. Here is a fun example you try yourself to see some of those things in action: (no archive links for this one sorry). You will see it becoming interesting over time (this requires Javascript enabled). Here is also a recent example just showing what Google Chrome collects on you: Here are some other resources on the topic if you cannot see this documentary: - 2017, Behavior Analysis in Social Networks, ^{[[Archive.org]][95]} - 2017, Social Networks and Positive and Negative Affect ^{[[Archive.today]][96]} - 2015, Using Social Networks Data for Behavior and Sentiment Analysis ^{[[Archive.org]][97]} - 2016, A Survey on User Behavior Analysis in Social Networks ^{[[Archive.org]][98]} - 2017, DEF CON 25 presentation: [DEF CON 25 - Svea Eckert, Andreas Dewes - Dark Data](https://www.youtube.com/watch?v=1nvYGi7-Lxo) ^{[[Invidious]](https://yewtu.be/watch?v=1nvYGi7-Lxo)} - 2019, Influence and Behavior Analysis in Social Networks and Social Media ^{[[Archive.org]][99]} So, how can you mitigate these? - This guide will provide some technical mitigations using Fingerprinting resistant tools but those might not be sufficient. - You should apply common sense and try to find your own patterns in your behavior and behave differently when using anonymous identities. This includes: - The way you type (speed, accuracy...). - The words you use (be careful with your usual expressions). - The type of response you use (if you are sarcastic by default, try to have a different approach with your identities). - The way you use your mouse and click (try to solve the Captchas differently than your usual way) - The habits you have when using some Apps or visiting some Websites (do not always use the same menus/buttons/links to reach your content). - ... You need to act and fully adopt a role as an actor would do for a performance. You need to become a different person, think, and act like that person. This is not a technical mitigation but a human one. You can only rely on yourself for that. Ultimately, it is mostly up to you to fool those algorithms by adopting new habits and not revealing real information when using your anonymous identities. See [Appendix A4: Counteracting Forensic Linguistics]. ### Your Clues about your Real Life and OSINT: These are clues you might give over time that could point to your real identity. You might be talking to someone or posting on some board/forum/Reddit. In those posts, you might over time leak some information about your real life. These might be memories, experiences, or clues you shared that could then allow a motivated adversary to build a profile to narrow their search. A real use and well-documented case of this was the arrest of the hacker Jeremy Hammond[^153] who shared over time several details about his past and was later discovered. There are also a few cases involving OSINT at Bellingcat[^154]. Have a look at their very informative (but slightly outdated) toolkit here: ^{[[Archive.org]][100]} You can also view some convenient lists of some available OSINT tools here if you want to try them on yourself for example: - ^{[[Archive.org]][101]} - - - As well as this interesting Playlist on YouTube: ^{[[Invidious]][102]} As well as those interesting podcasts: You should never share real individual experiences/details using your anonymous identities that could later lead to finding your real identity. You will see more details about this in the [Creating new identities][Creating new identities:] section. ### Your Face, Voice, Biometrics, and Pictures: "Hell is other people", even if you evade every method listed above, you are not out of the woods yet thanks to the widespread use of advanced Face recognition by everyone. Companies like Facebook have used advanced face recognition for years[^155]'[^156] and have been using other means (Satellite imagery) to create maps of "people" around the world[^157]. This evolution has been going on for years to the point we can now say "we lost control of our faces"[^158]. If you are walking in a touristy place, you will most likely appear in someone's selfie within minutes without knowing it. That person could then go ahead and upload that selfie to various platforms (Twitter, Google Photos, Instagram, Facebook, Snapchat ...). Those platforms will then apply face recognition algorithms to those pictures under the pretext of allowing better/easier tagging or to better organize your photo library. In addition to this, the same picture will provide a precise timestamp and in most cases geolocation of where it was taken. Even if the person does not provide a timestamp and geolocation, it can still be guessed with other means[^159]'[^160]. Here are a few resources for even trying this yourself: - Bellingcat, Guide To Using Reverse Image Search For Investigations: ^{[[Archive.org]][103]} - Bellingcat, Using the New Russian Facial Recognition Site SearchFace ^{[[Archive.org]][104]} - Bellingcat, Dali, Warhol, Boshirov: Determining the Time of an Alleged Photograph from Skripal Suspect Chepiga ^{[[Archive.org]][105]} - Bellingcat, Advanced Guide on Verifying Video Content ^{[[Archive.org]][106]} - Bellingcat, Using the Sun and the Shadows for Geolocation ^{[[Archive.org]][107]} - Bellingcat, Navalny Poison Squad Implicated in Murders of Three Russian Activists ^{[[Archive.org]][108]} - Bellingcat, Berlin Assassination: New Evidence on Suspected FSB Hitman Passed to German Investigators ^{[[Archive.org]][109]} - Bellingcat, Digital Research Tutorial: Investigating a Saudi-Led Coalition Bombing of a Yemen Hospital ^{[[Invidious]][110]} - Bellingcat, Digital Research Tutorial: Using Facial Recognition in Investigations ^{[[Invidious]][111]} - Bellingcat, Digital Research Tutorial: Geolocating (Allegedly) Corrupt Venezuelan Officials in Europe ^{[[Invidious]][112]} ### Gait Recognition and Other Long-Range Biometrics Even if you are not looking at the camera, they can still figure out who you are[^161], make out your emotions[^162], analyze your gait[^163]'[^164]'[^165], read your lips[^166], analyze the behavior of your eyes[^167], and probably guess your political affiliation[^168]'[^169]. Contrary to popular belief and pop culture, modern gait recognition systems aren't fooled by simply changing how you walk (ex. with something uncomfortable in your shoe), as they analyze the way your body's muscles move across your entire body, as you perform certain actions. The best way to fool modern gait recognition is to wear loose clothes that obscure the way your muscles move as you perform actions. Other things than can be used to identify you include your earlobes, which are actually more identifiable than fingerprints, or even the shape of your skull. As such, soft headcoverings such as balaclavas are not recommendable for obscuring your identity - they make you look incredibly suspicious, while also conforming to the shape of your skull. ![][113] (Illustration from ^{[[Archive.org]][114]}) ![][115] (illustration from ^{[[Archive.org]][116]}) Those platforms (Google/Facebook) already know who you are for a few reasons: - Because you have or had a profile with them, and you identified yourself. - Even if you never made a profile on those platforms, you still have one without even knowing it[^170]'[^171]'[^172]'[^173]'[^174]. - Because other people have tagged you or identified you in their holidays/party pictures. - Because other people have put a picture of you in their contact list which they then shared with them. Here is also an insightful demo of Microsoft Azure you can try for yourself at where you can detect emotions and compare faces from different pictures. Governments already know who you are because they have your ID/Passport/Driving License pictures and often added biometrics (Fingerprints) in their database. Those same governments are integrating those technologies (often provided by private companies such as the Israeli Oosto[^175], Clearview AI[^176]'[^177], or NEC[^178]) in their CCTV networks to look for "persons of interest"[^179]. And some heavily surveilled states like China have implemented widespread use of Facial Recognition for various purposes[^180]'[^181] including possibly identifying ethnic minorities[^182]. A simple face recognition error by some algorithm can ruin your life[^183]'[^184]. Here are some resources detailing some techniques used by Law Enforcement today: - CCC video explaining current Law Enforcement surveillance capabilities: ^{[[Archive.org]][117]} - EFF SLS: ^{[[Archive.org]][118]} Apple is making FaceID mainstream and pushing its use to log you into many services including the Banking systems. The same goes with fingerprint authentication being mainstreamed by many smartphone makers to authenticate yourself. A simple picture where your fingers appear can be used to de-anonymize you[^185]'[^186]'[^187]'[^188]. The same goes with your voice which can be analyzed for various purposes as shown in the recent Spotify patent[^189]. Even your iris can be used for identification in some places[^190]. We can safely imagine a near future where you will not be able to create accounts or sign in anywhere without providing unique biometrics (A suitable time to re-watch Gattaca[^191], Person of Interest[^192] , and Minority Report[^193]). And you can safely imagine how useful these large biometrics databases could be to some interested third parties. In addition, all this information can also be used against you (if you are already de-anonymized) using deepfake[^194] by crafting false information (Pictures, Videos, Voice Recordings[^195]...) and have already been used for such purposes[^196]'[^197]. There are even commercial services for this readily available such as ^{[[Archive.org]][119]} and ^{[[Archive.org]][120]}. See this demo: ^{[[Invidious]][121]} At this time, there are a few steps[^198] you can use to mitigate (and only mitigate) face recognition when conducting sensitive activities where CCTV might be present: - Wear a facemask as they have been proven to defeat some face recognition technologies[^199] but not all[^200]. - Wear a baseball cap or hat to mitigate identification from high-angle CCTVs (filming from above) from recording your face. Remember this will not help against front-facing cameras. - Wear sunglasses in addition to the facemask and baseball cap to mitigate identification from your eye's features. - Consider wearing special sunglasses (expensive, unfortunately) called "Reflectacles" ^{[[Archive.org]][122]}. There was a small study showing their efficiency against IBM and Amazon facial recognition[^201]. - All that might still be useless because of gait recognition mentioned earlier but there might be hope here if you have a 3D Printer: ^{[[Archive.org]][123]} (see [Gait Recognition and Other Long-Range Biometrics]) (Note that if you intend to use these where advanced facial recognition systems have been installed, these measures could also flag as you as suspicious by themselves and trigger a human check) ### Phishing and Social Engineering: Phishing[^202] is a social engineering[^203] type of attack where an adversary could try to extract information from you by pretending or impersonating something/someone else. A typical case is an adversary using a man-in-the-middle[^97] attack or a fake e-mail/call to ask for your credential for a service. This could for example be through e-mail or through impersonating financial services. Such attacks can also be used to de-anonymize someone by tricking them into downloading malware or revealing personal information over time. The only defense against those is not to fall for them and common sense. These have been used countless times since the early days of the internet and the usual one is called the "419 scam" (see ^{[[Wikiless]][124]} ^{[[Archive.org]][125]}). Here is a good video if you want to learn a bit more about phishing types: Black Hat, Ichthyology: Phishing as a Science ^{[[Invidious]][126]}. ## Malware, exploits, and viruses: ### Malware in your files/documents/e-mails: Using steganography or other techniques, it is easy to embed malware into common file formats such as Office Documents, Pictures, Videos, PDF documents... These can be as simple as HTML tracking links or complex targeted malware. These could be simple pixel-sized images[^204] hidden in your e-mails that would call a remote server to try and get your IP address. These could be exploiting a vulnerability in an outdated format or an outdated reader[^205]. Such exploits could then be used to compromise your system. See these good videos for more explanations on the matter: - What is a File Format? ^{[[Invidious]][127]} - Ange Albertini: Funky File Formats: ^{[[Invidious]][128]} You should always use extreme caution. To mitigate these attacks, this guide will later recommend the use of virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) to mitigate leaking any information even in case of opening such a malicious file. If you want to learn how to try detecting such malware, see [Appendix T: Checking files for malware] ### Malware and Exploits in your apps and services: So, you are using Tor Browser or Brave Browser over Tor. You could be using those over a VPN for added security. But you should keep in mind that there are exploits[^206] (hacks) that could be known by an adversary (but unknown to the App/Browser provider). Such exploits could be used to compromise your system and reveal details to de-anonymize you such as your IP address or other details. A real use case of this technique was the Freedom Hosting[^207] case in 2013 where the FBI inserted malware[^208] using a Firefox browser exploit on a Tor website. This exploit allowed them to reveal details of some users. More recently, there was the notable SolarWinds[^209] hack that breached several US government institutions by inserting malware into an official software update server. In some countries, Malware is just mandatory and/or distributed by the state itself. This is the case for instance in China with WeChat[^210] which can then be used in combination with other data for state surveillance[^211]. There are countless examples of malicious browser extensions, smartphone apps, and various apps that have been infiltrated with malware over the years. Here are some steps to mitigate this type of attack: - You should never have 100% trust in the apps you are using. - You should always check that you are using the updated version of such apps before use and ideally validate each download using their signature if available. - You should not use such apps directly from a hardware system but instead, use a Virtual Machine for compartmentalization. To reflect these recommendations, this guide will therefore later guide you in the use of Virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]) so that even if your Browser/Apps get compromised by a skilled adversary, that adversary will find himself stuck in a sandbox[^212] without being able to access identifying information or compromise your system. ### Malicious USB devices: There are readily available commercial and cheap "badUSB" [^213]devices that can take deploy malware, log your typing, geolocate you, listen to you or gain control of your laptop just by plugging them in. Here are some examples that you can already buy yourself: - Hak5, USB Rubber Ducky ^{[[Archive.org]][129]} - Hak5, O.MG Cable ^{[[Invidious]][130]} - Keelog ^{[[Archive.org]][131]} - AliExpress ^{[[Archive.org]][132]} Such devices can be implanted anywhere (charging cable, mouse, keyboard, USB key ...) by an adversary and can be used to track you or compromise your computer or smartphone. The most notable example of such attacks is probably Stuxnet[^214] in 2005. While you could inspect a USB key physically, scan it with various utilities, check the various components to see if they are genuine, you will most likely never be able to discover complex malware embedded in genuine parts of a genuine USB key by a skilled adversary without advanced forensics equipment[^215]. To mitigate this, you should never trust such devices and plug them into sensitive equipment. If you use a charging device, you should consider the use of a USB data blocking device that will only allow charging but not any data transfer. Such data blocking devices are now readily available in many online shops. You should also consider disabling USB ports completely within the BIOS of your computer unless you need them (if you can). ### Malware and backdoors in your Hardware Firmware and Operating System: This might sound a bit familiar as this was already partially covered previously in the [Your CPU][Your CPU:] section. Malware and backdoors can be embedded directly into your hardware components. Sometimes those backdoors are implemented by the manufacturer itself such as the IME in the case of Intel CPUs. And in other cases, such backdoors can be implemented by a third party that places itself between orders of new hardware and customer delivery[^216]. Such malware and backdoors can also be deployed by an adversary using software exploits. Many of those are called rootkits[^217] within the tech world. Usually, these types of malware are harder to detect and mitigate as they are implemented at a lower level than the userspace[^218] and often in the firmware[^219] of hardware components itself. What is firmware? Firmware is a low-level operating system for devices. Each component in your computer probably has firmware including for instance your disk drives. The BIOS[^220]/UEFI[^221] system of your machine for instance is a type of firmware. These can allow remote management and are capable of enabling full control of a target system silently and stealthily. As mentioned previously, these are harder to detect by users but some limited steps that can be taken to mitigate some of those by protecting your device from tampering and use some measures (like re-flashing the bios for example). Unfortunately, if such malware or backdoor is implemented by the manufacturer itself, it becomes extremely difficult to detect and disable those. ## Your files, documents, pictures, and videos: ### Properties and Metadata: This can be obvious to many but not to all. Most files have metadata attached to them. Good examples are pictures that store EXIF[^222] information which can hold a lot of information such as GPS coordinates, which camera/phone model took it, and when it was taken precisely. While this information might not directly give out who you are, it could tell exactly where you were at a certain moment which could allow others to use various sources to find you (CCTV or other footage taken at the same place at the same time during a protest for instance). You must verify any file you would put on those platforms for any properties that might hold any information that might lead back to you. Here is an example of EXIF data that could be on a picture: ![][133] (Illustration from Wikipedia) This also works for videos. Yes, videos too have geo-tagging, and many are very unaware of this. Here Is for instance a very convenient tool to geo-locate YouTube videos: ^{[[Archive.org]][134]} For this reason, you will always have to be incredibly careful when uploading files using your anonymous identities and check the metadata of those files. **Even if you publish a plain text file, you should always double or triple-check it for any information leakage before publishing. You will find some guidance about this in the [Some additional measures against forensics][Some additional measures against forensics:] section at the end of the guide.** ### Watermarking: #### Pictures/Videos/Audio: Pictures/Videos often contain visible watermarks indicating who is the owner/creator but there are also invisible watermarks in various products aiming at identifying the viewer itself. So, if you are a whistleblower and thinking about leaking some picture/audio/video file. Think twice. There are chances that those might contain invisible watermarking within them that would include information about you as a viewer. Such watermarks can be enabled with a simple switch in like Zoom (Video[^223] or Audio[^224]) or with extensions[^225] for popular apps such as Adobe Premiere Pro. These can be inserted by various content management systems. For a recent example where someone leaking a Zoom meeting recording was caught because it was watermarked: ^{[[Tor Mirror]][135]} ^{[[Archive.org]][136]} Such watermarks can be inserted by various products[^226]'[^227]'[^228]'[^229] using Steganography[^230] and can resist compression[^231] and re-encoding[^232]'[^233]. These watermarks are not easily detectable and could allow identification of the source despite all efforts. In addition to watermarks, the camera used for filming (and therefore the device used for filming) a video can also be identified using various techniques such as lens identification[^234] which could lead to de-anonymization. Be extremely careful when publishing videos/pictures/audio files from known commercial platforms as they might contain such invisible watermarks in addition to details in the images themselves. There is no guaranteed 100% protection against those. You will have to use common sense. #### Printing Watermarking: Did you know your printer is most likely spying on you too? Even if it is not connected to any network? This is usually a known fact by many people in the IT community but few outside people. Yes ... Your printers can be used to de-anonymize you as well as explained by the EFF here ^{[[Archive.org]][137]} With this (old but still relevant) video explaining how from the EFF as well: ^{[[Invidious]][138]} Many printers will print an invisible watermark allowing for identification of the printer on every printed page. This is called Printer Steganography[^235]. There is no tangible way to mitigate this but to inform yourself on your printer and make sure it does not print any invisible watermark. This is important if you intend to print anonymously. Here is an (old but still relevant) list of printers and brands who do not print such tracking dots provided by the EFF ^{[[Archive.org]][139]} Here are also some tips from the Whonix documentation ( ^{[[Archive.org]][140]}): **Do not ever print in Color, usually, watermarks are not present without color toners/cartridges**[^236]**.** ### Pixelized or Blurred Information: Did you ever see a document with blurred text? Did you ever make fun of those movies/series where they "enhance" an image to recover seemingly impossible-to-read information? Well, there are techniques for recovering information from such documents, videos, and pictures. Here is for example an open-source project you could use yourself for recovering text from some blurred images yourself: ^{[[Archive.org]][141]} ![][142] This is of course an open-source project available for all to use. But you can imagine that such techniques have probably been used before by other adversaries. These could be used to reveal blurred information from published documents that could then be used to de-anonymize you. There are also tutorials for using such techniques using Photo Editing tools such as GIMP such as ^{[[Archive.org]][144]} followed by ^{[[Scribe.rip]][145]} ^{[[Archive.org]][146]} ![][147] Finally, you will find plenty of deblurring resources here: ^{[[Archive.org]][148]} Some online services could even help you do this automatically to some extent like MyHeritage.com enhance tool: ^{[[Archive.org]][149]} Here is the result of the above image: ![][150] Of course, this tool is more like "guessing" than really deblurring at this point, but it could be enough to find you using various reverse image searching services. There are also techniques to deblur/depixelate parts in videos: see ^{[[Archive.org]][1371]} For this reason, it is always extremely important that you correctly redact and curate any document you might want to publish. Blurring is not enough, and you should always completely blacken/remove any sensitive data to avoid any attempt at recovering data from any adversary. Do not pixelized, do not blur, just put a hard black rectangle to redact information. ## Your Cryptocurrencies transactions: Contrary to widespread belief, Crypto transactions (such as Bitcoin and Ethereum) are not anonymous[^237]. Most cryptocurrencies can be tracked accurately through various methods[^238]'[^239]. Remember what they say on their page: ^{[[Archive.org]][151]} and ^{[[Archive.org]][152]}: "Bitcoin is not anonymous" The main issue is not setting up a random Crypto wallet to receive some currency behind a VPN/Tor address (at this point, the wallet is anonymous). The issue is mainly when you want to convert Fiat money (Euros, Dollars ...) to Crypto and then when you want to cash in your Crypto. You will have few realistic options but to transfer those to an exchange (such as Coinbase/Kraken/Bitstamp/Binance). Those exchanges have known wallet addresses and will keep detailed logs (due to KYC[^240] financial regulations) and can then trace back those crypto transactions to you using the financial system[^241]. There are some cryptocurrencies with privacy/anonymity in mind like Monero but even those have some and warnings to consider[^242]'[^243]. Even if you use Mixers or Tumblers[^244] (services that specialize in "anonymizing" cryptocurrencies by "mixing them"), keep in mind this is only obfuscation[^245] and not actual anonymity[^246]. Not only are they only obfuscation but they could also put you in trouble as you might end up exchanging your crypto against "dirty" crypto that was used in various questionable contexts[^247]. This does not mean you cannot use Bitcoin anonymously at all. You can actually use Bitcoin anonymously as long as you do not convert it to actual currency and use a Bitcoin wallet from a safe anonymous network. Meaning you should avoid KYC/AML regulations by various exchanges and avoid using the Bitcoin network from any known IP address. See [Appendix Z: Paying anonymously online with BTC (or any other cryptocurrency)][Appendix Z: Online anonymous payments using cryptocurrencies]. **Overall, the best option for using Crypto with reasonable anonymity and privacy is still Monero and you should ideally not use any other for sensitive transactions unless you are aware of the limitations and risks involved. Please do read** [Appendix B2: Monero Disclaimer]**.** **TLDR: Use Monero!** ## Your Cloud backups/sync services: All companies are advertising their use of end-to-end encryption (E2EE). This is true for almost every messaging app and website (HTTPS). Apple and Google are advertising their use of encryption on their Android devices and their iPhones. But what about your backups? Those automated iCloud/Google Drive backups you have? Well, you should know that most of those backups are not fully end-to-end encrypted and will hold some of your information readily available for a third party. You will see their claims that data is encrypted at rest and safe from anyone ... Except they usually do keep a key to access some of the data themselves. These keys are used for them indexing your content, recover your account, collecting various analytics. There are specialized commercial forensics solutions available (Magnet Axiom[^248], Cellebrite Cloud[^249]) that will help an adversary analyze your cloud data with ease. Notable Examples: - Apple iCloud: ^{[[Archive.org]][153]} : "Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on**, your backup includes a copy of the key protecting your Messages**. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. ". - Google Drive and WhatsApp: ^{[[Archive.org]][154]}: "**Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive**. ". Do however note that Facebook/Whatsapp have announced the rollout of encrypted backups on October 14^th^ 2021 ( ^{[[Archive.org]][155]}) which should solve this issue. - Dropbox: ^{[[Archive.org]][156]} "To provide these and other features, **Dropbox accesses, stores, and scans Your Stuff**. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with". - Microsoft OneDrive: ^{[[Archive.org]][157]}: Productivity and communications products, "When you use OneDrive, we collect data about your usage of the service, as well as the content you store, to provide, improve, and protect the services. **Examples include indexing the contents of your OneDrive documents so that you can search for them later and using location information to enable you to search for photos based on where the photo was taken**". You should not trust cloud providers with your (not previously and locally encrypted) sensitive data and you should be wary of their privacy claims. In most cases, they can access your data and provide it to a third party if they want to[^250]. The only way to mitigate this is to encrypt your data on your side and then only upload it to such services **or just not use them at all.** ## Your Browser and Device Fingerprints: Your Browser and Device Fingerprints[^382] are set of properties/capabilities of your System/Browser. These are used on most websites for invisible user tracking but also to adapt the website user experience depending on their browser. For instance, websites will be able to provide a "mobile experience" if you are using a mobile browser or propose a specific language/geographic version depending on your fingerprint. Most of those techniques work with recent Browsers like Chromium-based[^251] browsers (such as Chrome/Edge) or Firefox[^252] unless taking specific measures. You can find a lot of detailed information and publications about this on these resources: - ^{[[Archive.org]][158]} - ^{[[Archive.org]][159]} Most of the time, those fingerprints will, unfortunately, be unique or nearly unique to your Browser/System. This means that even If you log out from a website and then log back in using a different username, your fingerprint might remain the same if you did not take precautionary measures. An adversary could then use such fingerprints to track you across multiple services even if you have no account on any of them and are using adblocking. These fingerprints could in turn be used to de-anonymize you if you keep the same fingerprint between services. It should also be noted that while some browsers and extensions will offer some fingerprint resistance, this resistance in itself can also be used to fingerprint you as explained here ^{[[Archive.org]][160]} This guide will mitigate these issues by mitigating, obfuscating, and randomizing many of those fingerprinting identifiers by using Virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]), using specific recommendations (See [Appendix A5: Additional browser precautions with JavaScript enabled] and [Appendix V1: Hardening your Browsers][Appendix V1: Hardening your Browsers:]) and using by fingerprinting resistant Browsers (Brave and Tor Browser). ## Microarchitectural Side-channel Deanonymization Attacks: There was an attack published that can deanonymize users if they have a known alias. For example, an attacker trying to track the activities of a journalist can use that journalist's public Twitter handle to link their anonymous identities with their public one. This breaks compartmentalization of identities and can lead to complete deanonymization, even of users who practice proper OPSEC. The attack, published at ^{[[Archive.org]][1386]}, can be mitigated using a browser extension: - (Chrome, Edge, and other Chrome-based browsers) - (Firefox, Tor Browser, and other Firefox-based browsers) It's generally not recommended to install extensions into Tor Browser, because the fact that you have an extension installed can be an extra data point for browser fingerprinting. As such, this extension is only a temporary solution until the fix can be implemented by the browsers' own developers. Separating identities via separate browsers or even with VMs is not enough to avoid this attack. However, another solution is to make sure that when you start working with an anonymous identity, you entirely close all activities linked to other identities. The vulnerability only works if you're actively logged into a non-anonymous identity. The issue with this is that it can hinder effective workflow, as multitasking across multiple identities becomes impossible. ## Local Data Leaks and Forensics: Most of you have probably seen enough Crime dramas on Netflix or TV to know what forensics are. These are technicians (usually working for law enforcement) that will perform various analysis of evidence. This of course could include your smartphone or laptop. While these might be done by an adversary when you already got "burned", these might also be done randomly during a routine control or a border check. These unrelated checks might reveal secret information to adversaries that had no prior knowledge of such activities. Forensics techniques are now very advanced and can reveal a staggering amount of information from your devices even if they are encrypted[^253]. These techniques are widely used by law enforcement all over the world and should be considered. Here are some recent resources you should read about your smartphone: - UpTurn, The Widespread Power of U.S. Law Enforcement to Search Mobile Phones ^{[[Archive.org]][161]} - New-York Times, The Police Can Probably Break Into Your Phone ^{[[Archive.org]][162]} - Vice, Cops Around the Country Can Now Unlock iPhones, Records Show ^{[[Archive.org]][163]} I also highly recommend that you read some documents from a forensics examiner perspective such as: - EnCase Forensic User Guide, ^{[[Archive.org]][164]} - FTK Forensic Toolkit, ^{[[Archive.org]][165]} - SANS Digital Forensics and Incident Response Videos, And finally, here is this very instructive detailed paper on the current state of IOS/Android security from the John Hopkins University: https://securephones.io/main.html[^254]. When it comes to your laptop, the forensics techniques are many and widespread. Many of those issues can be mitigated by using full disk encryption, virtualization (See [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]), and compartmentalization. This guide will later detail such threats and techniques to mitigate them. ## Bad Cryptography: There is a frequent adage among the infosec community: "Don't roll your own crypto!". And there are reasons[^255]'[^256]'[^257]'[^258] for that: We would not want people discouraged from studying and innovating in the crypto field because of that adage. So instead, we would recommend people to be cautious with "Roll your own crypto" because it is not necessarily good crypto: - Good cryptography is not easy and usually takes years of research to develop and fine-tune. - Good cryptography is transparent and not proprietary/closed source so it can be reviewed by peers. - Good cryptography is developed carefully, slowly, and rarely alone. - Good cryptography is usually presented and discussed in conferences and published in various journals. - Good cryptography is extensively peer-reviewed before it is released for use in the wild. - Using and implementing existing good cryptography correctly is already a challenge. Yet, this is not stopping some from doing it anyway and publishing various production Apps/Services using their self-made cryptography or proprietary closed-source methods: - You should apply caution when using Apps/Services using closed-source or proprietary encryption methods. All the good crypto standards are public and peer-reviewed and there should be no issue disclosing the one you use. - You should be wary of Apps/Services using a "modified" or proprietary cryptographic method[^259]. - By default, you should not trust any "Roll your own crypto" until it was audited, peer-reviewed, vetted, and accepted by the cryptography community[^260]'[^261]. - There is no such thing as "military-grade crypto"[^262]'[^263]'[^264]. Cryptography is a complex topic and bad cryptography could easily lead to your de-anonymization. In the context of this guide,we recommend sticking to Apps/Services using well-established, published, and peer-reviewed methods. So, what to prefer and what to avoid as of 2021? You will have to look up for yourself to get the technical details of each app and see if they are using "bad crypto" or "good crypto". Once you get the technical details, you could check this page for seeing what it is worth: ^{[[Archive.org]][166]} Here are some examples: - Hashes: - Prefer: SHA-3 or BLAKE2[^265] - Still relatively ok to use: SHA-2 (such as the widely used SHA-256 or SHA-512) - Avoid: SHA-1, MD5 (unfortunately still widely used), CRC, MD6 (rarely used) - File/Disk Encryption: - Prefer: - Hardware Accelerated[^266]: AES (Rijndael) 256 Bits with HMAC-SHA-2 or HMAC-SHA-3 (This is what Veracrypt, Bitlocker, Filevault 2, KeepassXC, and LUKS use by default). Prefer SHA-3. - Non-Hardware Accelerated: Same as accelerated above or if available consider: - ChaCha20[^267] or XChaCha20 (You can use ChaCha20 with Kryptor , unfortunately, it is not available with Veracrypt). - Serpent[^268] - TwoFish[^269] - Avoid: Pretty much anything else - Password Storage: - Prefer: Argon2, scrypt - If these aren't options, use bcrypt, or if not possible at least PBKDF2 (only as a last resort) - Be skeptical of Argon2d, as it's vulnerable to some forms of side-channels. Prefer Argon2i or Argon2id - Avoid: SHA-3, SHA-2, SHA-1, MD5 - Browser Security (HTTPS): - Prefer: TLS 1.3 (ideally TLS 1.3 with ECH/eSNI support) or at least TLS 1.2 (widely used) - Avoid: Anything Else (TLS =<1.1, SSL =<3) - Signing messages/files with PGP/GPG: - Prefer ECDSA (ed25519)+ECDH (ec25519) or RSA 4096 Bits* - **Consider a more modern**[^270] **alternative to PGP/GPG: Minisign ** ^{[[Archive.org]][167]} - Avoid: RSA 2048 bits - SSH keys: - ED25519 (preferred) or RSA 4096 Bits* - Avoid: RSA 2048 bits * **Warning: RSA and ED25519 are unfortunately not seen as "Quantum Resistant"**[^271] **and while they have not been broken yet, they probably will be broken someday into the future. It is just a matter of when rather than if RSA will ever be broken. So, these are preferred in those contexts due to the lack of a better possibility.** Here are some real cases of issues bad cryptography: - Telegram: ^{[[Archive.org]][168]} - Telegram: ^{[[Archive.org]][169]} - Cryptocat: - Some other examples can be found here: ^{[[Archive.org]][170]} Later this guide will not recommend "bad cryptography" and that should hopefully be enough to protect you? ## No logging but logging anyway policies: Many people have the idea that privacy-oriented services such as VPN or E-Mail providers are safe due to their no-logging policies or their encryption schemes. Unfortunately, many of those same people forget that all those providers are legal commercial entities subject to the laws of the countries in which they operate. Any of those providers can be forced to silently (without your knowing (using for example a court order with a gag order[^272] or a national security letter[^273]) log your activity to de-anonymize you. There have been several recent examples of those: - 2021, Proton, Proton logged IP address of French activist after an order by Swiss authorities (source link unavailable). - 2021, WindScribe, Servers were not encrypted as they should have been allowing MITM attacks by authorities[^275]. - 2021, DoubleVPN servers, logs, and account info seized by law enforcement[^276]. - 2021, The Germany-based mail provider Tutanota was forced to monitor specific accounts for 3 months[^277]. - 2020, The Germany-based mail provider Tutanota was forced to implement a backdoor to intercept and save copies of the unencrypted e-mails of one user[^278] (they did not decrypt the stored e-mail). - 2017, PureVPN was forced to disclose information of one user to the FBI[^279]. - 2014, an EarthVPN user was arrested based on logs provider to the Dutch Police[^280]. - 2013, Secure E-Mail provider Lavabit shuts down after fighting a secret gag order[^281]. - 2011, HideMyAss user was de-anonymized, and logs were provided to the FBI[^282]. Some providers have implemented the use of a Warrant Canary[^283] that would allow their users to find out if they have been compromised by such orders, but this has not been tested yet as far as we know. Finally, it is now well known that some companies might be sponsored front ends for some state adversaries (see the Crypto AG story[^284] and Omnisec story[^285]). For these reasons, you mustn't trust such providers for your privacy despite all their claims. In most cases, you will be the last person to know if any of your accounts were targeted by such orders and you might never know at all. To mitigate this, in cases where you want to use a VPN, we will recommend the use of a cash/Monero-paid VPN provider over Tor to prevent the VPN service from knowing any identifiable information about you. If the VPN provider knows nothing about you, it should mitigate any issue due to them not logging but logging anyway. ## Some Advanced targeted techniques: ![][171] (Illustration: an excellent movie we highly recommend: Das Leben der Anderen[^286]) Many advanced techniques can be used by skilled adversaries[^287] to bypass your security measures provided they already know where your devices are. Many of those techniques are detailed here ^{[[Archive.org]][172]} (Air-Gap Research Page, Cyber-Security Research Center, Ben-Gurion University of the Negev, Israel) but also in this report ^{[[Archive.org]][173]} (ESET, JUMPING THE AIR GAP: 15 years of nation-state effort) and include: - Attacks requiring malware implants: - Exfiltration of Data through a Malware infected Router: ^{[[Invidious]][174]} - Exfiltration of Data through observation of Light variation in a Backlit keyboard with a compromised camera: ^{[[Invidious]][175]} - Exfiltration of Data through a compromised Security Camera (that could first use the previous attack) ^{[[Invidious]][176]} - Communication from outsider to compromised Security Cameras through IR light signals: ^{[[Invidious]][177]} - Exfiltration of data from a compromised air-gapped computer through acoustic analysis of the FAN noises with a smartphone ^{[[Invidious]][178]} - Exfiltration of data from a malware-infected air-gapped computer through HD LEDs with a Drone ^{[[Invidious]][179]} - Exfiltration of data from a USB malware on an air-gapped computer through electromagnetic interferences ^{[[Invidious]][180]} - Exfiltration of data from a malware-infected HDD drive through covert acoustic noise ^{[[Invidious]][181]} - Exfiltration of data through GSM frequencies from a compromised (with malware) air-gapped computer ^{[[Invidious]][182]} - Exfiltration of data through electromagnetic emissions from a compromised Display device ^{[[Invidious]][183]} - Exfiltration of data through magnetic waves from a compromised air-gapped computer to a Smartphone stored inside a Faraday bag ^{[[Invidious]][184]} - Communication between two compromised air-gapped computers using ultrasonic soundwaves ^{[[Invidious]][184]} - Exfiltration of Bitcoin Wallet from a compromised air-gapped computer to a smartphone ^{[[Invidious]][185]} - Exfiltration of Data from a compromised air-gapped computer using display brightness ^{[[Invidious]][186]} - Exfiltration of Data from a compromised air-gapped computer through vibrations ^{[[Invidious]][187]} - Exfiltration of Data from a compromised air-gapped computer by turning RAM into a Wi-Fi emitter ^{[[Invidious]][188]} - Exfiltration of Data from a compromised air-gapped computer through power lines ^{[[Archive.org]][189]} - **Attacks not requiring malware:** - Observing a blank wall in a room from a distance to figure how many people are in a room and what they are doing[^288]. Publication with demonstration: ^{[[Archive.org]][190]} - Observing a reflective bag of snacks in a room from a distance to reconstruct the entire room[^289]. Publication with photographic examples: ^{[[Archive.org]][191]} - Measuring floor vibrations to identify individuals and determine their health condition and mood[^290]. Publication with demonstration: ^{[[Archive.org]][192]} - Observing a light bulb from a distance to listen to the sound in the room[^291] **without any malware**: Demonstration: ^{[[Invidious]][193]}. It should be noted that this type of attack is not new at all and there have been articles about such techniques as far back as 2013[^292] and that you can even buy devices to perform this yourself such as here: ^{[[Archive.org]][194]} Here is also a good video from the same authors to explain those topics: Black Hat, The Air-Gap Jumpers ^{[[Invidious]][195]} **Realistically, this guide will be of little help against such adversaries as such malware could be implanted on the devices by a manufacturer, anyone in the middle**[^293]**, or by anyone with physical access to the air-gapped computer but there are still some ways to mitigate such techniques:** - Do not conduct sensitive activity while connected to an untrusted/unsecured power line to prevent power line leaks. - Do not use your devices in front of a camera that could be compromised. - Use your devices in a soundproofed room to prevent sound leaks. - Use your devices in a Faraday cage to prevent electromagnetic leaks. - Do not talk about sensitive information where lightbulbs could be seen from outside. - Buy your devices from different/unpredictable/offline places (shops) where the probability of them being infected with such malware is lower. - Do not let anyone access your air-gapped computers except trusted people. ## Some bonus resources: - Have a look at the Whonix Documentation concerning Data Collection techniques here: ^{[[Archive.org]][196]} - You might also enjoy looking at this service ^{[[Archive.org]][197]} (Terms of Services, Didn't Read) that will give you a good overview of the various ToS of many services. - Have a look at ^{[[Archive.org]][198]} for some more resources. - Have a look at ^{[[Wikiless]][199]} ^{[[Archive.org]][200]} to have an overview of all known mass-surveillance projects, current, and past. - Have a look at ^{[[Archive.org]][201]} (even if you don't know about Death Note). - Consider finding and reading Michael Bazzell's book "Open-Source Intelligence Techniques" (eighth edition as of this writing to find out more about recent OSINT techniques) - Finally, check ^{[[Archive.org]][202]} for the latest academic papers related to Online Anonymity. ## Notes: If you still do not think such information can be used by various actors to track you, you can see some statistics for yourself for some platforms and keep in mind those are only accounting for the lawful data requests and will not count things like PRISM, MUSCULAR, SORM or XKEYSCORE explained earlier: - Google Transparency Report ^{[[Archive.org]][203]} - Facebook Transparency Report ^{[[Archive.org]][204]} - Apple Transparency Report ^{[[Archive.org]][205]} - Cloudflare Transparency Report ^{[[Archive.org]][206]} - Snapchat Transparency Report ^{[[Archive.org]][207]} - Telegram Transparency Report ^{[[Archive.org]][208]} (requires telegram installed) - Microsoft Transparency Report ^{[[Archive.org]][209]} - Amazon Transparency Report ^{[[Archive.org]][210]} - Dropbox Transparency Report ^{[[Archive.org]][211]} - Discord Transparency Report ^{[[Archive.org]][212]} - GitHub Transparency Report ^{[[Archive.org]][213]} - Snapchat Transparency Report ^{[[Archive.org]][214]} - TikTok Transparency Report ^{[[Archive.org]][215]} - Reddit Transparency Report ^{[[Archive.org]][216]} - Twitter Transparency Report ^{[[Archive.org]][217]} # General Preparations: Personally, in the context of this guide, it is also interesting to have a look at your security model. And in this context,we only have one to recommend: Zero-Trust Security[^391] ("Never trust, always verify"). Here are some various resources about what Zero-Trust Security is: - DEFCON, Zero Trust a Vision for Securing Cloud, ^{[[Invidious]][218]} - From the NSA themselves, Embracing a Zero Trust Security Model, ^{[[Archive.org]][219]} ## Picking your route: First, here is a small basic UML diagram showing your available options according to your skills/budget/time/resources. ![][220] ### Timing limitations: - You have no time at all: - **Go for the Tor Browser route.** - You have extremely limited time to learn and need a fast-working solution: - **Your best option is to go for the Tails route (excluding the persistent plausible deniability section).** - You have time and more importantly motivation to learn: - **Go with any route.** ### Budget/Material limitations: - You have no budget and even accessing a laptop is complicated or you only have your smartphone: - **Go for the Tor Browser route.** - You only have one laptop available and cannot afford anything else. You use this laptop for either work, family, or your personal stuff (or both): - **Your best option is to go for the Tails route.** - You can afford a spare dedicated unsupervised/unmonitored laptop for your sensitive activities: - But it is old, slow, and has bad specs (less than 6GB of RAM, less than 250GB disk space, old/slow CPU): - **You should go for the Tails route.** - It is not that old, and it has decent specs (at least 8GB of RAM, 250GB of disk space or more, decent CPU): - **You could go for Tails, Whonix routes.** - It is new and it has great specs (more than 16GB or ideally 32GB of RAM, >250GB of disk space, recent fast CPU): - **You could go for any route, but we would recommend Qubes OS if your threat model allows it.** - If it is an ARM-based M1 Mac: - **Not possible currently for these reasons:** - **Virtualization of x86 images on ARM M1 Macs is still limited to commercial software (Parallels) which is not supported by Whonix yet.** - **Virtualbox is not available for ARM architecture yet.** - **Whonix is not supported on ARM architecture yet.** - **Tails is not supported on ARM architecture yet.** - **Qubes OS is not supported on ARM architecture yet.** **Your only option on M1 Macs is probably to stick with Tor Browses for now. But we would guess that if you can afford an M1 Mac you should probably get a dedicated x86 laptop for more sensitive activities.** ### Skills: - Do you have no IT skills at all the content of this guide look like an alien language to you? Consider: - **The Tor Browser route (simplest of all)** - **The Tails route (excluding the persistent plausible deniability section).** - You have some IT skills and mostly understand this guide so far, consider: - **The Tails route (with the optional persistent plausible deniability section).** - **The Whonix route.** - You have moderate to high IT skills, and you are already familiar with some of the content of this guide, consider: - **Any route (Qubes OS is preferred if you can afford it).** - You are an l33T hacker, "there is no spoon", "the cake is a lie", you have been using "doas" for years, and "all your base is belong to us", and you have strong opinions on systemd. - **This guide is not meant for you and will not help you with your HardenedBSD on your hardened Libreboot laptop ;-)** ### Adversarial considerations: Now that you know what is possible, you should also consider threats and adversaries before picking the right route. #### Threats: - If your main concern is a forensic examination of your devices, you should consider: - **The Tor Browser route.** - **The Tails route.** - If your main concerns are remote adversaries that might uncover your online identity in various platforms, you should consider: - **The Tails route.** - **The Whonix route.** - **The Qubes OS route (best but requires budget/time and some skills).** - If you want system-wide plausible deniability[^311]'[^294] despite the risks[^295]'[^314], consider: - **The Tails Route including the persistent plausible deniability section (see [Persistent Plausible Deniability using Whonix within Tails][Persistent Plausible Deniability using Whonix within Tails:]).** - **The Whonix Route (This is possible on both Windows and Linux but will require more skills to achieve on Linux).** - If you are in a hostile environment where Tor/VPN usage alone is impossible/dangerous/suspicious, consider: - **The Tails route (without actually using Tor).** - **The Whonix route (without using Whonix).** - **The Qubes OS route (without actually using Whonix).** #### Adversaries: - Low skills: - Low resources: - Any motivation: Any Route - Medium resources: - Low to Medium motivation: Any Route - High motivation: TAILS, Whonix, Qubes OS Routes - High resources: - Low motivation: Any route - Medium to High motivation: TAILS, Whonix, Qubes OS Routes - Intermediate skills: - Low resources: - Low motivation: Any Route - Medium to High motivation: TAILS, Whonix, Qubes OS Routes - Medium resources: - Low motivation: Any Route - Medium to High motivation: TAILS, Whonix, Qubes OS Routes - High resources: - Low to High motivation: TAILS, Whonix, Qubes OS Routes - Highly skilled: - Low resources: - Low motivation: Any Route - Medium to High motivation: TAILS, Whonix, Qubes OS Routes - Medium resources: - Low to High motivation: TAILS, Whonix, Qubes OS Routes - High resources: - Low to High motivations: TAILS, Whonix, Qubes OS Routes **(but likely out of scope from this guide as this is probably a global adversary)** In all cases, you should read these two pages from the Whonix documentation that will give you in-depth insight into your choices: - ^{[[Archive.org]][221]} - ^{[[Archive.org]][222]} - ^{[[Archive.org]][223]} You might be asking yourself: "How do I know if I'm in a hostile online environment where activities are actively monitored and blocked?" - First read more about it at the EFF here: ^{[[Archive.org]][224]} - Check some data yourself here on the Tor Project OONI[^296] (Open Observatory of Network Interference) website: - Have a look at and see if they have data about your country. - Specific to China, look at and ^{[[Archive.org]][225]} - Test for yourself using OONI (this can be risky in a hostile environment). ## Steps for all routes: ### Getting used to using better passwords: See [Appendix A2: Guidelines for passwords and passphrases]. ### Getting an anonymous Phone number: **Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms but just want anonymous browsing or if the platforms you will use allow registration without a phone number.** #### Physical Burner Phone and prepaid SIM card: ##### Get a burner phone: This is rather easy. Leave your smartphone on and at home. Have some cash and go to some random flea market or small shop (ideally one without CCTV inside or outside and while avoiding being photographed/filmed) and just buy the cheapest phone you can find with cash and without providing any personal information. It only needs to be in working order. *A note regarding your current phone:* The point of leaving your smartphone on is to create avoid leaking the fact that you're not using the device. If a smartphone is turned off, this creates a metadata trail that can be used to correlate the time your smartphone was turned off with the activation of your burner. If possible, leave your phone doing something (for example, watching YouTube on auto-play) to obscure the metadata trail further. This will not make it impossible to correlate your inactivity, but may make it more difficult if your phone's usage patterns can look convincing while you buy your burner. We would recommend getting an old "dumbphone" with a removable battery (old Nokia if your mobile networks still allow those to connect as some countries phased out 1G-2G completely). This is to avoid the automatic sending/gathering of any telemetry/diagnostic data on the phone itself. You should never connect that phone to any Wi-Fi. **Site Note: Be careful of some sellers as shown here ** ^{[[Archive.org]][226]} It will also be crucial not to power on that burner phone ever (not even without the SIM card) in any geographical location that could lead to you (at your home/work for instance) and never at the same location as your other known smartphone (because that one has an IMEI/IMSI that will easily lead to you). This might seem like a big burden, but it is not as these phones are only being used during the setup/sign-up process and for verification from time to time. See [Appendix N: Warning about smartphones and smart devices] You should test that the phone is in working order before going to the next step. But we will repeat ourselves and state that it is important to leave your smartphone at home when going (or turn it off before leaving if you must keep it) and that you test the phone at a random location that cannot be tracked back to you (and again, do not do that in front of a CCTV, avoid cameras, be aware of your surroundings). No need for Wi-Fi at this place either. When you are certain the phone is in working order, disable Bluetooth then power it off (remove the battery if you can) and go back home and resume your normal activities. Go to the next step. ##### Getting an anonymous pre-paid SIM card: This is the hardest part of the whole guide. It is a SPOF (Single Point of Failure). The places where you can still buy prepaid SIM cards without ID registration are getting increasingly limited due to various KYC type regulations[^297]. So here is a list of places where you can still get them now: ^{[[Archive.org]][227]} You should be able to find a place that is "not too far" and just go there physically to buy some pre-paid cards and top-up vouchers with cash. Do verify that no law was passed before going that would make registration mandatory (in case the above wiki was not updated). Try to avoid CCTV and cameras and do not forget to buy a Top-Up voucher with the SIM card (if it is not a package) as most pre-paid cards will require a top-up before use. See [Appendix N: Warning about smartphones and smart devices] Double-check that the mobile operators selling the pre-paid SIM cards will accept the SIM activation and top-up without any ID registration of any kind before going there. Ideally, they should accept SIM activation and top-up from the country you live in. We would recommend GiffGaff in the UK as they are "affordable", do not require identification for activation and top-up, and will even allow you to change your number up to two times from their website. One GiffGaff prepaid SIM card will therefore grant you three numbers to use for your needs. Power off the phone after activation/top-up and before going home. Do not ever power it on again unless you are not at a place that can be used to reveal your identity and ideally leave your real phone on but at home before going to the safe place with only your burner phone. #### Online Phone Number: **DISCLAIMER: Do not attempt this until you are done setting up a secure environment according to one of the selected routes. This step will require online access and should only be done from an anonymous network. Do not do this from any known/unsecured environment. Skip this until you have finished one of the routes.** There are many commercial services offering numbers to receive SMS messages online but most of those have no anonymity/privacy and can be of no help as most Social Media platforms place a limit on how many times a phone number can be used for registration. There are some forums and subreddits (like r/phoneverification/) where users will offer the service of receiving such SMS messages for you for a small fee (using PayPal or some crypto payment). Unfortunately, these are full of scammers and very risky in terms of anonymity. **You should not use those under any circumstance.** To this date, we do not know any reputable service that would offer this service and accept cash payments (by post for instance) like some VPN providers. But a few services are providing online phone numbers and do accept Monero which could be reasonably anonymous (yet less recommended than that physical way in the earlier chapter) that you could consider: - **Recommended**: Do not require any identification (even e-mail): - (Iceland based, accepts Monero) ^{[[Tor Mirror]][228]} ^{[[Archive.org]][229]} - (Ukraine based, accepts Monero) ^{[[Archive.org]][230]} - Do require identification (valid e-mail): - (US California based, accepts Monero) ^{[[Archive.org]][231]} - (Germany based, accepts Monero) ^{[[Archive.org]][232]} - (Russia based, accepts Monero) ^{[[Archive.org]][233]} There are some other possibilities listed here ^{[[Archive.org]][234]}. **Use at your own risk.** Now, what if you have no money? Well, in that case, you will have to try your luck with free services and hope for the best. Here are some examples, **use at your own risk**: - - - **DISCLAIMER:We cannot vouch for any of these providers and therefore we will still recommend doing it yourself physically. In this case, you will have to rely on the anonymity of Monero and you should not use any service that requires any kind of identification using your real identity. Please do read [Appendix B2: Monero Disclaimer].** Therefore, it is just more convenient, cheaper, and less risky to just get a pre-paid SIM card from one of the physical places that still sell them for cash without requiring ID registration. But at least there is an alternative if you have no other choice. ### Get a USB key: **Skip this step if you have no intention of creating anonymous accounts on most mainstream platforms but just want anonymous browsing or if the platforms you will use allow registration without a phone number.** Get at least one or two decent size generic USB keys (at least 16GB but we would recommend 32GB). Please do not buy or use gimmicky self-encrypting devices such as these: ^{[[Archive.org]][235]} Some might be very efficient[^298] but many are gimmicky gadgets that offer no real protection[^299]. ### Find some safe places with decent public Wi-Fi: You need to find safe places where you will be able to do your sensitive activities using some publicly accessible Wi-Fi (without any account/ID registration, avoid CCTVs). This can be anywhere that will not be tied to you directly (your home/work) and where you can use the Wi-Fi for a while without being bothered. But also, a place where you can do this without being "noticed" by anyone. If you think Starbucks is a clever idea, you may reconsider: - They probably have CCTVs in all their shops and keep those recordings for an unknown amount of time. - You will need to buy a coffee to get the Wi-Fi access code in most. If you pay for this coffee with an electronic method, they will be able to tie your Wi-Fi access with your identity. Situational awareness is key, and you should be constantly aware of your surroundings and avoid touristy places like it was plagued by Ebola. You want to avoid appearing on any picture/video of anyone while someone is taking a selfie, making a TikTok video, or posting some travel pictures on their Instagram. If you do, remember chances are high that those pictures will end up online (publicly or privately) with full metadata attached to them (time/date/geolocation) and your face. Remember these can and will be indexed by Facebook/Google/Yandex/Apple and probably all three letters' agencies. While this will not be available yet to your local police officers, it could be in the near future. You will ideally need a set of 3-5 separate places such as this to avoid using the same place twice. Several trips will be needed over the weeks for the various steps in this guide. You could also consider connecting to these places from a safe distance for added security. See [Appendix Q: Using long-range Antenna to connect to Public Wi-Fis from a safe distance.][Appendix Q: Using long-range Antenna to connect to Public Wi-Fis from a safe distance:] ## The Tor Browser route: This part of the guide will help you in setting up the simplest and easiest way to browse the web anonymously. It is not necessarily the best method and there are more advanced methods below with (much) better security and (much) better mitigations against various adversaries. Yet, this is a straightforward way of accessing resources anonymously and quickly with no budget, no time, no skills, and limited usage. So, what is Tor Browser? Tor Browser ( ^{[[Archive.org]][236]}) is a web browser like Safari/Firefox/Chrome/Edge/Brave designed with privacy and anonymity in mind. This browser is different from other browsers as it will connect to the internet through the Tor Network using Onion Routing. We first recommend that you watch this very nice introduction video by the Tor Project themselves: ^{[[Invidious]][237]}. After that, you should probably head over to their page to read their quick overview here: ^{[[Archive.org]][238]}. Without going into too many technical details, Tor Browser is an easy and simple "fire and forget" solution to browse the web anonymously from pretty much any device. It is probably sufficient for most people and can be used from any computer or smartphone. Here are several ways to set it up for all main OSes. **Warning:** You should avoid installing extensions in Tor Browser, as they can be used to fingerprint and identify you. ### Windows, Linux, and macOS: Please see [Appendix Y: Installing and using desktop Tor Browser]. ### Android: **Note on Tor Browser for Android: The development of Tor Browser for Android is behind desktop Tor Browser Bundle (TBB). Some features are not available yet. E.g., the desktop version of Tor now enables automatic bridges using Moat:** "**Connection Assist** works by looking up and downloading an up-to-date list of country-specific options to try using your location (with your consent). It manages to do so without needing to connect to the Tor Network first by utilizing [moat](https://support.torproject.org/glossary/moat/) – the same domain-fronting tool that Tor Browser uses to request a bridge from torproject.org." - Head over to: - Play Store: - F-Droid Store: It's not yet there but you can add it manually following the instructions at ^{[[Archive.org]][239]} - Install - Launch Tor Browser - After launching, click the upper right **Settings** icon - Select **Settings** > **Privacy and security** > **Tor network** - Select **Config Bridge**. - Read [Appendix X: Using Tor bridges in hostile environments]. - **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want: - Obfs4 - Meek-Azure - Snowflake Personally, if you need to use a Bridge (this is not necessary for a non-hostile environment), you should pick a Meek-Azure. Those will probably work even if you are in China and want to bypass the Great Firewall. It is probably the best option to obfuscate your Tor activities if needed and Microsoft servers are usually not blocked. *Only available for Desktop Tor users: Recently, the Tor Project has made it incredibly simple to access Bridges with **Connection Assist**, and it is now automatically done in hostile or censored regions. Simply open the Tor Browser and the connection will be configured based on your needs on any hostile network. Previously, we had a list of options below this paragraph which were necessary to enable and configure bridges, but now that this is done automatically using [moat](https://support.torproject.org/glossary/moat/).* ^{[[Archive.org]][1387]} - You are almost done As with the desktop version, you need to know there are safety levels in Tor Browser. On Android, you can access these by following these steps: - Click the menu (bottom right) - Click **Settings**. - Head over to the **Privacy and security** section. - Click **Security Settings**. You will find details about each level here: ^{[[Archive.org]][240]} but here is a summary: - Standard (the default): - All features are enabled (including JavaScript) - Safer: - JavaScript is disabled on non-HTTPS websites - Some fonts and symbols are disabled - Any media playback is "click to play" (disabled by default) - Safest: - Javascript is disabled everywhere - Some fonts and symbols are disabled - Any media playback is "click to play" (disabled by default) We would recommend the "Safer" level for most cases. The Safest level should be enabled if you think you are accessing suspicious or dangerous websites and/or if you are extra paranoid. If you are extra paranoid, use the "Safest" level by default and consider downgrading to Safer is the website is unusable because of Javascript blocking. However, the Safer level should be used with some extra precautions while using some websites: see [Appendix A5: Additional browser precautions with JavaScript enabled]. Now, you are really done, and you can now surf the web anonymously from your Android device. ### iOS: **Disclaimer: Onion Browser, following a 2018 release on iOS, has had IP leaks via WebRTC. It is still the only officially endorsed browser for the Tor network for iOS. Users should exercise caution when using the browser and check for any DNS leaks.** While the official Tor Browser is not yet available for iOS, there is an alternative called Onion Browser endorsed by the Tor Project[^300]. - Head over to - Install - Disable Wi-Fi and Mobile Data - Launch Onion Browser - After Launching, click the upper right Settings icon (Disabling Wi-Fi and Mobile Data previously were to prevent Onion Browser from connecting automatically and to allow access to these options). - Select "Bridge Configuration" and read [Appendix X: Using Tor bridges in hostile environments] - **If needed (after reading the appendix above)**, activate the option and select the type of bridge you want: - Obfs4 - Snowflake - (Meek-Azure is unfortunately not available on Onion Browser for iOS for some reason) Personally, if you need to use a Bridge (this is not necessary for a non-hostile environment), you should pick a Snowflake one (since Meek-Azure bridges are not available). Those will probably work even if you are in China and want to bypass the Great Firewall. It is probably the best option you have on iOS. - You are almost done As with the desktop version, you need to know there are safety levels in Onion Browser. On iOS, you can access these by following these steps: - Click the shield icon (upper left) - You will have three levels to pick from - 1. Gold: Ideal if you are suspicious, paranoid, or accessing what you think are dangerous resources. - JavaScript is disabled - WebSockets, Geolocation, and XHR are disabled - No Video or Audio - Links cannot open Apps - WebRTC is blocked - Mixed HTTP/HTTPS is blocked - Ads and Pop-Ups are blocked - 2. Silver: - JavaScript partially allowed - WebSockets, Geolocation, and XHR are disabled - No Video or Audio - Links cannot open Apps - WebRTC is blocked - Mixed HTTP/HTTPS is blocked - Ads and Pop-Ups are blocked - 3. Bronze (not recommended): - JavaScript allowed - Audio and Video allowed - Links cannot open Apps - WebRTC is not blocked - Mixed HTTP/HTTPS is not blocked - Ads and Pop-Ups are blocked We would recommend the "Silver" level for most cases. The Gold level should only be enabled if you think you are accessing suspicious or dangerous websites or if you are extra paranoid. The Gold mode will also most likely break many websites that rely actively on JavaScript. As JavaScript is enabled in the Silver mode, please see [Appendix A5: Additional browser precautions with JavaScript enabled]. Now, you are really done, and you can now surf the web anonymously from your iOS device. ### Important Warning: **This route is the easiest but is not designed to resist highly skilled adversaries. It is however usable on any device regardless of the configuration. This route is also vulnerable to correlation attacks (See [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]) and is blind to anything that might be on your device (this could be any malware, exploit, virus, remote administration software, parental controls...). Yet, if your threat model is quite low, it is probably sufficient for most people.** If you have time and want to learn, we recommend going for other routes instead as they offer far better security and mitigate far more risks while lowering your attack surface considerably. ## The Tails route: This part of the guide will help you in setting up Tails if one of the following is true: - You cannot afford a dedicated laptop - Your dedicated laptop is just too old and too slow - You have very low IT skills - You decide to go with Tails anyway Tails[^301] stands for **The Amnesic Incognito Live System**. It is a bootable Live Operating System running from a USB key that is designed for leaving no traces and forcing all connections through the Tor network. You insert the Tails USB key into your laptop, boot from it and you have a full operating system running with privacy and anonymity in mind. As soon as you shut down the computer, everything will be gone unless you saved it somewhere. Tails is an amazingly straightforward way to get going in no time with what you have and without much learning. It has extensive documentation and tutorials. **WARNING: Tails is not always up to date with their bundled software. And not always up to date with the Tor Browser updates either. You should always make sure you are using the latest version of Tails and you should use extreme caution when using bundled apps within Tails that might be vulnerable to exploits and reveal your location**[^302]**.** It does however have some drawbacks: - Tails uses Tor and therefore you will be using Tor to access any resource on the internet. This alone will make you suspicious to most platforms where you want to create anonymous accounts (this will be explained in more detail later). - Your ISP (whether it is yours or some public Wi-Fi) will also see that you are using Tor, and this could make you suspicious in itself. - Tails does not include (natively) some of the software you might want to use later which will complicate things quite a bit if you want to run some specific things (Android Emulators for instance). - Tails uses Tor Browser which while it is very secure will be detected as well by most platforms and will hinder you in creating anonymous identities on many platforms. - Tails will not protect you more from the 5$ wrench[^11]. - Tor in itself might not be enough to protect you from an adversary with enough resources as explained earlier. **Important Note: If your laptop is monitored/supervised and some local restrictions are in place, please read** [Appendix U: How to bypass (some) local restrictions on supervised computers]**.** You should also read Tails Documentation, Warnings, and limitations, before going further ^{[[Archive.org]][241]} Taking all this into account and the fact that their documentation is great, we will just redirect you towards their well-made and well-maintained tutorial: ^{[[Archive.org]][242]}, pick your flavor and proceed. If you're having an issue accessing Tor due to censorship or other issues, you can try using Tor Bridges by following this Tails tutorial: ^{[[Archive.org]][243]} and find more information about these on Tor Documentation ^{[[Archive.org]][244]} **If you think using Tor alone is dangerous/suspicious, see [Appendix P: Accessing the internet as safely as possible when Tor/VPN is not an option][Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option]** ### Tor Browser settings on Tails: When using Tor Browser, you should click the little shield Icon (upper right, next to the Address bar) and select your Security level (see ^{[[Archive.org]][240]} for details). Basically, there are three. - Standard (the default): - All features are enabled (including JavaScript) - Safer: - JavaScript is disabled on non-HTTPS websites - Some fonts and symbols are disabled - Any media playback is "click to play" (disabled by default) - Safest: - Javascript is disabled everywhere - Some fonts and symbols are disabled - Any media playback is "click to play" (disabled by default) We would recommend the "Safer" level for most cases. The Safest level should be enabled if you think you are accessing suspicious or dangerous websites or if you are extra paranoid. The Safest mode will also most likely break many websites that rely actively on JavaScript. **Temporary Important Warning: Please see [Microarchitectural Side-channel Deanonymization Attacks][Microarchitectural Side-channel Deanonymization Attacks:].** If you are extra paranoid, use the "Safest" level by default and consider downgrading to Safer is the website is unusable because of Javascript blocking. Lastly, while using Tor Browser on Tails on the "Safer" level, please consider [Appendix A5: Additional browser precautions with JavaScript enabled] When you are done and have a working Tails on your laptop, go to the [Creating your anonymous online identities][Creating your anonymous online identities:] step much further in this guide or if you want persistence and plausible deniability, continue with the next section. ### Persistent Plausible Deniability using Whonix within Tails: Consider checking the ^{[[Archive.org]][245]} project for Tails. This project is a clever idea of a one-click self-contained VM solution that you could store on an encrypted disk using plausible deniability[^311] (see [The Whonix route:] first chapters and also for some explanations about Plausible deniability, as well as the [How to securely delete specific files/folders/data on your HDD/SSD and Thumb drives:] section at the end of this guide for more understanding). This would allow the creation of a hybrid system mixing Tails with the Virtualization options of the Whonix route in this guide. ![][246] **Note: See [Pick your connectivity method][Pick your connectivity method:] in the Whonix Route for more explanations about Stream Isolation** In short: - You could run non-persistent Tails from one USB key (following their recommendations) - You could store persistent VMs within a secondary container that could be encrypted normally or using the Veracrypt plausible deniability feature (these could be Whonix VMs for instance or any other). - You do benefit from the added Tor Stream Isolation feature (see [Tor over VPN] for more info about stream isolation). In that case, as the project outlines it, there should be no traces of any of your activities on your computer and the sensitive work could be done from VMs stored into a Hidden container that should not be easily discoverable by a soft adversary. **This option is particularly interesting for "traveling light" and to mitigate forensics attacks while keeping persistence on your work.** You only need 2 USB keys (one with Tails and one with a Veracrypt container containing persistent Whonix). The first USB key will appear to contain just Tails and the second USB will appear to contain just random garbage but will have a decoy volume which you can show for plausible deniability. You might also wonder if this will result in a "Tor over Tor" setup, but it will not. The Whonix VMs will be accessing the network directly through clearnet and not through Tails Onion Routing. In the future, this could also be supported by the Whonix project themselves as explained here: ^{[[Archive.org]][247]} but it is not yet recommended as of now for end-users. Remember that encryption with or without plausible deniability is not a silver bullet and will be of little use in case of torture. As a matter a fact, depending on who your adversary would be (your threat model), it might be wise not to use Veracrypt (formerly TrueCrypt) at all as shown in this demonstration: ^{[[Archive.org]][248]} **Plausible deniability is only effective against soft lawful adversaries that will not resort to physical means.** **See ** ^{[[Wikiless]][249]} ^{[[Archive.org]][250]} CAUTION: Please see [**Appendix K: Considerations for using external SSD drives**][Appendix K: Considerations for using external SSD drives] and [**Understanding HDD vs SSD**][Understanding HDD vs SSD:] sections if you consider storing such hidden VMs on an external SSD drive: - **Do not use hidden volumes on SSD drives as this is not supported/recommended by Veracrypt**[^303]**.** - **Use instead file containers instead of encrypted volumes.** - **Make sure you do know how to clean data from an external SSD drive properly.** Here is my guide on how to achieve this: #### First Run: - Download the latest HiddenVM release from ^{[[Archive.org]][251]} - Download the latest Whonix XFCE release from ^{[[Archive.org]][252]} - Prepare a USB Key/Drive with Veracrypt - Create a Hidden Volume on the USB/Key Drive (We would recommend at least 16GB for the hidden volume) - In the Outer Volume, place some decoy files - In the Hidden Volume, place the HiddenVM appimage file - In the Hidden Volume, place the Whonix XFCE ova file - Boot into Tails - Setup the Keyboard layout as you want. - Select Additional Settings and set an administrator (root) password (needed for installing HiddenVM) - Start Tails - Connect to a safe wi-fi (this is a required step for the rest to work) - Go into Utilities and Unlock your Veracrypt (hidden) Volume (do not forget to check the hidden volume checkbox) - Launch the HiddenVM appimage - When prompted to select a folder, select the Root of the Hidden volume (where the Whonix OVA and HiddenVM app image files are). - Let it do its thing (This will install Virtualbox within Tails with one click) - When it is done, it should automatically start Virtualbox Manager. - Import the Whonix OVA files (see [Whonix Virtual Machines:]) Note, if during the import you are having issues such as "NS_ERROR_INVALID_ARG (0x80070057)", this is probably because there is not enough disk space on your Hidden volume for Whonix. Whonix themselves recommend 32GB of free space but that's probably not necessary and 10GB should be enough for a start. You can try working around this error by renaming the Whonix *.OVA file to *.TAR and decompressing it within Tails. When you are done with decompression, delete the OVA file and import the other files with the Import wizard. This time it might work. #### Subsequent Runs: - Boot into Tails - Connect to Wi-Fi - Unlock your Hidden Volume - Launch the HiddenVM App - This should automatically open VirtualBox manager and show your earlier VMs from the first run ## Steps for all other routes: ### Get a dedicated laptop for your sensitive activities: Ideally, you should get a dedicated laptop that will not be tied to you in any effortless way (ideally paid with cash anonymously and using the same precautions as previously mentioned for the phone and the SIM card). It is recommended but not mandatory because this guide will help you harden your laptop as much as possible to prevent data leaks through various means. There will be several lines of defense standing between your online identities and yourself that should prevent most adversaries from de-anonymizing you besides state/global actors with considerable resources. This laptop should ideally be a clean freshly installed Laptop (Running Windows, Linux, or macOS), clean of your normal day-to-day activities, and offline (never connected to the network yet). In the case of a Windows laptop, and if you used it before such a clean install, it should also not be activated (re-installed without a product key). Specifically, in the case of MacBooks, it should never have been tied to your identity before in any means. So, buy second-hand with cash from an unknown stranger who does not know your identity This is to mitigate some future issues in case of online leaks (including telemetry from your OS or Apps) that could compromise any unique identifiers of the laptop while using it (MAC Address, Bluetooth Address, and Product key ...). But also, to avoid being tracked back if you need to dispose of the laptop. If you used this laptop before for different purposes (like your day-to-day activities), all its hardware identifiers are probably known and registered by Microsoft or Apple. If later any of those identifiers is compromised (by malware, telemetry, exploits, human errors ...) they could lead back to you. The laptop should have at least 250GB of Disk Space **at least 6GB (ideally 8GB or 16GB)** of RAM and should be able to run a couple of Virtual Machines at the same time. It should have a working battery that lasts a few hours. This laptop could have an HDD (7200rpm) or an SSD/NVMe drive. Both possibilities have their benefits and issues that will be detailed later. All future online steps performed with this laptop should ideally be done from a safe network such as Public Wi-Fi in a safe place (see [Find some safe places with decent public Wi-Fi][Find some safe places with decent public Wi-Fi:]). But several steps will have to be taken offline first. ### Some laptop recommendations: We would strongly recommend getting a "business grade" laptop (meaning not consumer/gaming-grade laptop) if you can. For instance, some ThinkPad from Lenovo (my personal favorite). This is because those business laptops usually offer better and more customizable security features (especially in the BIOS/UEFI settings) with longer support than most consumer laptops (Asus, MSI, Gigabyte, Acer...). The interesting features to look for are: - Better custom Secure Boot **settings (where you can selectively manage all the keys and not just use the Standard ones)** - HDD/SSD passwords in addition to just BIOS/UEFI passwords. - AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any "evil" functionalities[^304]. However, if you are going for the Qubes OS Route consider Intel CPUs as Qubes OS does not support AMD with their anti-evil-maid system[^305]. - Secure Wipe tools from the BIOS (especially useful for SSD/NVMe drives, see [Appendix M: BIOS/UEFI options to wipe disks in various Brands]). - Better control over the disabling/enabling of select peripherals (USB ports, Wi-Fis, Bluetooth, Camera, Microphone ...). - Better security features with Virtualization. - Native anti-tampering protections. - Longer support with BIOS/UEFI updates (and subsequent BIOS/UEFI security updates). - Some are supported by Libreboot ### Bios/UEFI/Firmware Settings of your laptop: #### PC: These settings can be accessed through the boot menu of your laptop. Here is a good tutorial from HP explaining all the ways to access the BIOS on various computers: ^{[[Archive.org]][253]} Usually how to access it is by pressing a specific key (F1, F2, or Del) at boot (before your OS). Once you are in there, you will need to apply a few recommended settings: - Disable Bluetooth completely if you can. - Disable Biometrics (fingerprint scanners) if you have any if you can. However, you could add a biometric additional check for booting only (pre-boot) but not for accessing the BIOS/UEFI settings. - Disable the Webcam and Microphone if you can. - Enable BIOS/UEFI password and use a long passphrase instead of a password (if you can) and make sure this password is required for: - Accessing the BIOS/UEFI settings themselves - Changing the Boot order - Startup/Power-on of the device - Enable HDD/SSD password if the feature is available. This feature will add another password on the HDD/SSD itself (not in the BIOS/UEFI firmware) that will prevent this HDD/SSD from being used in a different computer without the password. Note that this feature is also specific to some manufacturers and could require specific software to unlock this disk from a completely different computer. - Prevent accessing the boot options (the boot order) without providing the BIOS/UEFI password if you can. - Disable USB/HDMI or any other port (Ethernet, Firewire, SD card ...) if you can. - Disable Intel ME if you can (odds are very high you can't). - Disable AMD PSP if you can (AMD's equivalent to IME, see [Your CPU][Your CPU:]) - Disable Secure Boot if you intend to use Qubes OS as they do not support it out of the box[^306]. Keep it on if you intend to use Linux/Windows. - Check if your laptop BIOS has a secure erase option for your HDD/SSD that could be convenient in case of need. Only enable those on a "need to use" basis and disable them again after use. This can help mitigate some attacks in case your laptop is seized while locked but still on OR if you had to shut it down rather quickly and someone took possession of it (this topic will be explained later in this guide). ##### About Secure boot: So, what is Secure Boot[^307]? In short, it is a UEFI security feature designed to prevent your computer from booting an operating system from which the bootloader was not signed by specific keys stored in the UEFI firmware of your laptop. When the operating system (or the Bootloader[^308]) supports it, you can store the keys of your bootloader in your UEFI firmware, and this will prevent booting up any unauthorized Operating System (such as a live OS USB or anything similar). Secure Boot settings are protected by the password you set up to access the BIOS/UEFI settings. If you have that password, you can disable Secure Boot and allow unsigned OSes to boot on your system. This can help mitigate some Evil-Maid attacks (explained later in this guide). In most cases, Secure Boot is disabled by default or is enabled but in "setup" mode which will allow any system to boot. For Secure Boot to work, your Operating System will have to support it and then sign its bootloader and push those signing keys to your UEFI firmware. After that, you will have to go to your BIOS/UEFI settings and save those pushed keys from your OS and change the Secure Boot from setup to user mode (or custom mode in some cases). After doing that step, only the Operating Systems from which your UEFI firmware can verify the integrity of the bootloader will be able to boot. Most laptops will have some default keys already stored in the secure boot settings. Usually, those are from the manufacturer itself or some companies such as Microsoft. So, this means that by default, it will always be possible to boot some USB disks even with secure boot. These include Windows, Fedora, Ubuntu, Mint, Debian, CentOS, OpenSUSE, Tails, Clonezilla, and many others. Secure Boot is however not supported at all by Qubes OS at this point. In some laptops, you can manage those keys and remove the ones you do not want with a "custom mode" to only authorize your bootloader that you could sign yourself if you want to. So, what is Secure Boot protecting you from? It will protect your laptop from booting unsigned bootloaders (by the OS provider) with for instance injected malware. What is Secure Boot **not** protecting you from? - Secure Boot is not encrypting your disk and an adversary can still just remove the disk from your laptop and extract data from it using a different machine. Secure Boot is therefore useless without full disk encryption. - Secure Boot is not protecting you from a signed bootloader that would be compromised and signed by the manufacturer itself (Microsoft for example in the case of Windows). Most mainstream Linux distributions are signed these days and will boot with Secure Boot enabled. - Secure Boot can have flaws and exploits like any other system. If you are running an old laptop that does not benefit from new BIOS/UEFI updates, these can be left unfixed. Additionally, several attacks could be possible against Secure Boot as explained (in-depth) in these technical videos: - Defcon 22, ^{[[Invidious]][254]} - BlackHat 2016, ^{[[Invidious]][255]} **So, it can be useful as an added measure against some adversaries but not all. Secure Boot in itself is not encrypting your hard drive. It is an added layer but that is it.** **I still recommend you keep it on if you can.** #### Mac: Take a moment to set a firmware password according to the tutorial here: ^{[[Archive.org]][256]} You should also enable firmware password reset protection (available from Catalina) according to the documentation here: ^{[[Archive.org]][257]} This feature will mitigate the possibility for some adversaries to use hardware hacks to disable/bypass your firmware password. Note that this will also prevent Apple themselves from accessing the firmware in case of repair. ### Physically Tamper protect your laptop: At some point, you will inevitably leave this laptop alone somewhere. You will not sleep with it and take it everywhere every single day. You should make it as hard as possible for anyone to tamper with it without you noticing it. This is mostly useful against some limited adversaries that will not use a 5$ wrench against you[^11]. It is important to know that it is trivially easy for some specialists to install a key logger in your laptop, or to just make a clone copy of your hard drive that could later allow them to detect the presence of encrypted data in it using forensic techniques (more on that later). Here is a good cheap method to make your laptop tamper-proof using Nail Polish (with glitter) ^{[[Archive.org]][258]} [^309] (with pictures). While this is a good cheap method, it could also raise suspicions as it is quite "noticeable" and might just reveal that you "have something to hide". So, there are more subtle ways of achieving the same result. You could also for instance make a close-up macro photography of the back screws of your laptop or just use a small amount of candle wax within one of the screws that could just look like usual dirt. You could then check for tampering by comparing the photographs of the screws with new ones. Their orientation might have changed a bit if your adversary was not careful enough (Tightening them exactly the same way they were before). Or the wax within the bottom of a screw head might have been damaged compared to before. ![][259]![][260] The same techniques can be used with USB ports where you could just put a tiny amount of candle wax within the plug that would be damaged by inserting a USB key in it. In riskier environments, check your laptop for tampering before using it regularly. ## The Whonix route: ### Picking your Host OS (the OS installed on your laptop): This route will make extensive use of Virtual Machines[^310], they will require a host OS to run the Virtualization software. You have three recommended choices in this part of the guide: - Your Linux distribution of choice (excluding Qubes OS) - Windows 10/11 (preferably Home edition due to the absence of Bitlocker) - macOS (Catalina or higher up to Monterey) In addition, chances are high that your Mac is or has been tied to an Apple account (at the time of purchase or after signing-in) and therefore its unique hardware identifiers could lead back to you in case of hardware identifiers leak. Linux is also not necessarily the best choice for anonymity depending on your threat model. This is because using Windows will allow us to **conveniently** use Plausible Deniability[^311] (aka Deniable Encryption[^312]) easily at the OS level. Windows is also unfortunately at the same time a privacy nightmare[^313] but is the only easy to set up option for using OS-wide plausible deniability. Windows telemetry and telemetry blocking are also widely documented which should mitigate many issues. **So, what is Plausible Deniability?** You can cooperate with an adversary requesting access to your device/data without revealing your true secret. All this using Deniable Encryption[^314]. A soft lawful adversary could ask for your encrypted laptop password. At first, you could refuse to give out any password (using your "right to remain silent", "right not to incriminate yourself") but some countries are implementing laws[^315]'[^316] to exempt this from such rights (because terrorists and "think of the children"). In that case, you might have to reveal the password or face jail time in contempt of court. This is where plausible deniability will come into play. You could then reveal a password, but that password will only give access to "plausible data" (a decoy OS). The forensics will be well aware that it is possible for you to have hidden data but should not be able to prove this **(if you do this right)**. You will have cooperated, and the investigators will have access to something but not what you actually want to hide. Since the burden of proof should lie on their side, they will have no options but to believe you unless they have proof that you have hidden data. This feature can be used at the OS level (a plausible OS and a hidden OS) or at the files level where you will have an encrypted file container (similar to a zip file) where different files will be shown depending on the encryption password you use. This also means you could set up your own advanced "plausible deniability" setup using any Host OS by storing for instance Virtual Machines on a Veracrypt hidden volume container (be careful of traces in the Host OS tho that would need to be cleaned if the host OS is persistent, see [Some additional measures against forensics][Some additional measures against forensics:] section later). There is a project for achieving this within Tails ( ^{[[Archive.org]][245]}) which would make your Host OS non-persistent and use plausible deniability within Tails. In the case of Windows, plausible deniability is also the reason you should ideally have Windows 10/11 Home (and not Pro). This is because Windows 10/11 Pro natively offers a full-disk encryption system (Bitlocker[^317]) where Windows 10/11 Home offers no full-disk encryption at all. You will later use third-party open-source software for encryption that will allow full-disk encryption on Windows 10/11 Home. This will give you a good (plausible) excuse to use this software. While using this software on Windows 10/11 Pro would be suspicious. **Note about Linux:** So, what about Linux and plausible deniability? Yes, it is possible to achieve plausible deniability with Linux too. More information within the Linux Host OS section later. Unfortunately, encryption is not magic and there are some risks involved: #### Threats with encryption: ##### **The 5$ Wrench:** Remember that encryption with or without plausible deniability is not a silver bullet and will be of little use in case of torture. As a matter a fact, depending on who your adversary would be (your threat model), it might be wise not to use Veracrypt (formerly TrueCrypt) at all as shown in this demonstration: ^{[[Archive.org]][248]} Plausible deniability is only effective against soft lawful adversaries that will not resort to physical means. **Avoid, if possible, the use of plausible deniability-capable software (such as Veracrypt) if your threat model includes hard adversaries. So, Windows users should in that case install Windows Pro as a Host OS and use Bitlocker instead.** See ^{[[Wikiless]][249]} ^{[[Archive.org]][250]} ##### Evil-Maid Attack: Evil Maid Attacks[^318] are conducted when someone tampers with your laptop while you are away. To install to clone your hard drive, install malware or a key logger. If they can clone your hard drive, they can compare one image of your hard drive at the time they took it while you were away with the hard drive when they seize it from you. If you used the laptop again in between, forensics examiners might be able to prove the existence of the hidden data by looking at the variations between the two images in what should be an empty/unused space. This could lead to compelling evidence of the existence of hidden data. If they install a key logger or malware within your laptop (software or hardware), they will be able to simply get the password from you for later use when they seize it. Such attacks can be done at your home, your hotel, a border crossing, or anywhere you leave your devices unattended. You can mitigate this attack by doing the following (as recommended earlier): - Have basic tamper protection (as explained previously) to prevent physical access to the internals of the laptop without your knowing. This will prevent them from cloning your disks and installing a physical key logger without your knowledge. - Disable all the USB ports (as explained previously) within a password-protected BIOS/UEFI. Again, they will not be able to turn them on (without physically accessing the motherboard to reset the BIOS) to boot a USB device that could clone your hard drive or install a software-based malware that could act as a key logger. - Set up BIOS/UEFI/Firmware passwords to prevent any unauthorized boot of an unauthorized device. - Some OSes and Encryption software have the [Anti Evil Maid (AEM)][Anti Evil Maid (AEM):] protection that can be enabled. This is the case with Windows/Veracrypt and QubeOS (only on Intel CPUs). ##### Cold-Boot Attack: Cold Boot attacks[^319] are trickier than the Evil Maid Attack but can be part of an Evil Maid attack as it requires an adversary to come into possession of your laptop while you are actively using your device or shortly afterward. The idea is rather simple, as shown in this video[^320], an adversary could theoretically quickly boot your device on a special USB key that would copy the content of the RAM (the memory) of the device after you shut it down. If the USB ports are disabled or if they feel like they need more time, they could open it and "cool down" the memory using a spray or other chemicals (liquid nitrogen for instance) preventing the memory from decaying. They could then be able to copy its content for analysis. This memory dump could contain the key to decrypt your device. You will later apply a few principles to mitigate these. In the case of Plausible Deniability, there have been some forensics studies[^321] about technically proving the presence of the hidden data with a simple forensic examination (without a Cold Boot/Evil Maid Attack) but these have been contested by other studies[^322] and by the maintainer of Veracrypt[^323] so we would not worry too much about those yet. The same measures used to mitigate Evil Maid attacks should be in place for Cold Boot attacks with some added ones: - If your OS or Encryption software allows it, you should consider encrypting the keys within RAM too (this is possible with Windows/Veracrypt and will be explained later). Again see ^{[[Archive.org]][261]} - Do enable the option to Wipe keys from memory if a device is inserted in Veracrypt. - You should limit the use of Sleep stand-by and instead use Shutdown or Hibernate to prevent the encryption keys from staying in RAM when your computer goes to sleep. This is because sleep will maintain power in your memory for resuming your activity faster. Only hibernation and shutdown will actually clear the key from the memory[^324]. See also ^{[[Archive.org]][262]} and ^{[[Archive.org]][263]} Here are also some interesting tools to consider for Linux users to defend against these: - ^{[[Archive.org]][264]} (unfortunately unmaintained it seems) - ^{[[Archive.org]][266]} (unfortunately unmaintained as well it seems) - ^{[[Archive.org]][267]} - ^{[[Archive.org]][268]} - (Qubes OS, Intel CPU only) ^{[[Archive.org]][269]} ##### About Sleep, Hibernation, and Shutdown: If you want better security, you should shut down your laptop completely every time you leave it unattended or close the lid. This should clean and/or release the RAM and provide mitigations against cold boot attacks. However, this can be a bit inconvenient as you will have to reboot completely and type in a ton of passwords into various apps. Restart various VMs and other apps. So instead, you could also use hibernation (not supported on Qubes OS). Since the whole disk is encrypted, hibernation in itself should not pose a large security risk but will still shut down your laptop and clear the memory while allowing you to conveniently resume your work afterward. **What you should never do is using the standard sleep feature which will keep your computer on, and the memory powered. This is an attack vector against evil-maid and cold-boot attacks discussed earlier. This is because your powered-on memory holds the encryption keys to your disk (encrypted or not) and could then be accessed by a skilled adversary.** This guide will provide guidance later on how to enable hibernation on various host OSes (except Qubes OS) if you do not want to shut down every time. ##### Local Data Leaks (traces) and forensics examination: As mentioned briefly earlier, these are data leaks and traces from your operating system and apps when you perform any activity on your computer. These mostly apply to encrypted file containers (with or without plausible deniability) than OS-wide encryption. Such leaks are less "important" if your whole OS is encrypted (if you are not compelled to reveal the password). Let us say for example you have a Veracrypt encrypted USB key with plausible deniability enabled. Depending on the password you use when mounting the USB key, it will open a decoy folder or the sensitive folder. Within those folders, you will have decoy documents/data within the decoy folder and sensitive documents/data within the sensitive folder. In all cases, you will (most likely) open these folders with Windows Explorer, macOS Finder, or any other utility and do whatever you planned to do. Maybe you will edit a document within the sensitive folder. Maybe you will search for a document within the folder. Maybe you will delete one or watch a sensitive video using VLC. Well, all those Apps and your Operating System might keep logs and traces of that usage. This might include the full path of the folder/files/drives, the time those were accessed, temporary caches of those files, the "recent" lists in each app, the file indexing system that could index the drive, and even thumbnails that could be generated Here are some examples of such leaks: ###### Windows: - Windows ShellBags that are stored within the Windows Registry silently storing various histories of accessed volumes/files/folders[^325]. - Windows Indexing keeping traces of the files present in your user folder by default[^326]. - Recent lists (aka Jump Lists) in Windows and various apps keeping traces of recently accessed documents[^327]. - Many more traces in various logs, please see this convenient interesting poster for more insight: ^{[[Archive.org]][270]} ###### macOS: - Gatekeeper[^328] and XProtect keeping track of your download history in a local database and file attributes. - Spotlight Indexing - Recent lists in various apps keeping traces of recently accessed documents. - Temporary folders keeping various traces of App usage and Document usage. - macOS Logs - ... ###### Linux: - Tracker Indexing - Bash History - USB logs - Recent lists in various apps keeping traces of recently accessed documents. - Linux Logs - ... Forensics could' use all those leaks (see [Local Data Leaks and Forensics][Local Data Leaks and Forensics:]) to prove the existence of hidden data and defeat your attempts at using plausible deniability and to find out about your various sensitive activities. It will be therefore important to apply various steps to prevent forensics from doing this by preventing and cleaning these leaks/traces and more importantly by using whole disk encryption, virtualization, and compartmentalization. Forensics cannot extract local data leaks from an OS they cannot access. And you will be able to clean most of those traces by wiping the drive or by securely erasing your virtual machines (which is not as easy as you think on SSD drives). Some cleaning techniques will nevertheless be covered in the "Cover your Tracks" part of this guide at the very end. ##### Online Data Leaks: Whether you are using simple encryption or plausible deniability encryption. Even if you covered your tracks on the computer itself. There is still a risk of online data leaks that could reveal the presence of hidden data. **Telemetry is your enemy**. As explained earlier in this guide, the telemetry of Operating Systems but also from Apps can send staggering amounts of private information online. In the case of Windows, this data could for instance be used to prove the existence of a hidden OS / Volume on a computer and would be readily available at Microsoft. Therefore, it is critically important that you disable and block telemetry with all the means at your disposal. No matter what OS you are using. #### Conclusion: You should never conduct sensitive activities from a non-encrypted system. And even if it is encrypted, you should never conduct sensitive activities from the Host OS itself. Instead, you should use a VM to be able to efficiently isolate and compartmentalize your activities and prevent local data leaks. If you have little to no knowledge of Linux or if you want to use OS-wide plausible deniability, we recommend going for Windows (or back to the Tails route) for convenience. This guide will help you hardening it as much as possible to prevent leaks. This guide will also help you hardening macOS and Linux as much as possible to prevent similar leaks. If you have no interest in OS-wide plausible deniability and want to learn to use Linux, we will strongly recommend going for Linux or the Qubes OS route if your hardware allows it. **In all cases, the host OS should never be used to conduct sensitive activities directly. The host OS will only be used to connect to a public Wi-Fi Access Point. It will be left unused while you conduct sensitive activities and should ideally not be used for any of your day-to-day activities.** Consider also reading **** ^{[[Archive.org]][271]} ### Linux Host OS: As mentioned earlier, we do not recommend using your daily laptop for sensitive activities. Or at least we do not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk. I also recommend that you do the initial installation completely offline to avoid any data leak. You should always remember that despite the reputation, Linux mainstream distributions (Ubuntu for instance) are not necessarily better at security than other systems such as macOS and Windows. See this reference to understand why ^{[[Archive.org]][272]}. #### Full disk encryption: There are two routes here with Ubuntu or Debian based distros: - Using LUKS: - Without plausible deniability: - (Recommended and easy) Encrypt as part of the installation process: ^{[[Archive.org]][273]} - This process requires the full erasure of your entire drive (clean install). - Just check the "Encrypt the new Ubuntu installation for security" - (Tedious but possible) Encrypt after installation: ^{[[Archive.org]][274]} - With plausible deniability: See the next section [The Detached Headers Way] - Using Veracrypt: - With or without plausible deniability: See the next section [The Veracrypt Way] For other distros, you will have to document yourself, but it will likely be similar. Encryption during install is just much easier in the context of this guide. #### Note about plausible deniability on Linux: There are several ways to achieve plausible deniability on Linux[^329] and it is possible to achieve. Here are some more details about some of the ways we would recommend. All these options require some higher level of skills at using Linux. ##### The Detached Headers Way: While not supported yet by this guide, it is possible to achieve a form of deniability on Linux using LUKS by using detached LUKS headers. For now, we will redirect you toward this page for more information: ^{[[Archive.org]][275]} ##### The Veracrypt Way: It is technically possible to not only use Veracrypt but also to achieve plausible deniability on a Linux Host OS by using Veracrypt for system full-disk encryption (instead of LUKS). This is not supported by Veracrypt (System encryption is only supported on Windows) and requires some tinkering with various commands. This is not recommended at all for unskilled users and should only be used at your own risk. The steps to achieve this are not yet integrated into this guide but can be found here: (this is a .onion address and requires Tor Browser). #### Reject/Disable any telemetry: - During the install, just make sure you do not allow any data collection if prompted. - If you are not sure, just make sure you did not enable any telemetry and follow this tutorial if needed ^{[[Archive.org]][276]} - Any other distro: You will need to document yourself and find out yourself how to disable telemetry if there is any. #### Disable anything unnecessary: - Disable Bluetooth if enabled by following this guide ^{[[Archive.org]][277]} or issuing the following command: - ```sudo systemctl disable bluetooth.service --force``` - Disable Indexing if enabled by default (Ubuntu >19.04) by following this guide ^{[[Archive.org]][278]} or issuing the following commands: - ```sudo systemctl --user mask tracker-store.service tracker-miner-fs.service tracker-miner-rss.service tracker-extract.service tracker-miner-apps.service tracker-writeback.service``` - You can safely ignore any error if it says some service does not exist - ```sudo tracker reset -hard``` ##### Hibernation: As explained previously, you should not use the sleep features but shut down or hibernate your laptop to mitigate some evil-maid and cold-boot attacks. Unfortunately, this feature is disabled by default on many Linux distros including Ubuntu. It is possible to enable it, but it might not work as expected. Follow this information at your own risk. If you do not want to do this, you should never use the sleep function and power off instead (and set the lid closing behavior to power off instead of sleep). Follow one of these tutorials to enable Hibernate: - ^{[[Archive.org]][279]} - ^{[[Archive.org]][280]} - ^{[[Archive.org]][281]} After Hibernate is enabled, change the behavior so that your laptop will hibernate when you close the lid by following this tutorial for Ubuntu 20.04 ^{[[Archive.org]][282]} and this tutorial for Ubuntu 18.04 ^{[[Archive.org]][283]}. There is no tutorial yet for Ubuntu 21.04 or 21.10 but the above for 20.04 should probably work too. Unfortunately, this will not clean the key from memory directly when hibernating. To avoid this at the cost of some performance, you might consider encrypting the swap file by following this tutorial: ^{[[Archive.org]][284]} These settings should mitigate cold boot attacks if you can hibernate fast enough. #### Enable MAC address randomization: - Ubuntu, follow these steps ^{[[Archive.org]][285]}. - Any other distro: you will have to find the documentation yourself, but it should be quite similar to the Ubuntu tutorial. - Consider this tutorial which should still work: ^{[[Archive.org]][286]} #### Hardening Linux: As a light introduction for new Linux users, consider ^{[[Invidious]][287]} For more in-depth and advanced options, refer to: - This excellent guide: ^{[[Archive.org]][288]} - This excellent wiki resource: ^{[[Archive.org]][289]} - These excellent scripts are based on the guide and wiki above: ^{[[Archive.org]][290]} - These tools that can help you harden your Linux Kernel: - Lynis: - Kconfig-hardened-check: - Consider the use of KickSecure when using Debian: ^{[[Archive.org]][291]} - This interesting article: ^{[[Archive.org]][292]} #### Setting up a safe Browser: See [Appendix G: Safe Browser on the Host OS] ### macOS Host OS: **Note: At this time, this guide will not support ARM M1 MacBooks (yet). Due to Virtualbox not supporting this architecture yet. It could however be possible if you use commercial tools like VMWare or Parallels but those are not covered in this guide.** As mentioned earlier, we do not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk. I also recommend that you do the initial installation completely offline to avoid any data leak. **Do not ever sign in with your Apple account using that Mac.** #### During the install: - Stay Offline - Disable all data sharing requests when prompted including location services - Do not sign in with Apple - Do not enable Siri #### Hardening macOS: As a light introduction for new macOS users, consider ^{[[Invidious]][293]} Now to go more in-depth in securing and hardening your macOS, we recommend reading this guide which covers many of the issues: ^{[[Archive.org]][294]} Here are the basic steps you should take after your offline installation: ##### Enable Firmware password with "disable-reset-capability" option: First, you should set up a firmware password following this guide from Apple: ^{[[Archive.org]][295]} Unfortunately, some attacks are still possible and an adversary could disable this password so you should also follow this guide to prevent disabling the firmware password from anyone including Apple: ^{[[Archive.org]][257]} ##### Enable Hibernation instead of sleep: Again, this is to prevent some cold-boot and evil-maid attacks by powering down your RAM and cleaning the encryption key when you close the lid. You should always either hibernate or shut down. On macOS, the hibernate feature even has a special option to specifically clear the encryption key from memory when hibernating (while you might have to wait for the memory to decay on other Operating Systems). Once again there are no easy options to do this within the settings so instead, we will have to do this by running a few commands to enable hibernation: - Open a Terminal - Run: ```sudo pmset -a destroyfvkeyonstandby 1``` - This command will instruct macOS to destroy the Filevault key on Standby (sleep) - Run: ```sudo pmset -a hibernatemode 25``` - This command will instruct macOS to power off the memory during sleep instead of doing a hybrid hibernate that keeps the memory powered on. It will result in slower wakes but will increase battery life. Now when you close the lid of your MacBook, it should hibernate instead of sleep and mitigate attempts at performing cold-boot attacks. In addition, you should also set up an automatic sleep (Settings > Energy) so that your MacBook will hibernate automatically if left unattended. ##### Disable unnecessary services: Disable some unnecessary settings within the settings: - Disable Bluetooth - Disable the Camera and Microphone - Disable Location Services - Disable Airdrop - Disable Indexing ##### Prevent Apple OCSP calls: These are the infamous "unblockable telemetry" calls from macOS Big Sur disclosed here: ^{[[Archive.org]][296]} You could block OCSP reporting by issuing the following command in Terminal: - ``` sudo sh -c 'echo "127.0.0.1 ocsp.apple.com" >> /etc/hosts'``` But you should document yourself on the actual issue before acting. This page is a good place to start: ^{[[Archive.org]][297]} Up to you really. We would block it because we do not want any telemetry at all from my OS to the mothership without my specific consent. None. ##### Enable Full Disk encryption (Filevault): You should enable full disk encryption on your Mac using Filevault according to this part of the guide: ^{[[Archive.org]][294]} **Be careful when enabling. Do not store the recovery key at Apple if prompted (should not be an issue since you should be offline at this stage). You do not want a third party to have your recovery key.** ##### MAC Address Randomization: Unfortunately, macOS does not offer a native convenient way of randomizing your MAC Address and so you will have to do this manually. This will be reset at each reboot, and you will have to re-do it each time to ensure you do not use your actual MAC Address when connecting to various Wi-Fis You can do this by issuing the following commands in terminal (without the parentheses): - (Turn the Wi-Fi off) ```networksetup -setairportpower en0 off``` - (Change the MAC Address) ```sudo ifconfig en0 ether 88:63:11:11:11:11``` - (Turn the Wi-Fi back on) ```networksetup -setairportpower en0 on``` #### Setting up a safe Browser: See [Appendix G: Safe Browser on the Host OS] ### Windows Host OS: As mentioned earlier, we do not recommend using your daily laptop for sensitive activities. Or at leastWedo not recommend using your in-place OS for these. Doing that might result in unwanted data leaks that could be used to de-anonymize you. If you have a dedicated laptop for this, you should reinstall a fresh clean OS. If you do not want to wipe your laptop and start over, you should consider the Tails route or proceed at your own risk. I also recommend that you do the initial installation completely offline to avoid any data leak. #### Installation: You should follow [Appendix A: Windows Installation] As a light introduction, consider watching ^{[[Invidious]][298]} #### Enable MAC address randomization: You should randomize your MAC address as explained earlier in this guide: Go into Settings > Network & Internet > Wi-Fi > Enable Random hardware addresses Alternatively, you could use this free piece of software: ^{[[Archive.org]][299]} #### Setting up a safe Browser: See [Appendix G: Safe Browser on the Host OS] #### Enable some additional privacy settings on your Host OS: See [Appendix B: Windows Additional Privacy Settings] ##### Windows Host OS encryption: ###### If you intend to use system-wide plausible deniability: Veracrypt[^330] is the software we will recommend for full-disk encryption, file encryption, and plausible deniability. It is a fork of the well-known but deprecated and unmaintained TrueCrypt. It can be used for: - Full Disk simple encryption (your hard drive is encrypted with one passphrase). - Full Disk encryption with plausible deniability (this means that depending on the passphrase entered at boot, you will either boot a decoy OS or a hidden OS). - File container simple encryption (it is a large file that you will be able to mount within Veracrypt as if it were an external drive to store encrypted files within). - File container with plausible deniability (it is the same large file but depending on the passphrase you use when mounting it, you will either mount a "hidden volume" or the "decoy volume"). It is to my knowledge the only (convenient and usable by anyone) free, open-source, and openly audited[^331] encryption software that also provides plausible deniability for widespread use and it works with Windows Home Edition. Go ahead and download and install Veracrypt from: ^{[[Archive.org]][300]} After installation, please take a moment to review the following options that will help mitigate some attacks: - Encrypt the memory with a Veracrypt option[^332] (settings > performance/driver options > encrypt RAM) at a cost of 5-15% performance. This setting will also disable hibernation (which does not actively clear the key when hibernating) and instead encrypt the memory altogether to mitigate some cold-boot attacks. More details about this feature here: ^{[[Archive.org]][261]} - Enable the Veracrypt option to wipe the keys from memory if a new device is inserted (system > settings > security > clear keys from memory if a new device is inserted). This could help in case your system is seized while still on (but locked). - Enable the Veracrypt option to mount volumes as removable volumes (Settings > Preferences > Mount volume as removable media). This will prevent Windows from writing some logs about your mounts in the Event logs[^333] and prevent some local data leaks. - Be careful and have a good situational awareness if you sense something weird. Shut your laptop down as fast as possible. If you do not want to use encrypted memory (because performance might be an issue), you should at least enable hibernation instead of sleep. This will not clear the keys from memory (you are still vulnerable to cold boot attacks) but at least should mitigate them if your memory has enough time to decay. More details later in [Route A and B: Simple Encryption using Veracrypt (Windows tutorial)]. ###### If you do not intend to use system-wide plausible deniability: For this case, we will recommend the use of BitLocker instead of Veracrypt for the full disk encryption. The reasoning is that BitLocker does not offer a plausible deniability possibility contrary to Veracrypt. A hard adversary has then no incentive in pursuing his "enhanced" interrogation if you reveal the passphrase. Normally, you should have installed Windows Pro in this case and the BitLocker setup is quite straightforward. Basically, you can follow the instructions here: ^{[[Archive.org]][301]} But here are the steps: - Click the Windows Menu - Type "Bitlocker" - Click "Manage Bitlocker" - Click "Turn on Bitlocker" on your System Drive - Follow the instructions - **Do not save your recovery key to a Microsoft Account if prompted.** - **Only save the recovery key to an external encrypted drive. To bypass this, print the recovery key using the Microsoft Print to PDF printer and save the key within the Documents folder. Delete that file later.** - **Encrypt Entire Drive (do not encrypt the used disk space only).** - **Use "New Encryption Mode"** - **Run the BitLocker Check** - **Reboot** - Encryption should now be started in the background (you can check by clicking the Bitlocker icon on the lower right side of the taskbar). Unfortunately, this is not enough. With this setup, your Bitlocker key can just be stored as-is in the TPM chip of your computer. This is rather problematic as the key can be extracted in some cases with ease[^334]'[^335]'[^336]'[^337]. To mitigate this, you will have to enable a few more options as per the recommendations of Microsoft[^338]: - Click the Windows icon - Type Run - Type "gpedit.msc" (this is the group policy editor) - Navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker > Operating System Drives - Double Click the "Require Additional Authentication at Startup" - Click the "Configure TPM Startup PIN" and set it to "Require Startup PIN with TPM" - Double Click the "Allow enhanced PINs for startup" - Click the "Enable" (this will allow us to set a password rather than a PIN) - Close the Group Policy Editor - Click the Windows icon - Type Command to display the "Command Prompt" - Right Click on it and click "Run as Administrator" - Run ```manage-bde -protectors -delete c:``` (this will delete current protection: the recovery key you will not need) - Run ```manage-bde -protectors -add c: -TPMAndPIN``` (this will prompt you for a pre-boot password) - Enter a password or passphrase of your choice (a good one) - Run ```manage-bde -status``` - You should now see at your C: drive below "Key Protectors" the option "TPM and PIN" - You are done Now when you reboot your computer, you should ideally be prompted for: - A BIOS/UEFI boot password - An SSD/HDD unlock password (if the feature is available on your BIOS) - A Bitlocker Pre-Boot Pin Screen where you need to enter the password/passphrase you just set-up - And finally, the Windows Logon Screen where you can enter the credentials you set-up earlier ##### Enable Hibernation (optional): Again, as explained earlier. You should never use the sleep/stand-by feature to mitigate some cold-boot and evil-maid attacks. Instead, you should Shut down or hibernate. You should therefore switch your laptop from sleeping to hibernating when closing the lid or when your laptop goes to sleep. (**Note that you cannot enable hibernation if you previously enabled RAM encryption within Veracrypt)** The reason is that Hibernation will actually shut down your laptop completely and clean the memory. Sleep on the other hand will leave the memory powered on (including your decryption key) and could leave your laptop vulnerable to cold-boot attacks. By default, Windows 10/11 might not offer you this possibility so you should enable it by following this Microsoft tutorial: ^{[[Archive.org]][302]} - Open an administrator command prompt (right-click on Command Prompt and "Run as Administrator") - Run: powercfg.exe /hibernate on - Now run the additional command: ```**powercfg /h /type full**``` - **This command will make sure your hibernate mode is full and will fully clean the memory (not securely tho).** After that you should go into your power settings: - Open the Control Panel - Open System & Security - Open Power Options - Open "Choose what the power button does" - Change everything from sleep to hibernate or shutdown - Go back to the Power Options - Select Change Plan Settings - Select Advanced Power Settings - Change all the Sleep Values for each Power Plan to 0 (Never) - Make sure Hybrid Sleep is Off for each Power Plan - Enable Hibernate After the time you would like - Disable all the Wake timers #### Deciding which sub-route you will take: Now you will have to pick your next step between two options: - Route A: Simple encryption of your current OS - Pros: - Does not require you to wipe your laptop - No issue with local data leaks - Works fine with an SSD drive - Works with any OS - Simple - Cons: - You could be compelled by an adversary to reveal your password and all your secrets and will have no plausible deniability. - The danger of Online data leaks - Route B: Simple encryption of your current OS with later use of plausible deniability on files themselves: - Pros: - Does not require you to wipe your laptop - Works fine with an SSD drive - Works with any OS - Plausible deniability is possible with "soft" adversaries - Cons: - The danger of Online Data leaks - The danger of Local Data leaks (that will lead to more work to clean up those leaks) - Route C: Plausible Deniability Encryption of your Operating system (you will have a "hidden OS" and a "decoy OS" running on the laptop): - Pros: - No issues with local Data leaks - Plausible deniability is possible with "soft" adversaries - Cons: - Requires Windows (this feature is not "easily" supported on Linux). - The danger of online Data leaks - Requires full wipe of your laptop - No use with an SSD drive due to the requirement of disabling Trim[^339] Operations[^340]. This will severely degrade the performance/health of your SSD drive over time. **As you can see, Route C only offers two privacy advantages over the others, and it will only be of use against a soft lawful adversary. Remember ** ^{[[Wikiless]][249]} ^{[[Archive.org]][250]}**.** Deciding which route you will take is up to you. Route A is a minimum. **Always be sure to check for new versions of Veracrypt frequently to ensure you benefit from the latest patches. Especially check this before applying large Windows updates that might break the Veracrypt bootloader and send you into a boot loop.** **NOTE THAT BY DEFAULT VERACRYPT WILL ALWAYS PROPOSE A SYSTEM PASSWORD IN QWERTY (display the password as a test). This can cause issues if your boot input is using your laptop's keyboard (AZERTY for example) as you will have set up your password in QWERTY and will input it at boot time in AZERTY. So, make sure you check when doing the test boot what keyboard layout your BIOS is using. You could fail to log in just because of the QWERTY/AZERTY mix-up. If your BIOS boots using AZERTY, you will need to type the password in QWERTY within Veracrypt.** ##### Route A and B: Simple Encryption using Veracrypt (Windows tutorial) **Skip this step if you used BitLocker instead earlier.** You do not have to have an HDD for this method, and you do not need to disable Trim on this route. Trim leaks will only be of use to forensics in detecting the presence of a Hidden Volume but will not be of much use otherwise. This route is rather straightforward and will just encrypt your current Operating System in place without losing any data. Be sure to read all the texts Veracrypt is showing you, so you have a full understanding of what is going on. Here are the steps: - Launch VeraCrypt - Go into Settings: - Settings > Performance/driver options > Encrypt RAM - System > Settings > Security > Clear keys from memory if a new device is inserted - System > Settings > Windows > Enable Secure Desktop - Select System - Select Encrypt System Partition/Drive - Select Normal (Simple) - Select Single-Boot - Select AES as encryption Algorithm (click the test button if you want to compare the speeds) - Select SHA-512 as hash Algorithm (because why not) - Enter a strong passphrase (longer the better, remember [Appendix A2: Guidelines for passwords and passphrases]) - Collect some entropy by randomly moving your cursor around until the bar is full - Click Next as the Generated Keys screen - To rescue disk[^341] or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it. - Wipe mode: - If you have no sensitive data yet on this laptop, select None - If you have sensitive data on an SSD, Trim alone should take care of it[^342] but we would recommend one pass (random data) just to be sure. - If you have sensitive data on an HDD, there is no Trim, and we Swould recommend at least 1-pass. - Test your setup. Veracrypt will now reboot your system to test the bootloader before encryption. This test must pass for encryption to go forward. - After your computer rebooted and the test is passed. You will be prompted by Veracrypt to start the encryption process. - Start the encryption and wait for it to complete. - You are done, skip Route B and go to the next steps. There will be another section on creating encrypted file containers with Plausible Deniability on Windows. ##### Route B: Plausible Deniability Encryption with a Hidden OS (Windows only) **This is only supported on Windows.** **This is only recommended on an HDD drive. This is not recommended on an SSD drive.** **Your Hidden OS should not be activated (with an MS product key). Therefore, this route will recommend and guide you through a full clean installation that will wipe everything on your laptop.** Read the Veracrypt Documentation ^{[[Archive.org]][303]} (Process of Creation of Hidden Operating System part) and ^{[[Archive.org]][304]} (Security Requirements and Precautions Pertaining to Hidden Volumes). This is how your system will look after this process is done: ![][305] (Illustration from Veracrypt Documentation, ^{[[Archive.org]][303]}) As you can see this process requires you to have two partitions on your hard drive from the start. This process will do the following: - Encrypt your second partition (the outer volume) that will look like an empty unformatted disk from the decoy OS. - Prompt you with the opportunity to copy some decoy content within the outer volume. - This is where you will copy your decoy Anime/Porn collection from some external hard drive to the outer volume. - Create a hidden volume within the outer volume of that second partition. This is where the hidden OS will reside. - Clone your currently running Windows 10/11 installation onto the hidden volume. - Wipe your currently running Windows 10/11. - This means that your current Windows 10/11 will become the hidden Windows 10/11 and that you will need to reinstall a fresh decoy Windows 10/11 OS. **Mandatory if you have an SSD drive and you still want to do this against the recommendation: Disable SSD Trim in Windows**[^343] **(again this is NOT recommended at all as** **disabling Trim in itself is highly suspicious**). **Also** **as mentioned earlier, disabling Trim will reduce the lifetime of your SSD drive and will significantly impact its performance over time (your laptop will become slower and slower over several months of use until it becomes almost unusable, you will then have to clean the drive and re-install everything). But you must do it to prevent data leaks**[^344] **that could allow forensics to defeat your plausible deniability**[^345][^346]**. The only way around this at the moment is to have a laptop with a classic HDD drive instead.** ###### Step 1: Create a Windows 10/11 install USB key See [Appendix C: Windows Installation Media Creation][306] and go with the USB key route. ###### Step 2: Boot the USB key and start the Windows 10/11 install process (Hidden OS) - Insert the USB key into your laptop - See [Appendix A: Windows Installation] and proceed with installing Windows 10/11 Home. ###### Step 3: Privacy Settings (Hidden OS) See [Appendix B: Windows Additional Privacy Settings] ###### Step 4: Veracrypt installation and encryption process start (Hidden OS) Remember to read ^{[[Archive.org]][303]} Do not connect this OS to your known Wi-Fi. You should download the Veracrypt installer from a different computer and copy the installer here using a USB key. Here are the steps: - Install Veracrypt - Start Veracrypt - Go into Settings: - Settings > Performance/driver options > Encrypt RAM (**note that this option is not compatible with Hibernation your laptop and means you will have to shut down completely)** - System > Settings > Security > Clear keys from memory if a new device is inserted - System > Settings > Windows > Enable Secure Desktop - Go into System and select Create Hidden Operating System - Read all the prompts thoroughly - Select Single-Boot if prompted - Create the Outer Volume using AES and SHA-512. - Use all the space available on the second partition for the Outer Volume - Use a strong passphrase (remember [Appendix A2: Guidelines for passwords and passphrases]) - Select yes to Large Files - Create some Entropy by moving the mouse around until the bar is full and select NTFS (do not select exFAT as you want this outer volume to look "normal" and NTFS is normal). - Format the Outer Volume - Open Outer Volume: - At this stage, you should copy decoy data onto the outer volume. So, you should have some sensitive but not so sensitive files/folders to copy there. In case you need to reveal a password to this Volume**.** This is a good place for your Anime/Mp3/Movies/Porn collection. - We recommend you do not fill the outer volume too much or too little (about 40%). Remember you must leave enough space for the Hidden OS (which will be the same size as the first partition you created during installation). - Use a strong passphrase for the Hidden Volume (obviously a different one than the one for the Outer Volume). - Now you will create the Hidden Volume, select AES and SHA-512 - Fill the entropy bar until the end with random mouse movements - Format the hidden Volume - Proceed with the Cloning - Veracrypt will now restart and Clone the Windows where you started this process into the Hidden Volume. This Windows will become your Hidden OS. - When the cloning is complete, Veracrypt will restart within the Hidden System - Veracrypt will inform you that the Hidden System is now installed and then prompt you to wipe the Original OS (the one you installed previously with the USB key). - Use 1-Pass Wipe and proceed. - Now your Hidden OS will be installed, proceed to the next step ###### Step 5: Reboot and boot the USB key and start the Windows 10/11 install process again (Decoy OS) Now that the Hidden OS is fully installed, you will need to install a Decoy OS: - Insert the USB key into your laptop - See [Appendix A: Windows Installation] and proceed with installing Windows 10/11 Home again (do not install a different version and stick with Home). ###### Step 6: Privacy settings (Decoy OS) See [Appendix B: Windows Additional Privacy Settings] ###### Step 7: Veracrypt installation and encryption process start (Decoy OS) Now you will encrypt the Decoy OS: - Install Veracrypt - Launch VeraCrypt - Select System - Select Encrypt System Partition/Drive - Select Normal (Simple) - Select Single-Boot - Select AES as encryption Algorithm (click the test button if you want to compare the speeds) - Select SHA-512 as hash Algorithm (because why not) - Enter a short weak password (yes this is serious, do it, it will be explained later). - Collect some entropy by randomly moving your cursor around until the bar is full - Click Next as the Generated Keys screen - To rescue disk[^347] or not rescue disk, well that is up to you. We recommend making one (just in case), just make sure to store it outside your encrypted drive (USB key for instance or wait and see the end of this guide for guidance on safe backups). This rescue disk will not store your passphrase and you will still need it to use it. - Wipe mode: Select 1-Pass just to be safe - Pre-Test your setup. Veracrypt will now reboot your system to test the bootloader before encryption. This test must pass for encryption to go forward. - After your computer rebooted and the test is passed. You will be prompted by Veracrypt to start the encryption process. - Start the encryption and wait for it to complete. - Your Decoy OS is now ready for use. ###### Step 8: Test your setup (Boot in Both) Time to test your setup: - Reboot and input your Hidden OS passphrase, you should boot within the Hidden OS. - Reboot and input your Decoy OS passphrase, you should boot within the Decoy OS. - Launch Veracrypt on the Decoy OS and mount the second partition using the Outer Volume Passphrase (mount it as read-only, by going into Mount Options and Selecting Read-Only) and it should mount the second partition as a read-only displaying your decoy data (your Anime/Porn collection). You are mounting it as read-only now because if you were to write data on it, you could override content from your Hidden OS. ###### Step 9: Changing the decoy data on your Outer Volume safely Before going to the next step, you should learn the way to mount your Outer Volume safely for writing content on it. This is also explained in this official Veracrypt Documentation ^{[[Archive.org]][307]} **You should do this from a safe trusted place.** Basically, you are going to mount your Outer Volume while also providing the Hidden Volume passphrase within the Mount Options to protect the Hidden Volume from being overwritten. Veracrypt will then allow you to write data to the Outer volume without risking overwriting any data on the Hidden Volume: - Open Veracrypt - Select your Second Partition - Click Mount - Click Mount Options - Check the "Protect the Hidden volume..." Option - Enter the Hidden OS passphrase - Click OK - Enter your Outer Volume passphrase - Click OK - You should now be able to open and write to your Outer volume to change the content (copy/move/delete/edit...) This operation will not actually mount the Hidden Volume and should prevent the creation of any forensic evidence that could lead to the discovery of the hidden OS. However, while you are performing this operation, both passwords will be stored in your RAM and therefore you could still be susceptible to a Cold-Boot Attack. To mitigate this, be sure to have the option to encrypt your RAM too as instructed before. ###### Step 10: Leave some forensics evidence of your outer Volume (with the decoy Data) within your Decoy OS We must make the Decoy OS as plausible as possible. We also want your adversary to think you are not that smart. Therefore, it is important to voluntarily leave some forensic evidence of your Decoy Content within your Decoy OS. This evidence will let forensic examiners see that you mounted your Outer Volume frequently to access its content. Here are useful tips to leave some forensics evidence: - Play the content from the Outer Volume from your Decoy OS (using VLC for instance). Be sure to keep a history of those. - Edit Documents and work on them. - Enable File Indexing again on the Decoy OS and include the Mounted Outer Volume. - Unmount it and mount it frequently to watch some Content. - Copy some Content from your Outer Volume to your Decoy OS and then delete it unsafely (just put it in the recycle Bin). - Have a Torrent Client installed on the Decoy OS use it from time to time to download some similar stuff that you will leave on the Decoy OS. - You could have a VPN client installed on the Decoy OS with a known VPN of yours (non-cash paid). Do not put anything suspicious on the Decoy OS such as: - This guide - Any links to this guide - Any suspicious anonymity software such as Tor Browser ###### Notes: **Remember that you will need valid excuses for this plausible deniability scenario to work:** - **You are using Veracrypt because you are using Windows 10/11 Home which does not feature Bitlocker but still wanted Privacy.** - **You have two Partitions because you wanted to separate the System and the Data for easy organization and because some Geek friend told you this was better for performance.** - **You have used a weak password for easy convenient booting on the System and a Strong long passphrase on the Outer Volume because you were too lazy to type a strong passphrase at each boot.** - **You encrypted the second Partition with a different password than the System because you do not want anyone in your entourage to see your stuff. And so, you did not want that data available to anyone.** Take some time to read again the "Possible Explanations for Existence of Two Veracrypt Partitions on Single Drive" of the Veracrypt documentation here ^{[[Archive.org]][303]} **Be careful:** - **You should never mount the Hidden Volume from the Decoy OS (NEVER EVER). If you did this, it would create forensics evidence of the Hidden Volume within the Decoy OS that could jeopardize your attempt at plausible deniability**. If you did this anyway (intentionally or by mistake) from the Decoy OS, there are ways to erase forensics evidence that will be explained later at the end of this guide. - **Never Use the Decoy OS from the same network (public Wi-Fi) as the Hidden OS.** - **When you do mount the Outer Volume from the Decoy OS, do not write any Data within the Outer Volume as this could override what looks like Empty Space but is in fact your Hidden OS. You should always mount it as read-only.** - **If you want to change the Decoy content of the Outer Volume, you should use a Live OS USB Key that will run Veracrypt.** - **Note that you will not use the Hidden OS to perform sensitive activities, this will be done later from a VM within the Hidden OS. The Hidden OS is only meant to protect you from a soft adversary that could gain access to your laptop and compel you to reveal your password.** - **Be careful of any tampering with your laptop. Evil-Maid Attacks can reveal your hidden OS.** ### Virtualbox on your Host OS: Remember [Appendix W: Virtualization][Appendix V1: Hardening your Browsers:]. This step and the following steps should be done from within the Host OS. This can either be your Host OS with simple encryption (Windows/Linux/macOS) or your Hidden OS with plausible deniability (Windows only). In this route, you will make extensive use of the free Oracle Virtualbox[^348] software. This is a virtualization software in which you can create Virtual Machines that emulate a computer running a specific OS (if you want to use something else like Xen, Qemu, KVM, or VMWARE, feel free to do so but this part of the guide covers Virtualbox only for convenience). So, you should be aware that Virtualbox is not the virtualization software with the best track record in terms of security and some of the reported issues[^349] have not been completely fixed to this date[^350] and if you are using Linux with a bit more technical skills, you should consider using KVM instead by following the guide available at Whonix here ^{[[Archive.org]][308]} and here ^{[[Archive.org]][309]} Some steps should be taken in all cases: **All your sensitive activities will be done from within a guest Virtual Machine running Windows 10/11 Pro (not Home this time), Linux, or macOS.** This has a few advantages that will help you remain anonymous: - It should prevent the guest VM OS (Windows/Linux/macOS), Apps, and any telemetry within the VMs from accessing your hardware directly. Even if your VM is compromised by malware, this malware should not be able to the VM and compromise your actual laptop. - It will allow us to force all the network traffic from your client VM to run through another Gateway VM that will direct (torify) all the traffic towards the Tor Network. This is a network "kill switch". Your VM will lose its network connectivity completely and go offline if the other VM loses its connection to the Tor Network. - The VM itself that only has internet connectivity through a Tor Network Gateway will connect to your cash-paid VPN service through Tor. - DNS Leaks will be impossible because the VM is on an isolated network that must go through Tor no matter what. ### Pick your connectivity method: There are seven possibilities within this route: - **Recommended and preferred:** - **Use Tor alone (User > Tor > Internet)** - **Use VPN over Tor (User > Tor > VPN > Internet) in specific cases** - **Use a VPS with a self-hosted VPN/Proxy over Tor (User > Tor > Self-Hosted VPN/Proxy > Internet) in specific cases** - Possible if required by context: - Use VPN over Tor over VPN (User > VPN > Tor > VPN > Internet) - Use Tor over VPN (User > VPN > Tor > Internet) - Not recommended and risky: - Use VPN alone (User > VPN > Internet) - Use VPN over VPN (User > VPN > VPN > Internet) - **Not recommended and highly risky (but possible)** - No VPN and no Tor (User > Internet) ![][310] #### Tor only: This is the preferred and most recommended solution. ![][311] With this solution, all your network goes through Tor, and it should be sufficient to guarantee your anonymity in most cases. There is one main drawback tho: **Some services block/ban Tor Exit nodes outright and will not allow account creations from those.** To mitigate this, you might have to consider the next option: VPN over Tor but consider some risks associated with it explained in the next section. #### VPN/Proxy over Tor: This solution can bring some benefits in some specific cases vs using Tor only where accessing the destination service would be impossible from a Tor Exit node. This is because many services will just outright ban, hinder, or block Tor Exit Nodes (see ^{[[Archive.org]][312]}). This solution can be achieved in two ways: - Paid VPN over Tor (easiest) - Paid Self-Hosted VPS configured as VPN/Proxy (most efficient in avoiding online obstacles such as captchas but requiring more skills with Linux) As you can see in this illustration, if your cash (preferred)/Monero paid VPN/Proxy is compromised by an adversary (despite their privacy statement and no-logging policies), they will only find an anonymous cash/Monero paid VPN/Proxy account connecting to their services from a Tor Exit node. ![][313] If an adversary somehow manages to compromise the Tor network too, they will only reveal the IP of a random public Wi-Fi that is not tied to your identity. If an adversary somehow compromises your VM OS (with malware or an exploit for instance), they will be trapped within the internal Network of Whonix and should be unable to reveal the IP of the public Wi-Fi. **This solution however has one main drawback to consider: Interference with Tor Stream Isolation**[^351]. Stream isolation is a mitigation technique used to prevent some correlation attacks by having different Tor Circuits for each application. Here is an illustration to show what stream isolation is: ![][314] (Illustration from Marcelo Martins, ^{[[Archive.org]][315]}) VPN/Proxy over Tor falls on the right-side[^352] meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases: - When your destination service does not allow Tor Exit nodes. - When you do not mind using a shared Tor circuit for various services. For instance, when using various authenticated services. **You should however consider not using this method when your aim is just to browse random various unauthenticated websites as you will not benefit from Stream Isolation and this could make correlation attacks easier over time for an adversary between each of your sessions (see [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]). If your goal however is to use the same identity at each session on the same authenticated services, the value of Stream isolation is lessened as you can be correlated through other means.** You should also know that Stream Isolation is not necessarily configured by default on Whonix Workstation. It is only pre-configured for some applications (including Tor Browser). Also, note that Stream Isolation does not necessarily change all the nodes in your Tor circuit. It can sometimes only change one or two. In many cases, Stream Isolation (for instance within the Tor Browser) will only change the relay (middle) node and the exit node while keeping the same guard (entry) node. More information at: - ^{[[Archive.org]][316]} - ^{[[Archive.org]][317]} - ^{[[Archive.org]][318]} #### Tor over VPN: You might be wondering: Well, what about using Tor over VPN instead of VPN over Tor? Well, we would not necessarily recommend it: - Disadvantages: - Your VPN provider is just another ISP that will then know your origin IP and will be able to de-anonymize you if required. We do not trust them. We prefer a situation where your VPN provider does not know who you are. It does not add much in terms of anonymity. - This would result in you connecting to various services using the IP of a Tor Exit Node which is banned/flagged in many places. It does not help in terms of convenience. - Advantages: - **The main advantage is that if you are in a hostile environment where Tor access is impossible/dangerous/suspicious, but VPN is okay.** - This method also does not break Tor Stream isolation. - This also hides your Tor activities from your main ISP. Note, if you are having issues accessing the Tor Network due to blocking/censorship, you could try using Tor Bridges. See [Appendix X: Using Tor bridges in hostile environments]. It is also possible to consider **VPN over Tor over VPN (User > VPN > Tor > VPN > Internet)** using two cash/Monero paid VPNs instead. This means that you will connect the Host OS to a first VPN from your Public Wi-Fi, then Whonix will connect to Tor, and finally, your VM will connect to a second VPN over Tor over VPN (see ^{[[Archive.org]][319]}). This will of course have a significant performance impact and might be quite slow, but Tor is necessary somewhere for achieving reasonable anonymity. Achieving this technically is easy within this route, you need two separate anonymous VPN accounts and must connect to the first VPN from the Host OS and follow the route. Conclusion: Only do this if you think using Tor alone is risky/impossible but VPNs are okay. Or just because you can and so why not. This method will not lower your security/privacy/anonymity. #### VPN only: This route will not be explained nor recommended. **If you can use VPNs then you should be able to add a Tor layer over it. And if you can use Tor, then you can add an anonymous VPN over Tor to get the preferred solution.** Just using a VPN or even a VPN over VPN makes no sense as those can be traced back to you over time. One of the VPN providers will know your real origin IP (even if it is in a safe public space) and even if you add one over it, the second one will still know you were using that other first VPN service. This will only slightly delay your de-anonymization. Yes, it is an added layer ... but it is a persistent centralized added layer, and you can be de-anonymized over time. This is just chaining 3 ISPs that are all subject to lawful requests. For more info, please see the following references: - ^{[[Archive.org]][320]} - ^{[[Archive.org]][321]} - ^{[[Archive.org]][322]} - ^{[[Archive.org]][323]} - ^{[[Archive.org]][324]} **In the context of this guide, Tor is required somewhere to achieve reasonable and safe anonymity and you should use it if you can.** #### No VPN/Tor: If you cannot use VPN nor Tor where you are, you probably are in a very hostile environment where surveillance and control are extremely high. Just do not, it is not worth it and too risky. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes. Do not forget to check back on [Adversaries (threats)] and [Appendix S: Check your network for surveillance/censorship using OONI]. If you have absolutely no other option and still want to do something, see [Appendix P: Accessing the internet as safely as possible when Tor/VPN is not an option][Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] **(at your own risk) and consider [The Tails route][The Tor Browser route:] instead.** #### Conclusion: | Connection Type | Anonymity | Ease of Access to online resources | Tor Stream isolation | Safer where Tor is suspicious/dangerous | Speed | Cost | Recommended | |------------------------------------|-----------|------------------------------------|----------------------|-----------------------------------------|------------|---------------------------|--------------------------------------------------| | Tor Alone | **Good** | **Medium** | **Possible** | **No** | **Medium** | **Free** | **Yes** | | Tor over VPN | **Good+** | **Medium** | **Possible** | **Yes** | **Medium** | **Around 50€/y** | **If needed (Tor inaccessible)** | | Tor over VPN over Tor | **Best** | **Medium** | **Possible** | **Yes** | **Poor** | **Around 50€/y** | **Yes** | | VPN over Tor | **Good-** | **Good** | **No** | **No** | **Medium** | **Around 50€/y** | **If needed (convenience)** | | Self-Hosted VPS VPN/Proxy over Tor | **Good-** | **Very Good** | **No** | **Yes** | **Medium** | **Around 50€/y** | **If needed (convenience)** | | VPN/Proxy over Tor over VPN | **Good-** | **Good** | **No** | **Yes** | **Poor** | **Around 100€/y** | **If needed (convenience and Tor inaccessible)** | | VPN/Proxy Alone | **Bad** | **Good** | **N/A** | **Yes** | **Good** | **Around 50€/y** | **No.** | | No Tor and VPN | **Bad** | **Unknown** | **N/A** | **No** | **Good** | **Around 100€ (Antenna)** | **No.** | Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor is still the best solution for anonymity and must be somewhere for anonymity. - If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard, we recommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity. - **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details). - If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **Then we recommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).** - If cost is an issue, we recommend the Tor Only option if possible. - If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] For more information, you can also see the discussions here that could help decide yourself: - Tor Project: ^{[[Archive.org]][325]} - Tails Documentation: - ^{[[Archive.org]][326]} - ^{[[Archive.org]][327]} - Whonix Documentation (in this order): - ^{[[Archive.org]][328]} - ^{[[Archive.org]][329]} - ^{[[Archive.org]][319]} - Some papers on the matter: - ^{[[Archive.org]][322]} ### Getting an anonymous VPN/Proxy: **Skip this step if you want to use Tor only.** See [Appendix O: Getting an anonymous VPN/Proxy] ### Whonix: **Skip this step if you cannot use Tor.** This route will use Virtualization and Whonix[^353] as part of the anonymization process. Whonix is a Linux distribution composed of two Virtual Machines: - The Whonix Workstation (this is a VM where you can conduct sensitive activities) - The Whonix Gateway (this VM will establish a connection to the Tor network and route all the network traffic from the Workstation through the Tor network). This guide will therefore propose two flavors of this route: - The Whonix only route where all traffic is routed through the Tor Network (Tor Only or Tor over VPN). ![][330] - A Whonix hybrid route where all traffic is routed through a cash (preferred)/Monero paid VPN over the Tor Network (VPN over Tor or VPN over Tor over VPN). ![][331] You will be able to decide which flavor to use based on my recommendations. We recommend the second one as explained before. Whonix is well maintained and has extensive and incredibly detailed documentation. #### A note on Virtualbox Snapshots: Later, you will create and run several Virtual Machines within Virtualbox for your sensitive activities. Virtualbox provides a feature called "Snapshots"[^354] that allow for saving the state of a VM at any point in time. If for any reason later you want to go back to that state, you can restore that snapshot at any moment. **I strongly recommend that you do make use of this feature by creating a snapshot after the initial installation/update of each VM. This snapshot should be done before its use for any sensitive/anonymous activity.** This will allow you to turn your VMs into a kind of disposable "Live Operating Systems" (like Tails discussed earlier). Meaning that you will be able to erase all the traces of your activities within a VM by restoring a Snapshot to an earlier state. Of course, this will not be "as good" as Tails (where everything is stored in memory) as there might be traces of this activity left on your hard disk. Forensics studies have shown the ability to recover data from a reverted VM[^355]. Fortunately, there will be ways to remove those traces after the deletion or reverting to an earlier snapshot. Such techniques will be discussed in the [Some additional measures against forensics][Some additional measures against forensics:] section of this guide. #### Download Virtualbox and Whonix utilities: You should download a few things within the host OS: - The latest version of the Virtualbox installer according to your Host OS ^{[[Archive.org]][332]} - (Skip this if you cannot use Tor natively or through a VPN) The latest Whonix OVA file from ^{[[Archive.org]][333]} according to your preference (Linux/Windows, with a Desktop interface XFCE for simplicity or only with the text-client for advanced users) This will conclude the preparations and you should now be ready to start setting up the final environment that will protect your anonymity online. #### Virtualbox Hardening recommendations: For ideal security, you should follow the recommendations provided here for each Virtualbox Virtual Machine ^{[[Archive.org]][334]} : - Disable Audio. - Do not enable Shared Folders. - Do not enable 2D acceleration. This one is done running the following command ```VBoxManage modifyvm "vm-id" --accelerate2dvideo on|off``` - Do not enable 3D acceleration. - Do not enable the Serial Port. - Remove the Floppy drive. - Remove the CD/DVD drive. - Do not enable the Remote Display server. - Enable PAE/NX (NX is a security feature). - Disable Advanced Configuration and Power Interface (ACPI). This one is done running the following command ```VBoxManage modifyvm "vm-id" --acpi on|off``` - Do not attach USB devices. - Disable the USB controller which is enabled by default. Set the Pointing Device to "PS/2 Mouse" or changes will revert. Finally, also follow this recommendation to desync the clock you are your VM compared to your host OS ^{[[Archive.org]][335]} This offset should be within a 60000-millisecond range and should be different for each VM and here are some examples (which can be later applied to any VM): - ```VBoxManage modifyvm "Whonix-Gateway-XFCE" --biossystemtimeoffset -35017``` - ```VBoxManage modifyvm "Whonix-Gateway-XFCE" --biossystemtimeoffset +27931``` - ```VBoxManage modifyvm "Whonix-Workstation-XFCE" --biossystemtimeoffset -35017``` - ```VBoxManage modifyvm "Whonix-Workstation-XFCE" --biossystemtimeoffset +27931``` Also, consider applying these mitigations from VirtualBox to mitigate Spectre[^356]/Meltdown[^357] vulnerabilities by running this command from the VirtualBox Program Directory. All of these are described here: ^{[[Archive.org]][82]} (be aware these can impact severely the performance of your VMs but should be done for best security). Finally, consider the security advice from Virtualbox themselves here ^{[[Archive.org]][336]} ### Tor over VPN: **Skip this step if you do not intend to use Tor over VPN and only intend to use Tor or cannot.** If you intend to use Tor over VPN for any reason. You first must configure a VPN service on your host OS. Remember that in this case, we recommend having two VPN accounts. Both paid with cash/Monero (see [Appendix O: Getting an anonymous VPN/Proxy]). One will be used in the Host OS for the first VPN connection. The other could be used in the VM to achieve VPN over Tor over VPN (User > VPN > Tor > VPN). If you intend to only use Tor over VPN, you only need one VPN account. See [Appendix R: Installing a VPN on your VM or Host OS][Appendix R: Installing a VPN on your VM or Host OS.] for instructions. ### Whonix Virtual Machines: **Skip this step if you cannot use Tor.** - Start Virtualbox on your Host OS. - Import Whonix file Into Virtualbox following the instructions on ^{[[Archive.org]][252]} - Start the Whonix VMs Remember at this stage that if you are having issues connecting to Tor due to censorship or blocking, you should consider connecting using Bridges as explained in this tutorial ^{[[Archive.org]][337]}. - Update the Whonix VMs by following the instructions on ^{[[Archive.org]][338]} - Shutdown the Whonix VMs - Take a snapshot of the updated Whonix VMs within Virtualbox (select a VM and click the Take Snapshot button). More on that later. - Go to the next step **Important Note: You should also read these very good recommendations over there ** ^{[[Archive.org]][339]} **as most of those principles will also apply to this guide. You should also read their general documentation here ** ^{[[Archive.org]][340]} **which will also provide tons of advice like this guide.** ### Pick your guest workstation Virtual Machine: Using Whonix/Linux will require more skills on your side as these are Linux distributions. You will also encounter more difficulties if you intend to use specific software that might be harder to use on Whonix/Linux. Setting up a VPN over Tor on Whonix will also be more complicated than on Windows as well. #### If you can use Tor: You can decide if you prefer to conduct your sensitive activities from the Whonix Workstation provided in the earlier section **(highly recommended)** or from a Custom VM that will use the Whonix Gateway like the Whonix Workstation (less secure but might be required depending on what you intend to do). #### If you cannot use Tor: If you cannot use Tor, you can use a Custom VM of your choice that will ideally use an anonymous VPN, if possible, to then connect to the Tor network. Or you could go with the risky route: See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] ### Linux Virtual Machine (Whonix or Linux): #### Whonix Workstation **(recommended and preferred)**: **Skip this step if you cannot use Tor.** Just use the provided Whonix Workstation VM. **It is the safest and most secure way to go on this route.** **It is also the only VM that will provide Stream Isolation pre-configured for most apps by default**[^358]**.** If you want additional software on the Workstation (such as another Browser), follow their guide here ^{[[Archive.org]][341]} Consider running Whonix in Live Mode if for extra malware protection, See ^{[[Archive.org]][342]} Do not forget to apply the VM hardening recommendations here: [Virtualbox Hardening recommendations]. Consider using AppArmor on your Whonix Workstations by following this guide: ^{[[Archive.org]][343]} #### Linux (any distro): **Be careful, any customization you make to the non-Whonix guest VMs (keyboard layout, language, time zone, screen resolution, or other) could be used to fingerprint your VMs later. See ** ^{[[Archive.org]][344]} ##### If you can use Tor (natively or over a VPN): Use the Linux Distro of your choice. We would recommend Ubuntu or Fedora for convenience but any other would work too. Be sure to not enable any telemetry. Refer to this tutorial ^{[[Archive.org]][345]} for detailed instructions. Consider hardening the VM as recommended in [Hardening Linux]. ##### If you cannot use Tor: Use the Linux Distro of your choice. We would recommend Ubuntu or Fedora for convenience but any other would work too. Be sure to not enable any telemetry. You could go with the risky route: See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] ##### Choose a browser within the VM: This time, we will recommend Brave browser. See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM] See [Appendix V1: Hardening your Browsers][Appendix V1: Hardening your Browsers:] as well. ### Windows 10/11 Virtual Machine: **Be careful, any customization you make to the non-Whonix guest VMs (keyboard layout, language, time zone, screen resolution, or other) could be used to fingerprint your VMs later. See ** ^{[[Archive.org]][344]} #### Windows 10 and 11 ISO download: Go with the Official Windows 10/11 Pro VM and harden it yourself: see [Appendix C: Windows Installation Media Creation][306] and go with the ISO route. #### If you can use Tor (natively or over a VPN): Refer to this tutorial ^{[[Archive.org]][345]} for detailed instructions. ##### Install: - Shut down the Whonix Gateway VM (this will prevent Windows from sending out telemetry and allow you to create a local account). - Open Virtualbox - Select Machine > New > Select Windows 10 or Windows 11 64bit - Allocate a minimum amount of 2GB for Windows 10 and 4GB for Windows 11 - Create a Virtual Disk using the VDI format and select Dynamically Allocated - Keep the disk size at 50GB for Windows 10 and 80GB for Windows 11 (this is a maximum; it should not reach that much) - Make sure PAE/NX is enabled in System > Processor - Select the VM and click Settings, Go into the Network Tab - Select "Internal Network" in the "Attached to" Field and select Whonix. - Go into the Storage Tab, Select the Empty CD and click the icon next to SATA Port 1 - Click on "Choose a disk file" and select the Windows ISO you previously downloaded - Click ok and start the VM - Virtualbox will prompt you to either push a button to boot the ISO or ask you what to boot, select the ISO or click. - Follow the steps in [Appendix A: Windows Installation] - Start the Whonix Gateway VM ##### Network Settings: - Back to your Windows - Windows 10: Go back into Settings then Network & Internet. Windows 11: Go into settings, click the upper left menu and pick "Network and Internet" - Windows 10: Click Properties (Below Ethernet). Windows 11: Click Ethernet - Windows 10: Edit IP settings. Windows 11: Edit IP assignment. - Windows 10: Enable IPv4 and set the following, Windows 11: Switch from DHCP to Manual and set the following: - IP address ```10.152.152.50``` (increase this IP by one for any other VM) - Subnet prefix length ```18``` (```255.255.192.0```) - Gateway ```10.152.152.10``` (this is the Whonix Gateway) - (Windows 10) DNS ```10.152.152.10``` (this is again the Whonix Gateway) - (Windows 11) exit the IP assignment and select DNS server assignment and set it to ```10.152.152.10``` (this is again the Whonix Gateway) - Save - Windows might prompt you if you want to be "discoverable" on this network. Click NO. Always stay on a "public network" if prompted. **Every time you will power on this VM in the future, you should make sure to change its Ethernet Mac Address before each boot. You can do this in Virtualbox > Settings > Network > Advanced > Click the refresh button next to the MAC address. You can only do this while the VM is powered off.** #### If you cannot use Tor: See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] ##### Install: - Open Virtualbox - Select Machine > New > Select Windows 10 or 11 64bit - Allocate a minimum amount of 4GB of RAM for 11 , 2GB of RAM for 10. - Create a Virtual Disk using the VDI format and select Dynamically Allocated - In the System/Processor tab, make sure PAE/NX is enabled. - Keep the disk size at 80GB for 11, 50GB for 10 (this is a maximum; it should not reach that much) - Go into the Storage Tab, Select the Empty CD and click the icon next to SATA Port 1 - Click on "Choose a disk file" and select the Windows ISO you previously downloaded - Click ok and start the VM - Virtualbox will prompt you to either push a button to boot the ISO or ask you what to boot, select the ISO or click. - Follow the steps in [Appendix A: Windows Installation] ##### Network Settings: - Windows will prompt you if you want to be discoverable on this network. Click NO. **Every time you will power on this VM in the future, you should make sure to change its Ethernet Mac Address before each boot. You can do this in Virtualbox > Settings > Network > Advanced > Click the refresh button next to the MAC address. You can only do this while the VM is powered off.** #### Choose a browser within the VM: This time, we will recommend Brave browser. See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM] See [Appendix V1: Hardening your Browsers][Appendix V1: Hardening your Browsers:] as well. #### Additional Privacy settings in Windows 10/11: See [Appendix B: Windows Additional Privacy Settings] ### Android Virtual Machine: Because sometimes you want to run mobile Apps anonymously too. You can also set up an Android VM for this purpose. As in other cases, ideally, this VM will also be sitting behind the Whonix Gateway for Tor network connectivity. But this can also be set up as VPN over Tor over VPN #### If you can use Tor (natively or over a VPN): Later in the VM settings during creation, go into Network and select Internal Network, Whonix. Then on Android itself: - Select Wi-Fi - Select VirtWifi to connect - Go into the advanced Wi-Fi properties - Switch from DHCP to Static - IP address ```10.152.152.50``` (increase this IP by one for any other VM) - Subnet prefix length ```18``` (```255.255.192.0```) - Gateway ```10.152.152.10``` (this is the Whonix Gateway) - DNS ```10.152.152.10``` (this is again the Whonix Gateway) #### If you cannot use Tor: Just use the tutorials as is and see [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] #### Installation: Two possibilities: AnBox or Android-x86 Personally, We would recommend AnBox over Android-x86 but it requires Linux ##### AnBox: Basically follow the tutorial here for installing AnBox on the Whonix Workstation: ^{[[Archive.org]][347]} for running Android Applications within an AnBox VM. Or follow the instructions here to install on any other VM **(Linux Only)** ##### Android-x86: Basically, follow the tutorial here: ^{[[Archive.org]][348]} - Download the ISO file of your choice - Create a New VM. - Select Linux and Linux 2.6 / 3.x / 4.x 64 Bit. - In System: - Allocate at least 2048MB (2GB) memory - Uncheck the Floppy drive - In the Processor Tab, select at least 1 or more CPUs - Enable PAE/NX - In Display Settings, Change the adapter to VBoxVGA - In Audio Settings, Change to Intel HD Audio - Start the VM - Select Advanced if you want persistence, Live if you want a disposable Boot (and skip the next steps). - Select Auto Install on Selected Hard Disk - Select Run Android - Set up as you wish (disable all prompts for data collections). **I recommend using the TaskBar Home.** - Go into Settings, Android-x86 Options, and disable all collections. - Connect to VirtWifi Wi-Fi Network **(see the above section if you are behind Whonix and want to use Tor)** You are now done and can now install any Android app. ### macOS Virtual Machine: Yes, you can actually run macOS within Virtualbox (on Windows/Linux/macOS host systems) if you want to use macOS. You can run any version of macOS you want. #### If you can use Tor (natively or over a VPN): During the following tutorials, before starting the macOS VM, make sure you do put the macOS VMs on the Whonix Network. - Select the VM and click Settings, Go into the Network Tab - Select "Internal Network" in the "Attached to" Field and select Whonix Afterward, and during the install, you will need to input an IP address manually to connect through the Whonix Gateway. Use these settings when prompted in the macOS installation process: - IP address ```10.152.152.50``` (increase this IP by one for any other VM) - Subnet prefix length ```18``` (```255.255.192.0```) - Gateway ```10.152.152.10``` (this is the Whonix Gateway) - DNS ```10.152.152.10``` (this is again the Whonix Gateway) #### If you cannot use Tor: Just use the tutorials as is and see [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] #### Installation: - Windows Host OS: - Virtualbox Catalina Tutorial: ^{[[Archive.org]][349]} - Virtualbox Big Sur Tutorial: ^{[[Archive.org]][350]} - Virtualbox Monterey Tutorial: ^{[[Archive.org]][351]} - macOS Host OS: - Just use the same tutorials as above but execute the various commands in the terminal. It should work without issue. - Linux Host OS: - Just use the same tutorials as above but execute the various commands in the terminal. It should work without issue. There are some drawbacks to running macOS on Virtual Machines. The main one is that they do not have a serial number (0 by default) and you will be unable to log in to any Apple-provided service (iCloud, iMessage...) without a genuine ID. You can set such IDs using this script: ^{[[Archive.org]][352]} but keep in mind that randomly generated IDs will not work and using the ID of someone else will break their Terms of Services and could count as impersonation (and therefore could be illegal). Note: We also ran in multiple issues with running these on AMD processors. This can be fixed so here is the configurationWeused which worked fine with Catalina, Big Sur and Monterey which will tell Virtualbox to emulate an Intel Processor instead: - ```VBoxManage modifyvm "macOSCatalina" ---cpuidset 00000001 000106e5 00100800 0098e3fd bfebfbff``` - ```VBoxManage setextradata "macOSCatalina" "VBoxInternal/Devices/efi/0/Config/DmiSystemProduct" "MacBookPro15,1" ``` - ```VBoxManage setextradata "macOSCatalina" "VBoxInternal/Devices/efi/0/Config/DmiBoardProduct" "Mac-551B86E5744E2388"``` - ```VBoxManage setextradata "macOSCatalina" "VBoxInternal/Devices/smc/0/Config/DeviceKey" "ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"``` - ```VBoxManage setextradata "macOSCatalina" "VBoxInternal/Devices/smc/0/Config/GetKeyFromRealSMC" 1``` - ```VBoxManage modifyvm "macOSCatalina" --cpu-profile "Intel Core i7-6700K"``` - ```VBoxManage setextradata "macOSCatalina" VBoxInternal2/EfiGraphicsResolution 1920x1080``` #### Hardening macOS: Refer to [Hardening macOS]. #### Choose a browser within the VM: This time, we will recommend Brave browser. See why here: [Appendix V: What browser to use in your Guest VM/Disposable VM] See [Appendix V1: Hardening your Browsers][Appendix V1: Hardening your Browsers:] as well. ### KeepassXC: You will need something to store your data (logins/passwords, identities, and TOTP[^359] information). For this purpose, we strongly recommend KeePassXC because of its integrated TOTP feature. This is the ability to create entries for 2FA[^360] authentication with the authenticator feature. Remember this should ideally be installed on your Guest VM and not on your Host OS. You should never do any sensitive activities from your Host OS. Here are the tutorials: - Tails: KeePassXC is integrated by default - Whonix: ^{[[Archive.org]][353]} - Linux: - Download from ^{[[Archive.org]][354]} - Follow the tutorial here ^{[[Archive.org]][355]} - Windows: - Download from ^{[[Archive.org]][354]} - Follow the tutorial here ^{[[Archive.org]][355]} - macOS: - Download from ^{[[Archive.org]][354]} - Follow the tutorial here ^{[[Archive.org]][355]} Test that KeePassXC is working before going to the next step. ### VPN client installation (cash/Monero paid): **If you decided to not use a cash-paid VPN and just want to use Tor, skip this step.** **If you cannot use a VPN at all in a hostile environment, skip this step.** Otherwise, see [Appendix R: Installing a VPN on your VM or Host OS][Appendix R: Installing a VPN on your VM or Host OS.] to install a VPN client on your client VM. This should conclude the Route and you should now be ready. #### About VPN Client Data Mining/Leaks: You might be asking yourself if those VPN clients are trustworthy not to leak any information about your local environment to the VPN provider when using them in the "VPN over Tor" context. This is a valid concern but should be taken with a grain of salt. Remember that all VPN activities are happening from a sandboxed VM on an internal network behind a Network Gateway (the Whonix Gateway). It does not matter much if the VPN client leaves some identifiers on your guest VM. The guest VM is still sandboxed and walled-off from the Host OS. The attack surface is small especially when using the reputable and recommended VPN providers within the guides (iVPN, Mullvad, Proton VPN, and maybe Safing.io). At best, the VPN client would know your local IP (internal IP) and some randomized identifiers but should not be able to get anything from the Host OS. And in theory, the VPN client should not send any telemetry back to the VPN provider. If your VPN client does this or asks this, you should consider changing the provider. ### (Optional) Allowing only the VMs to access the internet while cutting off the Host OS to prevent any leak: This step will allow you to configure your Host OS so that only the Whonix Gateway VM will have access to the internet. This will therefore prevent any "leak" from your Host OS while letting the Whonix Gateway establish the tor connectivity. The other VMs (Whonix Workstation or any other VM you installed behind it will not be affected) There are three ways to do this: - The Lazy Way (not really recommended): not supported by Whonix and might have some security implications as you will expose the Whonix Gateway VM to the Public Wi-Fi network. We would recommend against this unless you are in a hurry or very lazy. - **This method will not work with Wi-Fi captive portals requiring any registration to connect.** - The Better Way (see further down): still not supported by Whonix but it will not expose the Whonix Gateway VM to the Public Wi-Fi network. This should keep things in check in terms of security. - The Best Way: Using an external USB Wi-Fi dongle and just disabling Wi-Fi on the Host OS/Computer. #### The Lazy Way (**not supported by Whonix** but it will work if you are in a hurry, see further for the better way): **This way is not supported by the Whonix project**[^361] but I will go ahead and give this option anyway. This is helpful to prevent your Host OS from leaking any information while you are using the Whonix VMs. **Note that this option as-is will only work on Wi-Fis without a captive portal (where you must enter some information to unlock access).** The illustration below shows the result of this step: ![][356] ##### Configuration of the Whonix Gateway VM: For this to work, we will need to change some configurations on the Whonix Gateway VM. we will need to add a DHCP client to the Whonix Gateway to receive IP addresses from the network. To do those changes the Host OS will still have to have internet access allowed for now. So here is how: - Be sure to have your Host OS connected to a safe Wi-Fi. - Through VirtualBox, start the Whonix Gateway VM - Start a Terminal on the VM - Install a DHCP client on the Whonix Gateway VM using the following command: - ```sudo apt install dhcpcd5``` - Now edit the Whonix Gateway VM network configuration using the following command: - ```sudo nano /etc/network/interfaces.d/30_non-qubes-whonix``` - Within the file change the following lines: - ```# auto eth0``` to ```auto eth0``` - ```# iface eth0 inet dhcp``` to ```iface eth0 inet dhcp``` - ```iface eth0 inet static``` to ```# iface eth0 inet static``` - ``` address 10.0.2.15``` to ```# address 10.0.2.15``` - ``` netmask 255.255.255.0``` to ```# netmask 255.255.255.0``` - ``` gateway 10.0.2.2``` to ```# gateway 10.0.2.2``` - Save (using Ctrl+X and confirm with Y) and power off the VM from the top left menu - Go into the VirtualBox Application and select the Whonix Gateway VM - Click Settings - Click the Network Tab - For Adapter 1, change the "Attached To" value from "NAT" to "Bridged Adapter" - As "Name", select your Wi-Fi network Adapter - Click OK and you are done with the VM configuration part ##### Configuration of the Host OS: Now you must block internet access from your Host OS while still allowing the VM to connect. This will be done by connecting to Wi-Fi with the Host OS but without assigning itself an IP address. The VM will then use your Wi-fi association to get an IP address. ###### Windows Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open an administrative command prompt (right-click on Command Prompt and Run as Administrator) - Run the following command: ```route delete 0.0.0.0``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the Whonix Gateway VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. ###### Linux Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open a Terminal - Run the following command: ```sudo ip route del default``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the Whonix Gateway VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. ###### macOS Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open a Terminal - Run the following command: ```sudo route delete default``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the Whonix Gateway VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. #### The Better Way (recommended): This way will not go against Whonix recommendations (as it will not expose the Whonix Gateway to the Host OS) and will have the advantage of allowing connections not only to open Wi-Fis but also to the ones with a Captive Portal where you need to enter some information to access the internet. Yet this will still not be supported by the Whonix project, but it is fine as the main concern for the earlier Lazy Way is to have the Whonix Gateway VM exposed to the Host Network, and it will not be the case here. This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge. For this purpose, I will recommend the use of a lightweight Linux Distro. Any will do but the easiest will be an Ubuntu-based distro and I would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup. Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else. Of course, you can also achieve this with any other Linux distro if you so decide you do not like XUbuntu. This is how it will look at the end: ![][357] ##### Installing XUbuntu VM: XUbuntu was picked due the performance of XFCE. Make sure you are connected to a safe Wi-Fi for this operation. First, you will need to download the latest XUbuntu Stable release ISO from When you are done with the download, it is time to create a new VM: - Start VirtualBox Manager - Create a new VM and name it as you want, for example, "XUbuntu Bridge" - Select type "Linux" - Select Version "Ubuntu (64-bit)" - Leave other options to default and click Create - On the next screen, leave the default options and click Create - Select the newly create VM and click Settings - Select Network - For Adapter 1, Switch to Bridged Mode and pick your Wi-Fi adapter in the Name - Select Adapter 2 and enable it - Attach it to "Internal Network" and name it "XUbuntu Bridge" - Select Storage - Select the Empty CD drive - On the right side, click the CD icon and select "Choose a disk file" - Select the ISO of XUbuntu you previously downloaded and Click Ok - Start the VM - Select Start XUbuntu - Select Install XUbuntu - Pick your Keyboard Layout and click Continue - Select Minimal Installation and Download Updates while installing XUbuntu - Select Erase Disk and install XUbuntu and click Install Now - Select the Time Zone of your choice and click Continue - Pick some random names unrelated to you (my favorite username is "NoSuchAccount") - Pick a password and require a password to login - Click Continue and wait for the install to finish and Restart - When you are done rebooting, log-in - Click the upper right connection icon (it looks like two rotating spheres) - Click Edit Connections - Select Wired Connection 2 (Adapter 2 previously configured in VirtualBox settings) - Select the IPv4 Tab - Change the Method to "Shared to other computers" and click Save - You are now done setting up the XUbuntu Bridge VM ##### Configuring the Whonix Gateway VM: By default, the Whonix Gateway has no DHCP client and will require one to get an IP from a shared network you configured earlier: - Through VirtualBox, start the Whonix Gateway VM - Start a Terminal on the VM - Install a DHCP client on the Whonix Gateway VM using the following command: - ```sudo apt install dhcpcd5``` - Now edit the Whonix Gateway VM network configuration using the following command: - ```sudo nano /etc/network/interfaces.d/30_non-qubes-whonix``` - Within the file change the following lines: - ```# auto eth0``` to ```auto eth0``` - ```# iface eth0 inet dhcp``` to ```iface eth0 inet dhcp``` - ```iface eth0 inet static``` to ```# iface eth0 inet static``` - ``` address 10.0.2.15``` to ```# address 10.0.2.15``` - ``` netmask 255.255.255.0``` to ```# netmask 255.255.255.0``` - ``` gateway 10.0.2.2``` to ```# gateway 10.0.2.2``` - Save (using Ctrl+X and confirm with Y) and power off the VM from the top left menu - Go into the VirtualBox Application and select the Whonix Gateway VM - Click Settings - Click the Network Tab - For Adapter 1, change the "Attached To" value from "NAT" to "Internal Network" - As "Name", select the internal network "XUbuntu Bridge" you created earlier and click OK - Reboot the Whonix Gateway VM - From the upper left menu, select System, Tor Control Panel, and check that you are connected (you should be) - You are done configuring the Whonix Gateway VM ##### Configuration of the Host OS: Now you must block internet access from your Host OS while still allowing the XUbuntu Bridge VM to connect. This will be done by connecting to Wi-Fi with the Host OS but without assigning itself a gateway address. The VM will then use your Wi-fi association to get an IP address. If necessary, from the XUbuntu Bridge VM, you will be able to launch a Browser to enter information into any captive/registration portal on the Wi-Fi network. Only the XUbuntu Bridge VM should be able to access the internet. The Host OS will be limited to local traffic only. ###### Windows Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open an administrative command prompt (right-click on Command Prompt and Run as Administrator) - Run the following command: ```route delete 0.0.0.0``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the XUbuntu Bridge VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - If necessary, you can use the XUbuntu Bridge VM Browser to fill in any information on any captive/registration portal to access the Wi-Fi. - After that, you can start the Whonix Gateway VM which should obtain the Internet Connection from the XUbuntu Bridge VM. - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. ###### Linux Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open a Terminal - Run the following command: ```sudo ip route del default``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the XUbuntu Bridge VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - If necessary, you can use the XUbuntu Bridge VM Browser to fill in any information on any captive/registration portal to access the Wi-Fi. - After that, you can start the Whonix Gateway VM which should obtain the Internet Connection from the XUbuntu Bridge VM. - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. ###### macOS Host OS: The goal here is to associate with a Wi-Fi network without having an internet connection. You will achieve this by deleting the Gateway from the connection after you are connected: - First, connect to the safe Wi-Fi of your choice - Open a Terminal - Run the following command: ```sudo route delete default``` (this deletes the Gateway from your IP configuration) - You are done, your Host OS will now be unable to access the internet while still connected to the Wi-Fi - Note that this will reset at each disconnect/reconnection to a network, and you will have to delete the route again. This is not permanent. - You can now start the XUbuntu Bridge VM which should now obtain an IP automatically from the Wi-Fi network and should provide Network to the other VMs behind (Whonix Workstation or other). - If necessary, you can use the XUbuntu Bridge VM Browser to fill in any information on any captive/registration portal to access the Wi-Fi. - After that, you can start the Whonix Gateway VM which should obtain the Internet Connection from the XUbuntu Bridge VM. - And finally, after that, you can start the Whonix Workstation VM (or any other VM you configured to work behind the Whonix Gateway VM) and it should be connected to the internet through Tor. #### The best way: This way will not go against Whonix recommendations (as it will not expose the Whonix Gateway to the Host OS) and will have the advantage of allowing connections not only to open Wi-Fis but also to the ones with a Captive Portal where you need to enter some information to access the internet. Yet this will still not be supported by the Whonix project, but it is fine as the main concern for the earlier Lazy Way is to have the Whonix Gateway VM exposed to the Host Network, and it will not be the case here. This option is the best because the network will be completely disabled on the Host OS from booting up. This option will require an additional VM between the Host OS and the Whonix Gateway to act as a Network Bridge and to connect to the Wi-Fi network. **This option requires a working USB Wi-Fi Dongle that will be passed through to a bridge VM.** For this purpose, I will recommend the use of a lightweight Linux Distro. Any will do but the easiest will be an Ubuntu-based distro and I would recommend the lightweight XUbuntu as it will be extremely easy to configure this setup. Why XUbuntu and not Ubuntu or KUbuntu? Because XUbuntu uses an XFCE desktop environment which is lightweight and this VM will only serve as a proxy and nothing else. Of course, you can also achieve this with any other Linux distro if you so decide you do not like XUbuntu. This is how it will look at the end: ![][358] ##### Configuration of the Host OS: - Disable Networking on your Host OS completely (Turn off the on-board Wi-Fi completely) - Plug in and install your USB Wi-Fi Dongle. Connect it to a safe Public Wi-Fi. This should be easy and automatically installed by any recent OS (Windows 10/11, macOS, Linux). ##### Configuring the Whonix Gateway VM: By default, the Whonix Gateway has no DHCP client and will require one to get an IP from a shared network you will configure later, on a Bridge VM: - Through VirtualBox, start the Whonix Gateway VM - Start a Terminal on the VM - Install a DHCP client on the Whonix Gateway VM using the following command: - ```sudo apt install dhcpcd5``` - Now edit the Whonix Gateway VM network configuration using the following command: - ```sudo nano /etc/network/interfaces.d/30_non-qubes-whonix``` - Within the file change the following lines: - ```# auto eth0``` to ```auto eth0``` - ```# iface eth0 inet dhcp``` to ```iface eth0 inet dhcp``` - ```iface eth0 inet static``` to ```# iface eth0 inet static``` - ``` address 10.0.2.15``` to ```# address 10.0.2.15``` - ``` netmask 255.255.255.0``` to ```# netmask 255.255.255.0``` - ``` gateway 10.0.2.2``` to ```# gateway 10.0.2.2``` - Save (using Ctrl+X and confirm with Y) and power off the VM from the top left menu ##### Installing XUbuntu VM: Make sure you are connected to a safe Wi-Fi for this operation. First, you will need to download the latest XUbuntu Stable release ISO from When you are done with the download, it is time to create a new VM: - Disconnect your host OS from the Wi-Fi you previously connected to with the dongle and forget the network. - Start VirtualBox Manager - Create a new VM and name it as you want, for example, "XUbuntu Bridge" - Select type "Linux" - Select Version "Ubuntu (64-bit)" - Leave other options to default and click Create - On the next screen, leave the default options and click Create - Select the newly create VM and click Settings - Select Network - For Adapter 1, Attach it to "Internal Network" and name it "XUbuntu Bridge" - Select Storage - Select the Empty CD drive - On the right side, click the CD icon and select "Choose a disk file" - Select the ISO of XUbuntu you previously downloaded and Click Ok - Select the USB Tab - On the right side, click the USB icon with a + sign (the second from the top) - Select the Wi-Fi Adapter Dongle from the list and make sure it is checked (leave the USB options to default) - Start the VM - Select Start XUbuntu - Select Install XUbuntu - Pick your Keyboard Layout and click Continue - Select Minimal Installation and do not check the Download Updates during the install option - Select Erase Disk and install XUbuntu and click Install Now - Select the Time Zone of your choice and click Continue - Pick some random names unrelated to you (my favorite username is "NoSuchAccount") - Pick a password and require a password to login - Click Continue and wait for the install to finish and Restart - When you are done rebooting, log-in - Click the upper right connection icon (it looks like two rotating spheres) - Click Edit Connections - Select Wired Connection 1 (normally there should only be one) - Select the IPv4 Tab - Change the Method to "Shared to other computers" and click Save - Again, click the upper right connection icon - Connect to the safe Wi-Fi of your choice and if necessary, input the necessary information into a Captive Portal. - You are now done setting up the XUbuntu Bridge VM At this stage, your Host OS should have no network at all and your XUbuntu VM should have a fully working Wi-Fi connection and this Wi-Fi connection will be shared to the Internal Network "XUbuntu Bridge". ##### Additional configuration of the Whonix Gateway VM: Now it is time to configure the Whonix Gateway VM to get access from the shared network from the bridge VM you just made on the earlier step: - Go into the VirtualBox Application and select the Whonix Gateway VM - Click Settings - Click the Network Tab - For Adapter 1, change the "Attached To" value from "NAT" to "Internal Network" - As "Name", select the internal network "XUbuntu Bridge" you created earlier and click OK - Reboot the Whonix Gateway VM - From the upper left menu, select System, Tor Control Panel, and check that you are connected (you should be) - You are done configuring the Whonix Gateway VM At this stage, your Whonix Gateway VM should be getting internet access from the XUbuntu Bridge VM which in turn is getting internet access from the Wi-Fi Dongle and sharing it. Your Host OS should have no network connectivity at all. All the VMs behind the Whonix Gateway should now work fine without additional configuration. ### Final step: **Take a post-install VirtualBox snapshot of your VMs.** You are done and can now skip the rest to go to the [Getting Online][Getting Online:] part. ## The Qubes Route: **Note that the guide has been updated to Qubes OS 4.1** As they say on their website, Qubes OS is a reasonably secure, free, open-source, and security-oriented operating system for single-user desktop computing. Qubes OS leverages and extensively uses Xen-based virtualization to allow for the creation and management of isolated compartments called Qubes. Qubes OS is not a Linux distribution[^362] but a Xen distribution. It is different from Linux distributions because it will make extensive use of Virtualization and Compartmentalization so that any app will run in a different VM (Qube). As a bonus, Qubes OS integrates Whonix by default and allows for increased privacy and anonymity. It is highly recommended that you document yourself over Qubes OS principles before going this route. Here are some recommended resources: - Qubes OS Introduction, ^{[[Archive.org]][359]} - Qubes OS Video Tours, ^{[[Archive.org]][360]} - Qubes OS Getting Started, ^{[[Archive.org]][361]} - YouTube, Life Behind the Tinfoil: A Look at Qubes and Copperhead - Konstantin Ryabitsev, The Linux Foundation ^{[[Invidious]][362]} - YouTube, We used the reasonably-secure Qubes OS for 6 months and survived - Matty McFatty [@themattymcfatty] ^{[[Invidious]][363]} - YouTube, Qubes OS: How it works, and a demo of this VM-centric OS ^{[[Invidious]][364]} This OS is recommended by prominent figures such as Edward Snowden, PrivacyGuides.org. Qubes is the best option in this guide for people who are more comfortable with Linux and tech in general. But it has some downsides such as the lack of OS-wide plausible deniability, its hardware requirements, and its hardware compatibility. While you can run this on 4GB of RAM as per their requirements ^{[[Archive.org]][363]}, the recommended RAM is 16GB. We would recommend against using Qubes OS if you have less than 8GB of RAM. If you want a comfortable experience, you should have 16GB, if you want a particularly enjoyable experience, you should have 24GB or 32GB. The reason for this RAM requirement is that each app will run in a different VM and each of those VM will require and allocate a certain amount of memory that will not be available for other apps. If you are running native Windows apps within Qubes OS Qubes, the ram overhead will be significant. You should also check their hardware compatibility here ^{[[Archive.org]][365]} before proceeding. Your mileage might vary, and you might experience several issues about hardware compatibility that you will have to troubleshoot and solve yourself. I think that if you can afford it and are comfortable with the idea of using Linux, you should go with this route as it is probably the best one in terms of security and privacy. The only disadvantage of this route is that it does not provide a way to enable OS-wide plausible deniability ^{[[Archive.org]][311]}, unlike the Whonix route. ### Pick your connectivity method: There are seven possibilities within this route: - **Recommended and preferred:** - **Use Tor alone (User > Tor > Internet)** - **Use VPN over Tor (User > Tor > VPN > Internet) in specific cases** - **Use a VPS with a self-hosted VPN/Proxy over Tor (User > Tor > Self-Hosted VPN/Proxy > Internet) in specific cases** - Possible if required by context: - Use VPN over Tor over VPN (User > VPN > Tor > VPN > Internet) - Use Tor over VPN (User > VPN > Tor > Internet) - Not recommended and risky: - Use VPN alone (User > VPN > Internet) - Use VPN over VPN (User > VPN > VPN > Internet) - **Not recommended and highly risky (but possible)** - No VPN and no Tor (User > Internet) ![][310] #### Tor only: This is the preferred and most recommended solution. ![][366] With this solution, all your network goes through Tor, and it should be sufficient to guarantee your anonymity in most cases. There is one main drawback tho: **Some services block/ban Tor Exit nodes outright and will not allow account creations from those.** To mitigate this, you might have to consider the next option: VPN over Tor but consider some risks associated with it explained in the next section. #### VPN/Proxy over Tor: This solution can bring some benefits in some specific cases vs using Tor only where accessing the destination service would be impossible from a Tor Exit node. This is because many services will just outright ban, hinder, or block Tor Exit Nodes (see ^{[[Archive.org]][312]}). This solution can be achieved in two ways: - Paid VPN over Tor (easiest) - Paid Self-Hosted VPS configured as VPN/Proxy (most efficient in avoiding online obstacles such as captchas but requiring more skills with Linux) As you can see in this illustration, if your cash (preferred)/Monero paid VPN/Proxy is compromised by an adversary (despite their privacy statement and no-logging policies), they will only find an anonymous cash/Monero paid VPN account connecting to their services from a Tor Exit node. ![][367] If an adversary somehow manages to compromise the Tor network too, they will only reveal the IP of a random public Wi-Fi that is not tied to your identity. If an adversary somehow compromises your VM OS (with malware or an exploit for instance), they will be trapped within the internal Network of Whonix and should be unable to reveal the IP of the public Wi-Fi. **This solution however has one main drawback to consider: Interference with Tor Stream Isolation**[^364]. Stream isolation is a mitigation technique used to prevent some correlation attacks by having different Tor Circuits for each application. Here is an illustration to show what stream isolation is: ![][314] (Illustration from Marcelo Martins, ^{[[Archive.org]][315]}) VPN/Proxy over Tor falls on the right-side[^365] meaning using a VPN/Proxy over Tor forces Tor to use one circuit for all activities instead of multiple circuits for each. This means that using a VPN/Proxy over Tor can reduce the effectiveness of Tor in some cases and should therefore be used only for some specific cases: - When your destination service does not allow Tor Exit nodes. - When you do not mind using a shared Tor circuit for various services. For instance for using various authenticated services. **You should however consider not using this method when your aim is just to browse random various unauthenticated websites as you will not benefit from Stream Isolation and this could make correlation attacks easier for an adversary between each of your sessions (see [Your Anonymized Tor/VPN traffic][Your Anonymized Tor/VPN traffic:]).** More information at: - ^{[[Archive.org]][316]} - ^{[[Archive.org]][317]} - ^{[[Archive.org]][318]} #### Tor over VPN: You might be wondering: Well, what about using Tor over VPN instead of VPN over Tor? - Disadvantages - Your VPN provider is just another ISP that will then know your origin IP and will be able to de-anonymize you if needed. We do not trust them. Prefer a situation where your VPN provider does not know who you are. It does not add much in terms of anonymity. - This would result in you connecting to various services using the IP of a Tor Exit Node which is banned/flagged in many places. It does not help in terms of convenience. - Advantages: - **The main advantage is that if you are in a hostile environment where Tor access is impossible/dangerous/suspicious, but VPN is okay.** - This method also does not break Tor Stream isolation. Note, if you're having issues accessing the Tor Network due to blocking/censorship, you could try using Tor Bridges (see Tor Documentation ^{[[Archive.org]][244]} and Whonix Documentation ^{[[Archive.org]][337]}). It is also possible to consider **VPN over Tor over VPN (User > VPN > Tor > VPN > Internet)** using two cash/Monero paid VPNs instead. This means that you will connect the Host OS to a first VPN from your Public Wi-Fi, then Whonix will connect to Tor, and finally, your VM will connect to a second VPN over Tor over VPN (see ^{[[Archive.org]][319]}). This will of course have a significant performance impact and might be quite slow, but Tor is necessary somewhere for achieving reasonable anonymity. Achieving this technically is easy within this route, you need two separate anonymous VPN accounts and must connect to the first VPN from the Host OS and follow the route. Conclusion: Only do this if you think using Tor alone is risky/impossible but VPNs are okay. Or just because you can and so why not. This method will not lower your security/privacy/anonymity. #### VPN only: This route will not be explained nor recommended. **If you can use VPNs then you should be able to add a Tor layer over it. And if you can use Tor, then you can add an anonymous VPN over Tor to get the preferred solution.** Just using a VPN or even a VPN over VPN makes no sense as those can be traced back to you over time. One of the VPN providers will know your real origin IP (even if it is in a safe public space) and even if you add one over it, the second one will still know you were using that other first VPN service. This will only slightly delay your de-anonymization. Yes, it is an added layer ... but it is a persistent centralized added layer, and you can be de-anonymized over time. This is just chaining 3 ISPs that are all subject to lawful requests. For more info, please see the following references: - ^{[[Archive.org]][320]} - ^{[[Archive.org]][321]} - ^{[[Archive.org]][322]} - ^{[[Archive.org]][323]} - ^{[[Archive.org]][324]} **In the context of this guide, Tor is required somewhere to achieve reasonable and safe anonymity and you should use it if you can.** #### No VPN/Tor: If you cannot use VPN nor Tor where you are, you probably are in a very hostile environment where surveillance and control are extremely high. Just do not, it is not worth it and too risky. You can be de-anonymized almost instantly by any motivated adversary that could get to your physical location in a matter of minutes. Do not forget to check back on [Adversaries (threats)] and [Appendix S: Check your network for surveillance/censorship using OONI]. If you have absolutely no other option and still want to do something, see [Appendix P: Accessing the internet as safely as possible when Tor/VPN is not an option][Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] **(at your own risk).** #### Conclusion: | Connection Type | Anonymity | Ease of Access to online resources | Tor Stream isolation | Safer where Tor is suspicious/dangerous | Speed | Cost | Recommended | |------------------------------------|-----------|------------------------------------|----------------------|-----------------------------------------|------------|---------------------------|--------------------------------------------------| | Tor Alone | **Good** | **Medium** | **Possible** | **No** | **Medium** | **Free** | **Yes** | | Tor over VPN | **Good+** | **Medium** | **Possible** | **Yes** | **Medium** | **Around 50€/y** | **If needed (Tor inaccessible)** | | Tor over VPN over Tor | **Best** | **Medium** | **Possible** | **Yes** | **Poor** | **Around 50€/y** | **Yes** | | VPN over Tor | **Good-** | **Good** | **No** | **No** | **Medium** | **Around 50€/y** | **If needed (convenience)** | | Self-Hosted VPS VPN/Proxy over Tor | **Good-** | **Very Good** | **No** | **No** | **Medium** | **Around 50€/y** | **If needed (convenience)** | | VPN/Proxy over Tor over VPN | **Good-** | **Good** | **No** | **Yes** | **Poor** | **Around 100€/y** | **If needed (convenience and Tor inaccessible)** | | VPN/Proxy Alone | **Bad** | **Good** | **N/A** | **Yes** | **Good** | **Around 50€/y** | **No** | | No Tor and VPN | **Bad** | **Unknown** | **N/A** | **No** | **Good** | **Around 100€ (Antenna)** | **No. At your own risk.** | Unfortunately, using Tor alone will raise the suspicion of many destinations' platforms. You will face many hurdles (captchas, errors, difficulties signing up) if you only use Tor. In addition, using Tor where you are could put you in trouble just for that. But Tor remains the best solution for anonymity and must be somewhere for anonymity. - If you intend to create persistent shared and authenticated identities on various services where access from Tor is hard, we recommend the **VPN over Tor** and **VPS VPN/Proxy over Tor** options (or VPN over Tor over VPN if needed). It might be a bit less secure against correlation attacks due to breaking Tor Stream isolation but provides much better convenience in accessing online resources than just using Tor. It is an "acceptable" trade-off IMHP if you are careful enough with your identity. - **Note: It is becoming more common that mainstream services and CDNS are also blocking or hindering VPN users with captchas and other various obstacles**. **In that case, a self-hosted VPS with a VPN/Proxy over Tor is the best solution for this as having your own dedicated VPS guarantees you are the sole user of your IP and encounter little to no obstacles.** Consider a [Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux)][Self-hosted VPN/Proxy on a Monero/Cash-paid VPS (for users more familiar with Linux):] if you want the least amount of issues (this will be explained in the next section in more details). - If your intent however is just to browse random services anonymously without creating specific shared identities, using tor friendly services; or if you do not want to accept that trade-off in the earlier option. **Then we recommend using the Tor Only route to keep the full benefits of Stream Isolation (or Tor over VPN if you need to).** - If cost is an issue, we recommend the Tor Only option if possible. - If both Tor and VPN access are impossible or dangerous then you have no choice but to rely on Public wi-fi safely. See [Appendix P: Accessing the internet as safely as possible when Tor and VPNs are not an option] For more information, you can also see the discussions here that could help decide yourself: - Tor Project: ^{[[Archive.org]][325]} - Tails Documentation: - ^{[[Archive.org]][326]} - ^{[[Archive.org]][327]} - Whonix Documentation (in this order): - ^{[[Archive.org]][328]} - ^{[[Archive.org]][329]} - ^{[[Archive.org]][319]} - Some papers on the matter: - ^{[[Archive.org]][322]} ### Getting an anonymous VPN/Proxy: **Skip this step if you want to use Tor only or VPN is not an option.** See [Appendix O: Getting an anonymous VPN/Proxy] ### Note about Plausible Deniability: Qubes OS uses LUKS for full disk encryption and it is technically possible to achieve a form of deniability by using detached LUKS headers. This is not yet integrated into this guide but you will find an evolving tutorial on how to achieve this here: and some more background information within the Linux Host OS section (see [Note about plausible deniability on Linux]). ### Installation: You will follow the instructions from their own guide ^{[[Archive.org]][368]}: (Secure Boot is not supported as per their FAQ: ^{[[Archive.org]][369]} so it should be disabled in the BIOS/UEFI settings.) - Download the latest Qubes OS 4.1.x installation ISO according to their hardware compatibility list. - Get and verify the Qubes OS Master Signing key:

Type	Whonix	Prism-Break.org	PrivacyGuides.org	Tails	This guide
Offline Document Editing	LibreOffice	N/A	LibreOffice*	LibreOffice	LibreOffice, Notepad++
Online Document Editing (collaboration)	N/A	Cryptpad.fr	Cryptpad.fr, Etherpad.org, Privatebin.net	N/A	Cryptpad.fr, Etherpad.org, Privatebin.net
Pictures Editing	Flameshot (L)	N/A	N/A	GIMP	GIMP
Audio Editing	Audacity	N/A	N/A	Audacity	Audacity
Video Editing	Flowblade (L)	N/A	N/A	N/A	Flowblade (L) Olive (?) OpenShot (?) ShotCut (?)
Screen Recorder	Vokoscreen	N/A	N/A	N/A	Vokoscreen
Media Player	VLC	N/A	N/A	VLC	VLC
PDF Viewer	Ristretto (L)	N/A	N/A	N/A	Browser
PDF Redaction	PDF-Redact Tools (L)	N/A	N/A	PDF-Redact Tools (L)	LibreOffice, PDF-Redact Tools (L)

Browser	https://coveryourtracks.eff.org/ Fingerprinting Test with real Ad
Safari (Normal)*	Fail (Unique)
Safari (Private Window) *	Fail (Unique)
Edge (Normal)**	Fail (Unique)
Edge (Private Window) **	Fail (Unique)
Firefox (Normal)	Fail (Unique)
Firefox (Private Window)	Fail (Unique)
Chrome (Normal)	Fail (Unique)
Chrome (Private Window)	Fail (Unique)
Brave (Normal)	Passed (Randomized)
Brave (Private Window)	Passed (Randomized)
Brave (Tor Window)	Passed (Randomized)
Tor Browser (Normal mode)	Partial
Tor Browser (Safer mode)	Partial
Tor Browser (Safest mode)	Unknown (Result did not load)

Service	Against ToS	Requires Phone	Requires E-Mail	VPN Sign-up	Tor Sign-up	Captchas	ID or Financial Checks	Facial Checks	Manual Checks	Overall difficulty
Amazon	No	No	Yes	Yes	Yes	No	Yes*	No	Unclear	N/A
Apple	Yes*	Yes	Yes	Yes	Yes	No	No	No	No	Medium
Binance	Yes*	No	Yes	Yes	No	Yes	No	No	No	Medium
Briar	No	No	No	Yes	Yes	No	No	No	No	Easy
Discord	No	No	Yes	Yes	Yes	Yes	No	No	No	Medium
Element	No	No	No	Yes	Yes	Yes	No	No	No	Easy
Facebook	Yes*	Yes	Yes	Maybe	Maybe	Yes	Maybe	Maybe	Maybe	Hard
GitHub	No	No	Yes	Yes	Yes	Yes	No	No	No	Easy
GitLab	No	No	Yes	Yes	Yes	Yes	No	No	No	Easy
Google	No	Likely	Likely	Yes	Yes	Yes	Maybe	No	Maybe	Medium
HackerNews	No	No	No	Yes	Yes	Yes	No	No	No	Easy
Instagram	Unclear	Likely	Yes	Yes	Yes	Yes	No	Maybe	Maybe	Medium
Jami	No	No	No	Yes	No	No	No	No	No	Easy
iVPN	No	No	No	Yes	Yes	No	No	No	No	Easy
Kraken	Yes*	No	Yes	Yes	No	No	No	No	No	Medium
LinkedIn	Yes*	Yes	Yes	Yes	Yes	Yes	Maybe	Maybe	Maybe	Hard
MailFence	No	No	Yes	Yes	Maybe	Yes	No	No	No	Medium
Medium	No	No	Yes	Yes	Yes	No	No	No	No	Easy
Microsoft	Yes*	Maybe	Maybe	Yes	Yes	Yes	No	No	No	Medium
Mullvad	No	No	No	Yes	Yes	No	No	No	No	Easy
Njalla	No	No	No	Yes	Yes	No	No	No	No	Easy
OnionShare	No	No	No	Yes	Yes	No	No	No	No	Easy
OnlyFans	No	No	Yes	Yes	Yes	Yes	Yes (for full functionalities)	No	No	Hard (for full functionalities)
Proton Mail	No	Maybe	Likely	Yes	Yes	Yes	No	No	No	Medium
Proton VPN	No	No	Yes	Yes	Yes	No	No	No	No	Medium
Reddit	No	No	No	Yes	Yes	No	No	No	No	Easy
Slashdot	Yes*	No	No	Yes	Yes	Yes	No	No	No	Medium
Telegram	No	Yes	No	Yes	Yes	No	No	No	No	Easy
Tutanota	No	No	No	Maybe	No	Yes	No	No	No	Hard
Twitch	No	No	Yes	Yes	Yes	Yes	No	No	No	Easy
Twitter	No	Yes	Yes	Yes	Yes	Yes	No	No	Maybe	Medium
WhatsApp	Yes*	Yes	No	Yes	Yes	No	No	No	No	Medium
4chan	No	No	No	No	No	Yes	No	No	No	Hard

App⁰	e2ee¹	Roll Your Own Crypto	Perfect Forward Secrecy	Zero-Access Encryption at-rest⁵	Metadata Protection (obfuscation, encryption…)	Open-Source	Default Privacy Settings	Native Anonymous Sign-up (no e-mail or phone)	Possible through Tor	Privacy and Security Track Record ***	De-centralized	Additional notes
Berty (avoid)	Yes	No	Yes	Yes	Yes	Yes ¹³	Good	Yes	Yes	Good	Yes (peer to peer)	Not sufficiently reviewed by this project, cannot recommend
Briar (preferred)	Yes	No ¹	Yes	Yes	Yes (strong)	Yes	Good	Yes	Natively³	Good	Yes (peer to peer)
Cwtch (preferred)	Yes	No	Yes	Yes	Yes (strong)	Yes	Good	Yes	Natively	Good	Yes (peer to peer)
Discord (avoid)	No	Closed-source⁷	No	No	No	No	Bad	E-Mail Required	Virtualization	Bad	No
Element / Matrix.org (preferred)	Yes (opt-in)	No	Yes	Yes	Poor²	Yes	Good	Yes	Via Proxy³ or Virtualization	Good	Partial (federated servers)
Facebook Messenger (avoid)	Partial (Only 1to1 / opt-in)	Closed-source⁷	Yes	No	No	No	Bad	E-Mail and Phone required	Virtualization	Bad	No
OnionShare (preferred)	Yes	No	TBD⁸	TBD⁸	Yes (strong)	Yes	Good	Yes	Natively	Good	Yes (peer to peer)
Apple Messages (aka iMessage)	Yes	Closed-source⁷	No	Partial	No	No	Good	Apple device Required	Maybe Virtualization using real Apple device ID	Bad	No
IRC	Yes (OTR plugins)	No	No	No	No	Yes	Bad	Yes	Via Proxy³ or Virtualization	Good	No
Jami (preferred)	Yes	No³	Yes	Yes	Partial	Yes	Good	Yes	Via Proxy³ or Virtualization⁹	Good	Partial	Tor breaks some features
KakaoTalk (avoid)	Yes	Closed-source⁷	No⁴	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
Keybase	Yes	No	Partial (exploding message)	No	No	Yes	Good	E-Mail Required			No
Kik (avoid)	No	Closed-source⁷	No	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
Line (avoid)	Partial (opt-in)	Closed-source⁷	No	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
Pidgin with OTR (avoid)	Yes (OTR⁵)	No	Yes	No	No	Yes	Bad	Yes	Via Proxy³ or Virtualization	Bad⁶	No
Tox (avoid)	Yes	No	No	No	No	Yes	Good	Yes	Via Proxy³ or Virtualization	Medium⁷	Yes	Known cryptographic weaknesses¹⁴
Session (Preferred only on iOS)	Yes	No	No	Yes	Yes	Yes	Good	Yes	Via Proxy³ or Virtualization¹⁰	Good	Yes	Lacks PFS, deniability
Signal	Yes	No	Yes	Yes	Yes (moderate)	Yes	Good	Phone Required	Virtualization	Good	No	Requires burner or anonymous VOIP number for anonymous usage
Skype (avoid)	Partial (Only 1to1 / opt-in)	Closed-source⁷	No	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
SnapChat (avoid)	No	Closed-source⁷	No	No	No	No	Bad	No (but possible)	Virtualization	Bad	No	Deleted/expired messages are easily recoverable¹⁵,¹⁶
Teams (avoid)	Yes	Closed-source⁷	No	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
Telegram	Partial (Only 1to1 / opt-in)	Yes (MTProto⁸)	Partial (secret chats only)	Yes	No	Partial⁵	Medium (e2ee off by default)	Phone Required	Via Proxy³ or Virtualization	Medium⁹	No
Viber (avoid)	Partial (Only 1to1)	Closed-source⁷	Yes	No	No	No	Bad	No (but possible)	Virtualization	Bad	No
WeChat (avoid)	No	Closed-source⁷	No	No	No	No	Bad	No	Virtualization	Bad	No
WhatsApp (avoid)	Yes	Closed-source⁷	Yes	No	No	No	Bad	Phone Required	Virtualization	Bad	No
Wickr Me	Partial (Only 1to1)	No	Yes	No	Yes (moderate)	No	Good	Yes	Virtualization	Good	No
Gajim (XMPP) (preferred)	Yes	No	Yes	No	No	Yes	Good	Yes	Via Proxy³ or Virtualization	Good	Partial
Zoom (avoid¹⁰)	Disputed¹¹	No	TBD⁸	No	No	No	Bad	E-Mail Required	Virtualization	Bad¹²	No	Malware risk¹⁷