Essay:Quick privacy guide - Revision history

CriticalResist at 22:01, 1 August 2026

2026-08-01T22:01:22Z

← Older revision		Revision as of 22:01, 1 August 2026
Line 56:		Line 56:
	* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>		* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>
	** <code>'''Encrypt your hard drives'''. You may need to ''clone'' (technical term) the drives first, reformat with encryption, and then clone the backup back to the drive. Encrypt after you've switched to Linux because you will have to reformat your drives either way - and can encrypt with LUKS while you're installing Linux, saving time.</code>		** <code>'''Encrypt your hard drives'''. You may need to ''clone'' (technical term) the drives first, reformat with encryption, and then clone the backup back to the drive. Encrypt after you've switched to Linux because you will have to reformat your drives either way - and can encrypt with LUKS while you're installing Linux, saving time.</code>
			** <code>On Windows, '''BitLocker is not trustworthy''' - it's owned and maintained by Microsoft, and I have read about backdoor issues on it. Since I am not on Windows, and neither should you, I can't say much more. The recommended encryption software seems to be VeraCrypt for Windows. For Linux, it's still LUKS (Luks2 with argon2id algorithm, more specifically).</code>
	** <code>Use a '''password manager''' such as '''KeepassXC''', the only one that's consistently recommended in actual privacy guides.</code>		** <code>Use a '''password manager''' such as '''KeepassXC''', the only one that's consistently recommended in actual privacy guides.</code>
	** <code>For all of the above, you can use the same diceware passphrase as the decrypting password. It's uncrackable* (again, see below). That way you remember ''one'' password for everything.</code>		** <code>For all of the above, you can use the same diceware passphrase as the decrypting password. It's uncrackable* (again, see below). That way you remember ''one'' password for everything.</code>

CriticalResist at 21:48, 1 August 2026

2026-08-01T21:48:54Z

← Older revision		Revision as of 21:48, 1 August 2026
Line 20:		Line 20:


			* <code>'''DON'T TALK TO POLICE'''. Gotta begin with that. Anything you tell police will be recorded and can later be used against you, and '''not just in the US'''. "Well, I was just there, I didn't participate" - oh, so you were there. So now we're gonna make your life harder because you said you were there and maybe you're the one that did it. Oh look, there's a law (you never knew about) that says you had to intervene, now you can be sued for that.</code>
			** <code>Lying to investigators = bad. But not saying anything is not lying, legally. This is the difference. Also you can incriminate yourself just trying to be helpful and they will jump on that. See Scott McTiernan lying to FBI when he should have just been honest (too long to explain here).</code>
			** <code>"I have nothing to say officer, and I want to talk to my lawyer now". That's all you say, ever.</code>
			** <code>They don't care if you did it or not. They care to provide a case the prosecutor can argue in court. They will use any tactic including threatening you, or alternatively pretending to be your friend, or alternatively pretending to "just be looking for the truth, and get the facts straight etc".</code>
			** <code>Nothing good has ever come out of talking to police.</code>
			** <code>If police knocks at your door: meet them outside on the patio, close door behind you. Do not let them into your home.</code>
			** <code>Some of this will depend on your laws. We started a guide [[Essay:The guide to talk to police by country\|here]], but it's highly incomplete.</code>
	* <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>		* <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>
	** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc. Librewolf protects you against more than fingerprinting, this is just one example of what ~~that~~ does.</code>		** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc. Librewolf protects you against more than fingerprinting, this is just one example of what it does.</code>
	** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>		** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>

CriticalResist at 21:30, 1 August 2026

2026-08-01T21:30:27Z

CriticalResist: /* References */

2026-07-25T17:53:37Z

References

← Older revision		Revision as of 17:53, 25 July 2026
Line 189:		Line 189:
	[[Category:Essays]]		[[Category:Essays]]
	[[Category:Essays by CriticalResist]]		[[Category:Essays by CriticalResist]]
			<references />
			<references group="lower-alpha" />

CriticalResist at 17:53, 25 July 2026

2026-07-25T17:53:01Z

@@ Line 21: / Line 21: @@
 * <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>
-** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc.</code>
+** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc. Librewolf protects you against more than fingerprinting, this is just one example of what that does.</code>
 ** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>
@@ Line 146: / Line 146: @@
 To finish up, I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?
-To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.
+'''Startpage''' for example is a search engine that people use because it claims to be private - that's the entire reason you would use startpage. It says so in the tab title: "Startpage - Private Search Engine. No Tracking. No Search History."
-There is a huge amount of trust as well. When an app says it is private, and says it has a no-logs, ram-only policy, you still have to trust that they actually follow their policy unless, like in Mullvad's case, it gets its baptism of fire. But, that's the limitation: you trust the devs to do what they said they do. It doesn't mean you shouldn't or can't use the app, it just means you trust them to that extent.
+I was not impressed by startpage's privacy policy:
 That's about it for this guide, otherwise it'll start being cognitive overload. Just do a little at a time, it's fine, nobody can ever do ''everything''.

CriticalResist: /* Diceware pass phrases */

2026-06-02T00:48:11Z

Diceware pass phrases

← Older revision		Revision as of 00:48, 2 June 2026
Line 104:		Line 104:
	'''Why diceware algorithm and not just making up 5 words in your head though?''' Because our head is not truly random. You will pick a word from a movie you watched recently, or a place you went to, or something you like. Diceware is truly random.		'''Why diceware algorithm and not just making up 5 words in your head though?''' Because our head is not truly random. You will pick a word from a movie you watched recently, or a place you went to, or something you like. Diceware is truly random.

	~~This doesn~~'t ~~mean~~ there ~~aren~~'t other ~~vectors~~ of attack:		If you can't easily install or find diceware for your operating system though, there's a possible alternative method. Diceware, as its name implies, rolls dice to find words from a word list.

			If you have a printed dictionary at home: roll a dice 4 or 5 times. First 3 rolls are page number (up to page 666), fourth and fifth rolls is the word # on this page. so if you roll and get:

			5 3 3 4 1

			Open the dictionary at page 533, and look for word 41 (if there are fewer than 41 words on that page, turn to the next page and keep counting).

			You can make the dice rolls more complicated if you want so you can go above page 666.

			Why so convoluted? Because again, our minds are not fully random. We are talking about an important password that controls access to every other password/file you own. Take the time to do it properly ''once'', then forget about it - you'll remember it for the rest of your life.


			'''Vectors of attack''' exist against diceware pass phrases''':'''

	* '''Compulsion''': many jurisdictions are getting wise to this practice and passing laws to compel you to surrender your password. In some cases, saying "sorry but I forgot it" is not even a valid defense! But here's the thing: with a weak password or no encryption, you don't get the choice to talk with your lawyer about surrendering the password or not. That's just how I see it, it buys you time and a wider net of decisions if such laws exist where you live.		* '''Compulsion''': many jurisdictions are getting wise to this practice and passing laws to compel you to surrender your password. In some cases, saying "sorry but I forgot it" is not even a valid defense! But here's the thing: with a weak password or no encryption, you don't get the choice to talk with your lawyer about surrendering the password or not. That's just how I see it, it buys you time and a wider net of decisions if such laws exist where you live.
Line 115:		Line 128:
	In general, never assume you are fully safe. You don't need to be paranoid though, just remember why you do this: so that if you are ever investigated by the fascist state for your journalism or activism, they will have a harder time building a case against you.		In general, never assume you are fully safe. You don't need to be paranoid though, just remember why you do this: so that if you are ever investigated by the fascist state for your journalism or activism, they will have a harder time building a case against you.

	It's an old cat and mouse game. Developers make new privacy/security features, hackers crack them, devs make ''new'' security features. You will never be ahead of the curve - just the other day, I saw a new form of attack that hijacks a website, pretends you have to do "Cloudflare verification", and when you copy and run the code they ask you to, it's actually malware getting installed on your machine. We ~~get~~ so used to having to do these "verification steps" (especially if you use a VPN) that some people just don't think about it and do whatever the page asks.		It's an old cat and mouse game. Developers make new privacy/security features, hackers crack them, devs make ''new'' security features. You will never be ahead of the curve - just the other day, I saw a new form of attack that hijacks a website, pretends you have to do Cloudflare verification, and when you copy and run the code they ask you to run, it's actually malware getting installed on your machine. We are so used to having to do these "verification steps" (especially if you use a VPN) that some people just don't think about it and do whatever the page asks.

	So yes, this means you still need to use your head. Having GrapheneOS or Librewolf+VPN doesn't mean you can say whatever on X dot com without repercussions. It doesn't mean your computer can't be hacked remotely by a three-letter agency and malware installed that you will never ~~find out~~ (if you're not on their radar though, then there is no reason they would even know you exist).		So yes, this means you still need to use your head. Having GrapheneOS or Librewolf+VPN doesn't mean you can say whatever on X dot com without repercussions. It doesn't mean your computer can't be hacked remotely by a three-letter agency and malware installed that you will never know about (if you're not on their radar though, then there is no reason they would even know you exist).

	Like I said, this is a rabbit hole. There's now concerns with Intel CPUs that the US government has a backdoor into them. If deployed, this means they could just read and even access your computer through its CPU remotely, if you use Intel. We pretty much know, from the Snowden leaks, that the NSA owns backdoors into every big US tech company. Again, this doesn't mean you have to disconnect and live off the grid, just that you know to be mindful of what you share.		Like I said, this is a rabbit hole. There's now concerns with Intel CPUs that the US government has a backdoor into them. If deployed, this means they could just read and even access your computer through its CPU remotely, if you use Intel. We pretty much know, from the Snowden leaks, that the NSA owns backdoors into every big US tech company. Again, this doesn't mean you have to disconnect and live off the grid, just that you know to be mindful of what you share.
Line 129:		Line 142:
	Technically, if police can seize a server/computer quickly enough and freeze the components with liquid nitrogen, they can freeze the RAM cells in place, allowing them to transport it even without electricity to the station, and extract the contents of your RAM sticks there.<ref>https://www.securitum.com/memory_heist_the_secrets_and_risks_of_cold_boot_attacks.html</ref>		Technically, if police can seize a server/computer quickly enough and freeze the components with liquid nitrogen, they can freeze the RAM cells in place, allowing them to transport it even without electricity to the station, and extract the contents of your RAM sticks there.<ref>https://www.securitum.com/memory_heist_the_secrets_and_risks_of_cold_boot_attacks.html</ref>

	These two methods have yet to be used in real, uncontrolled conditions ('''as far as I'm aware'''), but they are very real and new vectors of attack, so who knows what they'll come up with next.		These two methods have yet to be used in real, uncontrolled conditions ('''as far as I'm aware'''), but they are very real and new vectors of attack, so who knows what they'll come up with next. This is why I say, again: you don't have to become paranoid because security is a rabbit hole that never ends. You just have to be mindful that things are moving and what is the correct practice today may not be in 10 years.

	To finish up, I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?		To finish up, I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?
Line 135:		Line 148:
	To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.		To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.

	There is a huge amount of trust as well. When an app says it is private, and says it has a no-logs, ram-only policy, you still have to trust that they actually follow their policy unless, like in Mullvad's case, it gets its baptism of fire. But, that's the limitation: you trust the devs to do what they ~~say~~ they do. It doesn't mean you shouldn't or can't use the app, it just means you trust them to that extent.		There is a huge amount of trust as well. When an app says it is private, and says it has a no-logs, ram-only policy, you still have to trust that they actually follow their policy unless, like in Mullvad's case, it gets its baptism of fire. But, that's the limitation: you trust the devs to do what they said they do. It doesn't mean you shouldn't or can't use the app, it just means you trust them to that extent.

	That's about it for this guide, otherwise it'll start being cognitive overload. Just do a little at a time, it's fine, nobody can ever do ''everything''.		That's about it for this guide, otherwise it'll start being cognitive overload. Just do a little at a time, it's fine, nobody can ever do ''everything''.

CriticalResist at 13:30, 22 May 2026

2026-05-22T13:30:04Z

CriticalResist at 12:49, 22 May 2026

2026-05-22T12:49:46Z

← Older revision		Revision as of 12:49, 22 May 2026
Line 22:		Line 22:
	* <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>		* <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>
	** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc.</code>		** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc.</code>
			** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>

	* <code>Use a '''2FA Authenticator app'''. I recommend Aegis on Android - open-source, fully-local. Set up 2FA on all your accounts - this is just further protection against hacking. You will need to scan a QR code with Aegis, and that's it, it's set up.</code>		* <code>Use a '''2FA Authenticator app'''. I recommend Aegis on Android - open-source, fully-local. Set up 2FA on all your accounts - this is just further protection against hacking. You will need to scan a QR code with Aegis, and that's it, it's set up.</code>

CriticalResist at 11:44, 22 May 2026

2026-05-22T11:44:29Z

← Older revision		Revision as of 11:44, 22 May 2026
Line 133:		Line 133:

	== References ==		== References ==

			[[Category:Essays]]
			[[Category:Essays by CriticalResist]]

CriticalResist: Created page with "{{Infobox essay|title=Quick privacy guide|author=CriticalResist|date=2026-05-22|excerpt=Yes, there are many privacy guides. But this one is mine. Meant to be quick and give you the cognitive tools to understand privacy.}} Yes, there are many privacy guides. But this one is mine. It's meant to be short and give you the cognitive tools and a checklist to understand privacy. Look, fascism is coming back to Europe and North America. It never fully left. If you live in the..."

2026-05-22T11:33:28Z

Created page with "{{Infobox essay|title=Quick privacy guide|author=CriticalResist|date=2026-05-22|excerpt=Yes, there are many privacy guides. But this one is mine. Meant to be quick and give you the cognitive tools to understand privacy.}} Yes, there are many privacy guides. But this one is mine. It's meant to be short and give you the cognitive tools and a checklist to understand privacy. Look, fascism is coming back to Europe and North America. It never fully left. If you live in the..."

New page

{{Infobox essay|title=Quick privacy guide|author=CriticalResist|date=2026-05-22|excerpt=Yes, there are many privacy guides. But this one is mine. Meant to be quick and give you the cognitive tools to understand privacy.}}

Yes, there are many privacy guides. But this one is mine. It's meant to be short and give you the cognitive tools and a checklist to understand privacy.

Look, fascism is coming back to Europe and North America. It never fully left. If you live in the Global South, chances are you're already living under a fascist dictatorship that the US installed in your country.

Digital privacy is a rabbit hole, I won't deny it. There's always something "more" you could do, and best practices evolve rapidly. Everyone kind of has their own security practices, and everyone thinks they're doing it better than anyone else.

Here's my philosophy: As the Filton 24 trials show, the point is not necessarily to prevent police from getting anything to indict you with. It's to prevent them from giving the prosecution a better case. Al Capone, the famous gangster, was arrested on tax evasion charges, not on the murder and bootlegging, because that's famously all the FBI could find on him.

Furthermore, my philosophy is also to do these steps before you actually need them. You won't install Linux while the SWAT is barging down your door - you do it 10 years in advance, in preparation for when you'll actually need it. This is why I say again: you have time to do this. Don't feel overwhelmed. Just come back to this list once in a while, do the next item on it.

== Technical stuff you need to do ==
First part: the technical checklist. There's a belief that switching to privacy-hardening alternatives is difficult; it's actually not, I will say that right away. You slowly learn and do it day by day. It takes some time to set up at first, but once it's done, you get used to it in 3 days and forget how the "more convenient" stuff ever looked like.

Trust me - I did it and it was painless. Worst case scenario if you get frustrated? You just take a break, leave everything as is, and get back to it on another day.

Here's what I'm suggesting. I tried to order the advice from ''simplest to do'' to ''most complex''. 'Complex' doesn't mean it's difficult or prone to fail, just that you might want to set some time aside to do it.

* <code>Switch to '''Librewolf browser'''. Technically you can harden Firefox, but Librewolf just does it for you automatically.</code>
** <code>Before you do, just open this page: https://sinceyouarrived.world/taken. It's safe. It just tells you all the personally identifiable information your browser helpfully sends to every web page you open as part of its normal operation. This is called fingerprinting, but Librewolf spoofs this data automatically. Assume every website gets and tracks this information about you: your timezone, your location, your GPU(!), your resolution, your OS, your browser, etc.</code>

* <code>Use a '''2FA Authenticator app'''. I recommend Aegis on Android - open-source, fully-local. Set up 2FA on all your accounts - this is just further protection against hacking. You will need to scan a QR code with Aegis, and that's it, it's set up.</code>

* <code>Switch to a no-logs '''search engine'''. This is kinda based on how much you trust the provider.</code>
** <code>I use 4get.ca, a tiny no-name (and kind of edgy, unfortunately) search engine that serves as a proxy to DDG, Google, Yandex, Brave etc. There's other search engines, but I don't trust big names. Just personal.</code>

* <code>Use '''Mullvad VPN'''. The only one that as a proven no-logs, ram-only policy. Nothing else comes close, don't even look anywhere else.</code>
** <code>Use only their own servers, not ones they rent. There's a toggle in the app. Rented servers are not guaranteed to actually respect no-logs and ram-only policies.</code>
** <code>'''VPN ALWAYS ON.'''</code>
** <code>Pay by cash envelope, no more than ~100$/€/£ at a time. Don't leave fingerprints on the envelope.</code>
** <code>Do not ever link your email address to your mullvad in any way.</code>
** <code>VPNs don't just hide your IP address. They also hide your internet traffic from your ISP, and make finding your browsing history and browsing actions much harder. In 2024, Swedish police raided Mullvad to try and seize a server - after Mullvad explained their operation, they left empty-handed because there was nothing to seize.</code>
** <code>Turn on all the stuff they have (dAIta, multihop, etc). Put it on your phone too.</code>

* <code>'''Email''' is just not secure. I don't know how else to break it to you. Email was invented in the 70s before hacking was even illegal. They did not even think about security or privacy back then.</code>
** <code>'''Proton''' is slightly ahead of the curve but '''will cooperate with police agencies''' and give them whatever they can. They fundraise for [[Freedom House]], a US government agency passing as an "NGO", and called it "nonprofit, nonpartisan organization"<ref>[https://proton.me/blog/2024-lifetime-account-charity-fundraiser Proton 2024 Fundraiser]</ref>... which is a lie. Personally, I don't trust them. But that's just me.</code>
** <code>'''Philosophy is: don't say it by email.''' Simple as. If you've already said stuff in emails you shouldn't have, delete them... that's the best you can do. Then, stop discussing sensitive stuff by email from now on.</code>

* <code>'''Chat platforms''': they all kinda suck. Telegram and Signal are ''not'' secure - Signal can be compelled by the US gov to give them data on you and you would never know it.<ref>If you're interested in more reading: https://dessalines.github.io/essays/why_not_signal.html</ref> This data can be enough to prosecute you. They ''will'' give it, they won't protect you. So don't assume you can say whatever on Signal and be safe.</code>
** <code>'''Metadata is valuable too'''. This is unencrypted information such as who you talked to, when, for how long, etc. "Data about data". Metadata is enough to lead to investigations and convictions.</code>
** <code>'''Matrix''' is the only one that's still safe-ish, but you have to trust the server owner. This is not a matrix guide, so I won't go into more details. Not many people use it. Otherwise: just be mindful of how you act on these platforms, that's it.</code>

* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>
** <code>'''Encrypt your hard drives'''. You may need to ''clone'' (technical term) the drives first, reformat with encryption, and then clone the backup back to the drive. Encrypt after you've switched to Linux because you will have to reformat your drives either way - and can encrypt with LUKS while you're installing Linux, saving time.</code>
** <code>Use a '''password manager''' such as '''KeepassXC''', the only one that's consistently recommended in actual privacy guides.</code>
** <code>For all of the above, you can use the same diceware passphrase as the decrypting password. It's uncrackable* (again, see below). That way you remember ''one'' password for everything.</code>

* <code>Switch to a '''Linux OS'''.</code>
** <code>There are very good working alternatives today, such as Mint or Zorin OS (very sleek and professional look).</code>
** <code>Getting used to Linux is very easy nowadays. if you run into an issue, ask an LLM about it (preferably a Chinese one such as Deepseek or Kimi) and chances are you will find a fix.</code>
** <code>Set up ''timeshift'' and ''Pika backups'' on a spare drive so you can always roll back if you break something. Trust me, I was a Linux noob 6 months ago, now I'm deploying my own scripts and automations on it. FOSS has come a long way and works and looks great today.</code>

* <code>Use '''different usernames''' everywhere. Or at least try to. Unique usernames for each service. Your password manager can remember them for you.</code>
** <code>On social media, make new accounts periodically and delete the old ones. Don't use the same account for more than 6 months. You can have alt accounts: one for posting, one for browsing, for example. There are services that give you temporary email addresses you can use to register, or fake phone numbers to verify SMS codes. This is completely up to you, but it's an additional layer.</code>
** <code>Changing your usernames right now, if you can, is worth it. If you can't change them, either make new accounts or leave it be, up to you. What matters is future-proofing yourself more than anything, again planning ahead for when this will actually be useful.</code>

* <code>'''Phone''': switch to '''GrapheneOS'''. Not every phone is compatible, Graphene's website keeps a list. Google Pixels are currently the only possible choice because they use hardware that secures the phone itself, regardless of what its Operating System is.</code>
** <code>Until you have GrapheneOS, get a '''privacy respecting keyboard'''. On Android, install F-droid store (only FOSS software) and install a keyboard from there. Yes, you can change your keyboards on Android. If you use the default one, it sends data back to its developing company.</code>
** <code> This is last in the list because Graphene currently only supports Pixel phones, meaning you'd likely have to get a new one, and they're not cheap.</code>

Yes, this is not the shortest list. But here's the thing: you don't have to do everything ''right now''. Make a mullvad account today just to take a look, send the cash envelope next week. 3 months from now, when you have a long weekend off, install Linux. Switch to Librewolf part-time - you can absolutely install it alongside your current browser, and just test it out.

Do it little by little as your cognitive load permits. Start exploring. Ask AI (Kimi for security/privacy questions tbh) how to go about it, or if you're curious about a part of it. Send it the essay and tell it to make you a guide.

If your devices ever get seized by state agents, however briefly: change them. Don't even play around. Throw the old ones out, buy new ones, redo everything. Assume they installed a trojan on it that you will never be able to remove. Recycle your pass phrases and passwords.

Don't take your phone with you on protests. It's very easy to track a phone with cell towers. Don't even turn it off, just leave it at home.

==== Diceware pass phrases ====
You can skip this.

'''tl;dr:''' current best recommendations is switch to a pass phrase you remember that lives only in your head. Do not ever write it down, if you do, pen-and-paper only and burn it afterwards. Only use for most sensitive personal stuff (encrypted drives and encrypted password manager database): do not enter it at a work computer. Your job won't protect you.

But I need to talk a bit about passwords and best practices, because I feel this is the most important part of this guide. Diceware is a method of password generation. On Linux, you just install it with 'sudo apt install diceware' and use it from the terminal. On Windows, I am not sure. I would avoid any web page for generating a password though - it's convenient, but you don't know where it's stored or what they do with it. If your password can be read in clear text 6 months from now because it was in your browser's cache files, there is no point in having a secure password. Everything is just easier on Linux.

In any case. Diceware has a novel way of generating passwords. Instead of a garbled mess of characters such as <code>!AJ(%p"J3`3AZzAz</code>, Diceware generates a longer but easier to remember ''phrase'', such as: <code>outthink-gesture-clay-audible-nursery</code>

How easy is that to remember? Type it for a couple days and you'll remember it your entire life. The first password, with its exclamation marks and random letter arrangement? You will forget and mistype it often.

We are told to use special characters, capital letters, mix in numbers etc into our passwords, but these are mostly trivial for a computer program to crack through. Linux has a zxcvbn package, which is an algorithm created by Dropbox to check password strength. This is the most current and up to date checker right now, as it relies on the latest cracking methods to determine password strength. Let's check both passwords with it:
Password: !AJ(%p"J3`3AZzAz
zxcvbn results:
Crack Time Estimates:
Online (throttled, 100/hr): centuries
Online (no throttling, 10/s): centuries
Offline (slow hash, 10k/s): centuries
Offline (fast hash, 10B/s): '''12 days'''
Entropy: 53.2 bits
A sufficiently motivated attacker, such as a police lab with an array of RTX 5090 GPUs, can crack this "complicated" password in less than 2 weeks. Your case will take at least a year to go to court, in other words: this is not secure. Meanwhile, the diceware passphrase that looks deceptively simple:
password: outthink-gesture-clay-audible-nursery
zxcvbn results:
Crack Time Estimates:
Online (throttled, 100/hr): centuries
Online (no throttling, 10/s): centuries
Offline (slow hash, 10k/s): centuries
Offline (fast hash, 10B/s): centuries
Entropy: 95.8 bits
The diceware passphrase is much harder to crack, almost double the entropy, and much easier for you to remember entirely in your head - repeat it to yourself several times a day and you'll remember it in 72 hours. And it is future-proofed too: even at 100 billion guesses per second from a program trying to break through your encryption, it will still take ''millennia'' to crack. No GPU array today or in the future will ever be enough, not from a police lab that has a backlog and other passwords they need to crack.

'''Why diceware algorithm and not just making up 5 words in your head though?''' Because our head is not truly random. You will pick a word from a movie you watched recently, or a place you went to, or something you like. Diceware is truly random.

This doesn't mean there aren't other vectors of attack:

* '''Compulsion''': many jurisdictions are getting wise to this practice and passing laws to compel you to surrender your password. In some cases, saying "sorry but I forgot it" is not even a valid defense! But here's the thing: with a weak password or no encryption, you don't get the choice to talk with your lawyer about surrendering the password or not. That's just how I see it, it buys you time and a wider net of decisions if such laws exist where you live.
* The '''encryption algorithm''' itself could be cracked, allowing an agency to simply bypass needing your password entirely. This is unlikely but is one reason encryption algorithms change over time. It's still better to have a password than not.
* The last one I must acknowledge... criminals and in some places even police will just '''beat you up''' until you give them the password. This is already happening in crypto heists. Due diligence is required based on where you live.

Okay, that was the tangent on passwords.

== Your biggest asset is your head ==
In general, never assume you are fully safe. You don't need to be paranoid though, just remember why you do this: so that if you are ever investigated by the fascist state for your journalism or activism, they will have a harder time building a case against you.

It's an old cat and mouse game. Developers make new privacy/security features, hackers crack them, devs make ''new'' security features. You will never be ahead of the curve - just the other day, I saw a new form of attack that hijacks a website, pretends you have to do "Cloudflare verification", and when you copy and run the code they ask you to, it's actually malware getting installed on your machine. We get so used to having to do these "verification steps" (especially if you use a VPN) that some people just don't think about it and do whatever the page asks.

So yes, this means you still need to use your head. Having GrapheneOS or Librewolf+VPN doesn't mean you can say whatever on X dot com without repercussions. It doesn't mean your computer can't be hacked remotely by a three-letter agency and malware installed that you will never find out (if you're not on their radar though, then there is no reason they would even know you exist).

Like I said, this is a rabbit hole. There's now concerns with Intel CPUs that the US government has a backdoor into them. If deployed, this means they could just read and even access your computer through its CPU remotely, if you use Intel. We pretty much know, from the Snowden leaks, that the NSA owns backdoors into every big US tech company. Again, this doesn't mean you have to disconnect and live off the grid, just that you know to be mindful of what you share.

This is why I recommend everything Chinese as much as possible, because China will never work with US "security" agencies, seeing that these same agencies are the ones trying to dismantle China from the inside.

"But I have to trust China then". Yes. Welcome to the Chinese Century - it's great. What do you care if china knows something about you? The only country liable to bomb you and disappear you into a waterboarding black site is the United States of America, and they control most digital avenues until China overtakes them. Trust China, discard USA.

I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?

To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.

There is a huge amount of trust as well. When an app says it is private, and says it has a no-logs, ram-only policy, you still have to trust that they actually follow their policy unless, like in Mullvad's case, it gets its baptism of fire. But, that's the limitation: you trust the devs to do what they say they do. It doesn't mean you shouldn't or can't use the app, it just means you trust them to that extent.

That's about it for this guide, otherwise it'll start being cognitive overload. Just do a little at a time, it's fine, nobody can ever do ''everything''.

== References ==

← Older revision		Revision as of 21:30, 1 August 2026
Line 24:		Line 24:
	** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>		** <code>By choice, Librewolf does not have a phone app. However, they officially recommend IronFox on Android.<ref>https://librewolf.net/docs/faq/#will-you-provide-an-android-version-of-librewolf</ref></code>

			*<code>What about '''TOR'''? TOR is a modified version of Firefox that connects to The Onion Router network. you use it by downloading the TOR browser: https://www.torproject.org/download/</code>
			**<code>TOR works by routing you through a number of its nodes, hosted by organizations and random people. You bounce in a long chain, becoming effectively untrackable, protecting your privacy and not leaving any trace of what you did online.</code>
			**<code>If you use TOR, follow its advice. Don't use with on top of a VPN (''I believe''), don't resize the window, don't add plugins. It does everything by itself already. The point of TOR is that your traffic looks like it could be ''anyone's'' traffic. If you start messing with it you stand out.</code>
			**<code>It's not fullproof; nothing is. TOR did receive research funding from three-letter US Agencies (don't remember if it was the NSA or CIA or who), but there are reasons for this: it allows their agents to work clandestinely abroad, and for that they need people to host nodes. To date, I am not aware of anyone who used TOR '''correctly''' and has been prosecuted over what they did on TOR. What you do on TOR stays on TOR.</code>
			**<code>TOR can work for daily browsing but it's generally slow. The rule of thumb remains: whatever you do over TOR remains on TOR. Don't start logging into accounts and sending email with TOR.</code>
	* <code>Use a '''2FA Authenticator app'''. I recommend Aegis on Android - open-source, fully-local. Set up 2FA on all your accounts - this is just further protection against hacking. You will need to scan a QR code with Aegis, and that's it, it's set up.</code>		* <code>Use a '''2FA Authenticator app'''. I recommend Aegis on Android - open-source, fully-local. Set up 2FA on all your accounts - this is just further protection against hacking. You will need to scan a QR code with Aegis, and that's it, it's set up.</code>
			* <code>Switch to a '''no-logs''' '''search engine'''. This is kinda based on how much you trust the provider.</code>
	* <code>Switch to a no-logs '''search engine'''. This is kinda based on how much you trust the provider.</code>
	** <code>I use 4get.ca, a tiny no-name (and kind of edgy, unfortunately) search engine that serves as a proxy to DDG, Google, Yandex, Brave etc. There's other search engines, but I don't trust big names. Just personal.</code>		** <code>I use 4get.ca, a tiny no-name (and kind of edgy, unfortunately) search engine that serves as a proxy to DDG, Google, Yandex, Brave etc. There's other search engines, but I don't trust big names. Just personal.</code>

Line 36:		Line 40:
	** <code>VPNs don't just hide your IP address. They also hide your internet traffic from your ISP, and make finding your browsing history and browsing actions much harder. In 2024, Swedish police raided Mullvad to try and seize a server - after Mullvad explained their operation, they left empty-handed because there was nothing to seize.</code>		** <code>VPNs don't just hide your IP address. They also hide your internet traffic from your ISP, and make finding your browsing history and browsing actions much harder. In 2024, Swedish police raided Mullvad to try and seize a server - after Mullvad explained their operation, they left empty-handed because there was nothing to seize.</code>
	** <code>Turn on all the stuff they have (dAIta, multihop, etc). Put it on your phone too.</code>		** <code>Turn on all the stuff they have (dAIta, multihop, etc). Put it on your phone too.</code>

	* <code>'''Email''' is just not secure. I don't know how else to say it. Email was invented in the 70s before hacking was even illegal. They did not even think about security or privacy back then.</code>		* <code>'''Email''' is just not secure. I don't know how else to say it. Email was invented in the 70s before hacking was even illegal. They did not even think about security or privacy back then.</code>
	** <code>'''Proton''' is slightly ahead of the curve but '''will cooperate with police agencies''' and give them whatever they can. They fundraise for [[Freedom House]], a US government agency passing as an "NGO", and called it "nonprofit, nonpartisan organization"<ref>[https://proton.me/blog/2024-lifetime-account-charity-fundraiser Proton 2024 Fundraiser]</ref>... which is a lie. Personally, I don't trust proton. But that's just me.</code>		** <code>'''Proton''' is slightly ahead of the curve but '''will cooperate with police agencies''' and give them whatever they can. They fundraise for [[Freedom House]], a US government agency passing as an "NGO", and called it "nonprofit, nonpartisan organization"<ref>[https://proton.me/blog/2024-lifetime-account-charity-fundraiser Proton 2024 Fundraiser]</ref>... which is a lie. Personally, I don't trust proton. But that's just me.</code>
	** <code>'''Philosophy is: don't say it by email.''' Simple as. If you've already said stuff in emails you shouldn't have, delete them, that's the best you can do. Your recipient should also delete the emails. From now on, stop discussing sensitive stuff by email.</code>		** <code>'''Philosophy is: don't say it by email.''' Simple as. If you've already said stuff in emails you shouldn't have, delete them, that's the best you can do. Your recipient should also delete the emails. From now on, stop discussing sensitive stuff by email.</code>

	* <code>'''Chat platforms''': they all kinda suck. Telegram and Signal are ''not'' secure - Signal can be compelled by the US gov to give them data on you and you would never know it.<ref>If you're interested in more reading: https://dessalines.github.io/essays/why_not_signal.html</ref> This data can be enough to prosecute you. They ''will'' give it, they won't protect you. So don't assume you can say whatever on Signal and be safe.</code>		* <code>'''Chat platforms''': they all kinda suck. Telegram and Signal are ''not'' secure - Signal can be compelled by the US gov to give them data on you and you would never know it.<ref>If you're interested in more reading: https://dessalines.github.io/essays/why_not_signal.html</ref> This data can be enough to prosecute you. They ''will'' give it, they won't protect you. So don't assume you can say whatever on Signal and be safe.</code>
	** <code>'''Metadata is valuable too'''. This is unencrypted information such as who you talked to, when, for how long, etc. "Data about data". Metadata is enough to lead to investigations and convictions.</code>		** <code>'''Metadata is valuable too'''. This is unencrypted information such as who you talked to, when, for how long, etc. "Data about data". Metadata is enough to lead to investigations and convictions.</code>
	** <code>'''Matrix''' is the only one that's still safe-ish (encryption and decentralized nature), but you have to trust the server owner. This is not a matrix guide, so I won't go into more details. Not many people use it.</code>		** <code>'''Matrix''' is the only one that's still safe-ish (encryption and decentralized nature), but you have to trust the server owner. This is not a matrix guide, so I won't go into more details. Not many people use it.</code>
	** <code>Otherwise: just be mindful of how you act on these platforms, that's about the best you can do.</code>		** <code>Otherwise: just be mindful of how you act on these platforms, that's about the best you can do.</code>

	* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>		* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>
	** <code>'''Encrypt your hard drives'''. You may need to ''clone'' (technical term) the drives first, reformat with encryption, and then clone the backup back to the drive. Encrypt after you've switched to Linux because you will have to reformat your drives either way - and can encrypt with LUKS while you're installing Linux, saving time.</code>		** <code>'''Encrypt your hard drives'''. You may need to ''clone'' (technical term) the drives first, reformat with encryption, and then clone the backup back to the drive. Encrypt after you've switched to Linux because you will have to reformat your drives either way - and can encrypt with LUKS while you're installing Linux, saving time.</code>
	** <code>Use a '''password manager''' such as '''KeepassXC''', the only one that's consistently recommended in actual privacy guides.</code>		** <code>Use a '''password manager''' such as '''KeepassXC''', the only one that's consistently recommended in actual privacy guides.</code>
	** <code>For all of the above, you can use the same diceware passphrase as the decrypting password. It's uncrackable* (again, see below). That way you remember ''one'' password for everything.</code>		** <code>For all of the above, you can use the same diceware passphrase as the decrypting password. It's uncrackable* (again, see below). That way you remember ''one'' password for everything.</code>

	* <code>Switch to a '''Linux OS'''.</code>		* <code>Switch to a '''Linux OS'''.</code>
	** <code>There are very good working alternatives today, such as Mint or Zorin OS (very sleek and professional look).</code>		** <code>There are very good working alternatives today, such as Mint or Zorin OS (very sleek and professional look).</code>
Line 57:		Line 57:
	** <code>FOSS software has come a long way in the past few years, it works and looks great now. Trust me, I was a Linux noob 6 months ago, now I'm deploying my own scripts and automations on it.</code>		** <code>FOSS software has come a long way in the past few years, it works and looks great now. Trust me, I was a Linux noob 6 months ago, now I'm deploying my own scripts and automations on it.</code>

			*<code>'''TailsOS,''' now just '''Tails,''' is a Linux distribution for privacy purposes that you can get here: https://tails.net/. Its entire point is that you don't install it; it lives in a USB stick or other bootable media (USB sticks are just more convenient) which you plug into your computer, and never installs anything. TailsOS lives entirely in RAM, the Random Access Memory. Once you shut off the computer, anything you did on that computer disappears.</code>
			**<code>Tails is not meant for 'daily driving', i.e. using on your home computer on the daily, because it doesn't save anything. The entire point of Tails is you don't save anything in or out of it.</code>
			**<code>Definitely read their best practices and documentation for more information.</code>
			**<code>Tails is maintained by the Tor Project.</code>
			**<code>Tails works for journalists, activists, and abuse victims. If you are in an abusive situation, you can use Tails on a bootable media you hide (even a microSD card, if that's easier for you to hide), and do your research/contact authorities etc. from Tails, from your normal computer - even if other people have access to it, even if it's your daily driver computer, you can run Tails without nobody ever knowing about it.</code>
	* <code>Use '''different usernames''' everywhere. Or at least try to. Unique usernames for each service. Your password manager can remember them for you.</code>		* <code>Use '''different usernames''' everywhere. Or at least try to. Unique usernames for each service. Your password manager can remember them for you.</code>
	** <code>On social media, make new accounts periodically and delete the old ones. Don't use the same account for more than 6 months. You can have alt accounts: one for posting, one for browsing, for example. There are services that give you temporary email addresses you can use to register, or fake phone numbers to verify SMS codes. This is completely up to you, but it's an additional layer.</code>		** <code>On social media, make new accounts periodically and delete the old ones. Don't use the same account for more than 6 months. You can have alt accounts: one for posting, one for browsing, for example. There are services that give you temporary email addresses you can use to register, or fake phone numbers to verify SMS codes. This is completely up to you, but it's an additional layer.</code>
	** <code>Changing your usernames right now, if you can, is worth it. If you can't change them, either make new accounts or leave it be, up to you. What matters is future-proofing yourself more than anything, again planning ahead for when this will actually be useful.</code>		** <code>Changing your usernames right now, if you can, is worth it. If you can't change them, either make new accounts or leave it be, up to you. What matters is future-proofing yourself more than anything, again planning ahead for when this will actually be useful.</code>

	* <code>'''Phone''': switch to '''GrapheneOS'''. Not every phone is compatible, Graphene's website keeps a list. Google Pixels are currently the only possible choice because they use hardware that secures the phone itself, regardless of what its Operating System is.</code>		* <code>'''Phone''': switch to '''GrapheneOS'''. Not every phone is compatible, Graphene's website keeps a list. Google Pixels are currently the only possible choice because they use hardware that secures the phone itself, regardless of what its Operating System is.</code>
	** <code>Until you have GrapheneOS, get a '''privacy respecting keyboard'''. On Android, install F-droid store (only FOSS software) and install a keyboard from there. Yes, you can change your keyboards on Android. If you use the default one, it sends data back to its developing company.</code>		** <code>Until you have GrapheneOS, get a '''privacy respecting keyboard'''. On Android, install F-droid store (only FOSS software) and install a keyboard from there. Yes, you can change your keyboards on Android. If you use the default one, it sends data back to its developing company.</code>
	** <code>This is last in the list because Graphene currently only supports Pixel phones, meaning you'd likely have to get a new phone for it and they're not cheap.</code>		** <code>This is last in the list because Graphene currently only supports Pixel phones, meaning you'd likely have to get a new phone for it and they're not cheap.</code>

	Yes, this is not the shortest list. But here's the thing: you don't have to do everything ''right now''. Make a mullvad account today just to take a look, send the cash envelope next week. 3 months from now, when you have a long weekend off, install Linux. Switch to Librewolf part-time - you can absolutely install it alongside your current browser and just test it out.		Yes, this is not the shortest list. But here's the thing: you don't have to do everything ''right now''. Make a mullvad account today just to take a look, send the cash envelope next week. 3 months from now, when you have a long weekend off, install Linux. Switch to Librewolf part-time - you can absolutely install it alongside your current browser and just test it out.

← Older revision		Revision as of 13:30, 22 May 2026
Line 29:		Line 29:
	** <code>I use 4get.ca, a tiny no-name (and kind of edgy, unfortunately) search engine that serves as a proxy to DDG, Google, Yandex, Brave etc. There's other search engines, but I don't trust big names. Just personal.</code>		** <code>I use 4get.ca, a tiny no-name (and kind of edgy, unfortunately) search engine that serves as a proxy to DDG, Google, Yandex, Brave etc. There's other search engines, but I don't trust big names. Just personal.</code>

	* <code>Use '''Mullvad VPN'''. The only one that as a proven no-logs, ram-only policy. Nothing else comes close, don't even look anywhere else.</code>		* <code>Use '''Mullvad VPN'''. The only one that has a proven no-logs, ram-only policy. Nothing else comes close, don't even look anywhere else.</code>
	** <code>Use only ~~their own~~ servers, not ones they rent. There's a ~~toggle~~ in the app. Rented servers are not guaranteed to actually respect no-logs and ram-only policies.</code>		** <code>Use only Mullvad-owned servers, not ones they rent. There's a filter option in the app for it. Rented servers are not guaranteed to actually respect no-logs and ram-only policies.</code>
	** <code>'''VPN ALWAYS ON.'''</code>		** <code>'''VPN ALWAYS ON.'''</code>
	** <code>Pay by cash envelope, no more than ~100$/€/£ at a time. Don't leave fingerprints on the envelope.</code>		** <code>Pay by cash envelope, no more than ~100$/€/£ at a time. Don't leave fingerprints on the envelope.</code>
Line 37:		Line 37:
	** <code>Turn on all the stuff they have (dAIta, multihop, etc). Put it on your phone too.</code>		** <code>Turn on all the stuff they have (dAIta, multihop, etc). Put it on your phone too.</code>

	* <code>'''Email''' is just not secure. I don't know how else to ~~break~~ it ~~to you~~. Email was invented in the 70s before hacking was even illegal. They did not even think about security or privacy back then.</code>		* <code>'''Email''' is just not secure. I don't know how else to say it. Email was invented in the 70s before hacking was even illegal. They did not even think about security or privacy back then.</code>
	** <code>'''Proton''' is slightly ahead of the curve but '''will cooperate with police agencies''' and give them whatever they can. They fundraise for [[Freedom House]], a US government agency passing as an "NGO", and called it "nonprofit, nonpartisan organization"<ref>[https://proton.me/blog/2024-lifetime-account-charity-fundraiser Proton 2024 Fundraiser]</ref>... which is a lie. Personally, I don't trust ~~them~~. But that's just me.</code>		** <code>'''Proton''' is slightly ahead of the curve but '''will cooperate with police agencies''' and give them whatever they can. They fundraise for [[Freedom House]], a US government agency passing as an "NGO", and called it "nonprofit, nonpartisan organization"<ref>[https://proton.me/blog/2024-lifetime-account-charity-fundraiser Proton 2024 Fundraiser]</ref>... which is a lie. Personally, I don't trust proton. But that's just me.</code>
	** <code>'''Philosophy is: don't say it by email.''' Simple as. If you've already said stuff in emails you shouldn't have, delete them~~...~~ that's the best you can do. ~~Then~~, stop discussing sensitive stuff by email ~~from now on~~.</code>		** <code>'''Philosophy is: don't say it by email.''' Simple as. If you've already said stuff in emails you shouldn't have, delete them, that's the best you can do. Your recipient should also delete the emails. From now on, stop discussing sensitive stuff by email.</code>

	* <code>'''Chat platforms''': they all kinda suck. Telegram and Signal are ''not'' secure - Signal can be compelled by the US gov to give them data on you and you would never know it.<ref>If you're interested in more reading: https://dessalines.github.io/essays/why_not_signal.html</ref> This data can be enough to prosecute you. They ''will'' give it, they won't protect you. So don't assume you can say whatever on Signal and be safe.</code>		* <code>'''Chat platforms''': they all kinda suck. Telegram and Signal are ''not'' secure - Signal can be compelled by the US gov to give them data on you and you would never know it.<ref>If you're interested in more reading: https://dessalines.github.io/essays/why_not_signal.html</ref> This data can be enough to prosecute you. They ''will'' give it, they won't protect you. So don't assume you can say whatever on Signal and be safe.</code>
	** <code>'''Metadata is valuable too'''. This is unencrypted information such as who you talked to, when, for how long, etc. "Data about data". Metadata is enough to lead to investigations and convictions.</code>		** <code>'''Metadata is valuable too'''. This is unencrypted information such as who you talked to, when, for how long, etc. "Data about data". Metadata is enough to lead to investigations and convictions.</code>
	** <code>'''Matrix''' is the only one that's still safe-ish, but you have to trust the server owner. This is not a matrix guide, so I won't go into more details. Not many people use it. Otherwise: just be mindful of how you act on these platforms, that's it.</code>		** <code>'''Matrix''' is the only one that's still safe-ish (encryption and decentralized nature), but you have to trust the server owner. This is not a matrix guide, so I won't go into more details. Not many people use it.</code>
			** <code>Otherwise: just be mindful of how you act on these platforms, that's about the best you can do.</code>

	* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>		* <code>Set a '''diceware pass phrase''' for any master password. I will talk more about this after the list, because I feel it's the most important part to understand.</code>
Line 53:		Line 54:
	** <code>There are very good working alternatives today, such as Mint or Zorin OS (very sleek and professional look).</code>		** <code>There are very good working alternatives today, such as Mint or Zorin OS (very sleek and professional look).</code>
	** <code>Getting used to Linux is very easy nowadays. if you run into an issue, ask an LLM about it (preferably a Chinese one such as Deepseek or Kimi) and chances are you will find a fix.</code>		** <code>Getting used to Linux is very easy nowadays. if you run into an issue, ask an LLM about it (preferably a Chinese one such as Deepseek or Kimi) and chances are you will find a fix.</code>
	** <code>Set up ''timeshift'' and ''Pika backups'' on a spare drive so you can always roll back if you break something. Trust me, I was a Linux noob 6 months ago, now I'm deploying my own scripts and automations on it~~. FOSS has come a long way and works and looks great today~~.</code>		** <code>Set up ''timeshift'' and ''Pika backups'' on a spare drive so you can always roll back if you break something.</code>
			** <code>FOSS software has come a long way in the past few years, it works and looks great now. Trust me, I was a Linux noob 6 months ago, now I'm deploying my own scripts and automations on it.</code>

	* <code>Use '''different usernames''' everywhere. Or at least try to. Unique usernames for each service. Your password manager can remember them for you.</code>		* <code>Use '''different usernames''' everywhere. Or at least try to. Unique usernames for each service. Your password manager can remember them for you.</code>
Line 61:		Line 63:
	* <code>'''Phone''': switch to '''GrapheneOS'''. Not every phone is compatible, Graphene's website keeps a list. Google Pixels are currently the only possible choice because they use hardware that secures the phone itself, regardless of what its Operating System is.</code>		* <code>'''Phone''': switch to '''GrapheneOS'''. Not every phone is compatible, Graphene's website keeps a list. Google Pixels are currently the only possible choice because they use hardware that secures the phone itself, regardless of what its Operating System is.</code>
	** <code>Until you have GrapheneOS, get a '''privacy respecting keyboard'''. On Android, install F-droid store (only FOSS software) and install a keyboard from there. Yes, you can change your keyboards on Android. If you use the default one, it sends data back to its developing company.</code>		** <code>Until you have GrapheneOS, get a '''privacy respecting keyboard'''. On Android, install F-droid store (only FOSS software) and install a keyboard from there. Yes, you can change your keyboards on Android. If you use the default one, it sends data back to its developing company.</code>
	** <code> This is last in the list because Graphene currently only supports Pixel phones, meaning you'd likely have to get a new ~~one,~~ and they're not cheap.</code>		** <code>This is last in the list because Graphene currently only supports Pixel phones, meaning you'd likely have to get a new phone for it and they're not cheap.</code>

	Yes, this is not the shortest list. But here's the thing: you don't have to do everything ''right now''. Make a mullvad account today just to take a look, send the cash envelope next week. 3 months from now, when you have a long weekend off, install Linux. Switch to Librewolf part-time - you can absolutely install it alongside your current browser, and just test it out.		Yes, this is not the shortest list. But here's the thing: you don't have to do everything ''right now''. Make a mullvad account today just to take a look, send the cash envelope next week. 3 months from now, when you have a long weekend off, install Linux. Switch to Librewolf part-time - you can absolutely install it alongside your current browser and just test it out.

	Do it little by little as your cognitive load permits. Start exploring. Ask AI (Kimi for security/privacy questions tbh) how to go about it, or if you're curious about a part of it. Send it the essay and tell it to make you a guide.		Do it little by little as your cognitive load permits. Start exploring. Ask AI (Kimi for security/privacy questions tbh) how to go about it, or if you're curious about a part of it. Send it the essay and tell it to make you a guide.
Line 72:		Line 74:

	==== Diceware pass phrases ====		==== Diceware pass phrases ====
	You can skip this.		You can skip this section''', but the tl;dr is:''' current best recommendations for your passwords is switch to a pass phrase you remember that lives only in your head. Do not ever write it down, if you do, pen-and-paper only and burn it afterwards. Only use for most sensitive personal stuff (encrypted drives and encrypted password manager database): do not enter it at a work computer. Your job won't protect you. Do not enter it on websites.

	'''tl;dr:''' current best recommendations is switch to a pass phrase you remember that lives only in your head. Do not ever write it down, if you do, pen-and-paper only and burn it afterwards. Only use for most sensitive personal stuff (encrypted drives and encrypted password manager database): do not enter it at a work computer. Your job won't protect you.

	But I need to talk a bit about passwords and best practices, because I feel this is the most important part of this guide. Diceware is a method of password generation. On Linux, you just install it with 'sudo apt install diceware' and use it from the terminal. On Windows, I am not sure. I would avoid any web page for generating a password though - it's convenient, but you don't know where it's stored or what they do with it. If your password can be read in clear text 6 months from now because it was in your browser's cache files, there is no point in having a secure password. Everything is just easier on Linux.		But I need to talk a bit about passwords and best practices, because I feel this is the most important part of this guide. Diceware is a method of password generation. On Linux, you just install it with 'sudo apt install diceware' and use it from the terminal. On Windows, I am not sure. I would avoid any web page for generating a password though - it's convenient, but you don't know where it's stored or what they do with it. If your password can be read in clear text 6 months from now because it was in your browser's cache files, there is no point in having a secure password. Everything is just easier on Linux.
Line 125:		Line 125:
	"But I have to trust China then". Yes. Welcome to the Chinese Century - it's great. What do you care if china knows something about you? The only country liable to bomb you and disappear you into a waterboarding black site is the United States of America, and they control most digital avenues until China overtakes them. Trust China, discard USA.		"But I have to trust China then". Yes. Welcome to the Chinese Century - it's great. What do you care if china knows something about you? The only country liable to bomb you and disappear you into a waterboarding black site is the United States of America, and they control most digital avenues until China overtakes them. Trust China, discard USA.

	I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?		Hardware is not inherently safe either. A paper made the rounds recently when it showed that you could be tracked accurately through walls by your own wifi signal. Your body distorts the wifi waves, which shows on camera as a clear, accurate shape.<ref>https://www.popularmechanics.com/technology/security/a42575068/scientists-use-wifi-to-see-through-walls/</ref>

			Technically, if police can seize a server/computer quickly enough and freeze the components with liquid nitrogen, they can freeze the RAM cells in place, allowing them to transport it even without electricity to the station, and extract the contents of your RAM sticks there.<ref>https://www.securitum.com/memory_heist_the_secrets_and_risks_of_cold_boot_attacks.html</ref>

			These two methods have yet to be used in real, uncontrolled conditions ('''as far as I'm aware'''), but they are very real and new vectors of attack, so who knows what they'll come up with next.

			To finish up, I also have to rant a little about '''privacy'''... it's often just a buzzword that gives you a false sense of security (hence the philosophy: never assume you are fully safe, limit what you share). "Privacy-focused" apps for example are plenty, but what exactly is privacy to their devs? How do they define it and help your privacy?

	To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.		To me, privacy means there is '''no tracking whatsoever''' and '''as much as possible is encrypted'''. That's the strict minimum. If it needs to do tracking, it stays on your machine and never, ever leaves it (local-first). Linux for example has good privacy out of the box: it does not track anything about you, not even that you are a Linux user, unless you opt-in. Even something as innocuous as "does this machine use Linux? Yes/no" being sent back to servers not privacy-respecting, in my opinion. Steam for example collects information about your hardware... is this dangerous if you're an activist? Maybe, maybe not (could be used to know your hardware and deploy a trojan against you specifically, who knows). But it's not private.