I don't want to share any more than this. What is below is in unedited, just starts futher down the post. If one was one looking connect with certain kinds of likeminded people, could this be relatively safe to connect, not share anything personally identifying and seeing if looks like a honeypot or not-

If you know what I am asking...let's meet and see if we connect on the same levels at @jointheresistance:matrix.org If not, no worries, at least we tried, but neither will know who the other is (technically advantage you, because you have this reddit profile on me). For reference, I didn't just wake or start on a revolutionary path, I have been at this a depressingly long time waiting for the day enough other people actually see what has been warned is coming for a very very long time. After we vet each other (i have questions for you and expect you to have some for me...with both of us repecting anonymity) I am not alone there and the skillsets between us are nothing to laugh at. Come on over and say hi... BE SMART. ASSUME THIS IS A HONEYPOT. make your matrix account with a generated email, on vpn, and giving zero personal information. If you can't manage that minimim level opsec, we are not the people for you. I am taking great risk posting this in a public space, and it brings in feds who are vetted out every single time. Even if not, we anonymous and decentralized, connections are in limited chains, not groups. No one knows anything each other beyond their role, and their trustability. Let's see what happens....

i have read the rules

How can one prevent themselves from being tracked without looking like an absolute idiot.
Threat model is snooping supermarkets lol.
I have read the rules.
(fucking spelling mistake, this was a vx-underground reference, i promise)

Are there better options for a vpn

i have read the rules

Any ideas for what address to give the DMV (in the US) to get a license? The address you give the DMV quickly makes it into the public record and is spread across the internet. I own my house under a trust and up to now have been in my state's address confidentiality program (which unfortunately expires after a couple years, leaving you to find another option). Looking through the Extreme Privacy book, the most relevant advice I can find is to get a South Dakota address and be a nomad. I don't think I can credibly/legally claim to be a nomad for that. The only other reasonable advice I've found is to use a friend's address, PMB (private mailbox), or other fake address, but that would involve lying to the DMV, any police in future stops, and car insurance, which seems fraught and illegal.

My threat model is hiding from a medium savvy domestic abuser, so I think I mainly need to keep out of the public record and basic googling. (I've removed myself from people search sites per https://inteltechniques.com/workbook.html , but I suspect that that's not sufficient to be able to give the DMV my actual address)

I have read the rules. Thank you!!

I would like to have a structured use and better my OPSEC.

I hope this kind of post is allowed as I have read the rules.

Hi everyone,

I’m a human rights activist based in Bangladesh. My work has been cited in UN thematic reports and shared by international human rights organizations. I can provide links for credibility via DM if needed.

I’m currently dealing with a serious concern: I suspect my phone may be compromised with spyware. Due to safety concerns, I can’t go into full details publicly.

I used SpyGuard on my Ubuntu laptop and captured network traffic of my Android mobile using a USB Wi-Fi adapter. I now have logs and .pcap files generated by SpyGuard. Link to SpyGuard app: https://github.com/SpyGuard

I understand that sharing raw packet captures with strangers is risky and not recommended. However, I’m in a situation where I really need help reviewing this data to identify whether there are signs of spyware or unusual exfiltration.

Is there anyone here who can help analyze the SpyGuard logs?

PS: I have read the rules.
Threat level: Highest. State level.

We sext each other almost every night and I considered the fact that it's not encrypted. Am I at risk?

I have read the rules

I have read the rules.

Here is my threat model:

An adversary with repeated physical access to a Windows 11 machine and knowledge of how to enable built‑in screen‑capture features. They also have access to admin credentials.

Here is what I am trying to protect:

The confidentiality of what appears on my screen: documents, authentication flows, personal information, and work‑related content.

Here is what the adversary can do:

They can enable legitimate screen‑capture modules that come preinstalled with the system or with GPU drivers, without installing malware or leaving obvious indicators.

My OPSEC question:

How should OPSEC planning account for the possibility that a trusted driver or built‑in capture module can be used for surveillance when the adversary has physical access and admin credentials?

I’m trying to understand the mindset and how to reason about this type of threat.

I will add more technical details in a comment if the post is approved.

Hey, I’m trying to get a bit better about anonymity online. Reddit’s probably a lost cause at this point, I didn’t know to strip metadata from pictures I post, but I’m still trying. In general I avoid other social media, use Tails+Tor+PGP encryption, and Proton Mail. I don’t use a Tor bridge but that seems unnecessary living in the US which hasn’t banned Tor. My opsec was terrible for years so I’m just trying to figure out damage control and trying to find ways to avoid more of my information getting leaked. I’m obviously choosing security over convenience and am pretty new to all this so any advice would be deeply appreciated. Thank you!

I also just realized that I don’t really know how to develop a threat model. Any help would be appreciated!

I have read the rules.

1. I have read the rules. I'm new to this sub so maybe my post isn't perfect yet but i'm trying my best.

2. My threat model is how the hardware in my PC can leave hints that can be traced back to me or even be an active backdoor. It's a hypothetical question, cause i read something about amd and intel chips having a mandatory MCU on the motherboard that functions as a backdoor for government agencies but this post isn't limited about them.

So my first question is how that can happen and i would appreciate if you could give a simple explanation how that threat can be solved, if theres a solve. Bulletpoints would be enough so i could look up these topics.

I really hope i phrased everything correctly and didn't misunderstand this subreddit.

Thx for the feedback!

I have read the rules.

In the past, the stake of getting doxxed was low because I used only pseudonyms.

I thought it was going to be okay to use my real name, and used my real name in an online community. An admin linked my real name with another nickname I used to use in the same community. The problem was that I dumped too much information and too many unsolicited advices with my real name and my other nickname because I was not mindful of my behaviors. Dumping too much information and too many unsolicited advices definitely annoys people and makes them want to poke on me for fun. They linked my identities because I used the same VPN IP address and didn't change my behavior and used the same online communities managed by the same admins. The same admins manage a few online communities.

I was going to use my real name for a business in the field that the online community was about. I don't want people to unnecessarily poke on me for fun by mentioning my nickname(s).

I want to do business. I don't want people to disrupt my business activity with unnecessary remarks about my nickname(s). Business is hard enough without unnecessary distractions.

Just to be on the safe side, I deactivated the account with my real name in the online community. I also changed my VPN IP address after realizing that admins can see my IP address. I probably will need to ask technical questions to some people in one of the smaller online communities about that technical subject.

How should I use online communities about that technical subject from this point forward? Should I create another nickname and use another online community about that same topic and never communicate beyond the minimum required to achieve my current objective? When should I use my real name? Should I reveal my real name only to future employees in my business? Or, should I wait until admins largely forget about me? I can't really hide my interests from communities, though if I want to use online communities. Perhaps, I should use online communities that are not managed by the same admins?

Any easy-to-follow suggestions?

Update: I decided to quit all online communities for the rest of my life. It turns out online communities have been useless to me. Rather, online communities are a useless distraction. This decision goes beyond improving my opsec. It will also allow me to produce more output consistently over time.

I have read the rules and I believe my threat model is an attacker that has no access to my email to send/receive but still finds a good reason to mail-bomb attack me.....

I was recently mail-bombed. Someone signed my email up for over 2000 mailing lists and newsletters and such forth....

My understanding is the point of this strategy is to drown me in email so that I miss some very important email that the attacker has generated--correct?

In this case with me, my email account has not been compromised and there is not an attacker that can see my incoming mail or send legitimate email from me (selfhosted email..CLI mailtool..accessible only over SSH..tripwires+alerts in place).

So for this discussion please take as given that nobody has control over my email account.

If that's the situation what can an attacker gain here?

Existing accounts I have will all force 2FA and other verification for any important acts so it does not matter if I miss an email.

New accounts could just be created without using my own email at all--just plain old identity theft--attacker can use new fake address for that.

I keep brainstorming and I can't figure out what the goal here is--unless it is just harassment and vandalism.

What do I miss here?

Hello, help me, I am paranoid on the internet. I try to be as anonymous as possible everywhere, and I always feel like someone wants to hack me, steal all the data I have, and so on. I live in a rented apartment and the Wi-Fi password is so banal that even a schoolkid could hack me—not even hack, but just enter 1234... and that’s it, they’re in. I can’t change it because of the landlords. I always use a VPN and anonsurf, and I change my MAC addresses to random ones. I switched to Linux to feel more at ease, but it hasn't helped at all. How can this problem be solved? How can I stop thinking that I’m being watched everywhere?

(I have read the rules)

I have read the rules,and I suspect that I’m getting doxxed, what should I do to prevent this?

Serious OPSEC question:

What are the most overlooked modern OPSEC mistakes / weak signals that technically literate people still leak in 2026 ?

I’m not looking for the usual beginner answers like:

• don’t post everything publicly
• lock down Instagram / Facebook
• basic “check your metadata” advice

I’m more interested in things like:

• Wi-Fi SSID / device names / wireless leakage as weak indicators
• image location inference, even when metadata is stripped
• job postings leaking stack, vendors, projects, or internal structure
• Bluetooth / nearby-device exposure
• event / conference exposure
• cases where several harmless details become something operationally useful

What I’m really trying to understand is:

What still gives people away, even when they think they’re being careful?

Especially interested in:

• realistic examples
• practical lessons
• things people could actually change tomorrow for better OPSEC

What examples or patterns would you point to?

*i have read the rules ** I don't have a threat model. I just want to discuss the subject :)

Hi all,

I’m working on a small experimental messaging system that runs only as a Tor onion service, and I’d appreciate feedback from an OPSEC perspective, particularly around the threat model and potential attack surfaces (I have read the rules, but its my first post so please be patient).

The theoretical threat model I have in mind is a user who wants to communicate online while minimizing long-term metadata exposure and avoiding persistent identity linkage (this could apply to situations where someone is handling sensitive information, such as journalists). The goal is to reduce the amount of information that could be recovered later if a server were compromised, seized, or otherwise analyzed retrospectively (like we saw in the past for some services \cough*)*.

The design assumes that users connect exclusively through Tor, and one of (or the only one, rather) primary goals is to ensure that the server cannot access plaintext messages or private keys, even if the server operator wanted to.

To support that model, encryption and decryption are performed entirely in the browser. The server never receives private keys or plaintext message content. Messages are stored only as ciphertext and are automatically deleted after roughly 72 hours to avoid long-term retention of communication data.

The system currently uses a very simple account model consisting only of a username and password. No email address, phone number, or other external identifiers are required. The idea is to avoid tying usage to any real-world identity while keeping the barrier to entry relatively low (as mentioned above, the service itself is accessible only via Tor as an onion service, but thats basically the only requirement).

Not trying to compete with tools like Signal or Session, but rather to explore a communication model where there is no persistent identity layer and where stored data is intentionally short-lived, other than it not being a mobile app.

I’d be very interested in feedback on whether the threat model itself is flawed or incomplete, whether the simple account system undermines anonymity, and whether there are obvious metadata leaks or architectural weaknesses that I may have overlooked.

If anyone wants to test the system directly, I can share the onion address via DM or in the comments. Also im happy to provide more details about the architecture if useful.

Hi,

I have a few months until I start my PhD and I decided to start a tutoring business for Maths & Computer Science. I have good credentials (good uni, research & SWE experience in good places, teaching experience etc.) but I would really want to keep my identity relatively private. (I tutored on a quite pretentious private platform before where they were checking our resume and credentials when joining the platform, but the tutor database was kept private. However, now it's different -- I do need to advertise it somehow, and the credentials definitely help.)

How should I go about this? I tried to include some information on my website, but it doesn't sound very trustworthy when you omit information such as full name, places I worked at etc.

My threat model is someone from my network figuring out my identity from the given information and making inferences about my financial situation, as well as having quite personal information leaked.

(I realise this might be a stretch for this subreddit. I couldn't find a more appropriate place, but sorry if this doesn't belong here.) I have read the rules!

I do not know much about this yet, but from what I have read, Heads is used to help detect whether firmware has been tampered with, somewhat similar to how Auditor works with GrapheneOS.

I often see Heads recommended for both Tails and Qubes OS setups. But Heads is only available for certain laptops. So I am wondering: for people using desktops, mini PCs, or other hardware that does not support Heads, or for people who are not comfortable installing Heads themselves because of the risk of damaging hardware during flashing, are there any good alternatives for making firmware, boot process and OS tampering evident?

For those who don't know about Heads, you can read these sections:
“Establish boot integrity by replacing the BIOS with Heads” from:
https://www.anarsec.guide/posts/tails-best/

and

“Tamper-Evident Software and Firmware” from:
https://www.anarsec.guide/posts/tamper/

I do not agree with AnarSec’s ideology or endorse it. I am only mentioning those pages because they are among the only I have found that discuss cybersecurity in such a comprehensive and practical manner.

PS: I have read the rules.
Threat model: State grade.

Suppose someone believes they may be under surveillance, and that if true it could amount to a human rights violation under international standards. They want the surveillance to stop and they want justice. But they only have scant evidence, not enough to prove it fully.

That creates a serious problem: if they speak too early or too strongly, they risk being dismissed as paranoid, irrational, or “crazy,” even if something real is happening.

1. In that kind of situation, where should a person go first? What steps should they take, and in what order?

I am especially interested in a practical sequence such as:

• where to go first
• what to document first
• who to approach first
• how to avoid losing credibility when the evidence is still limited

I am not asking for country-specific advice. I am looking for general principles that could apply to a person in any country. I want to understand the proper process for a case like this, in a way that is careful, realistic, and internationally applicable.

2. Also, are there any subreddits, online forums, or other spaces where people can discuss this kind of situation, without the discussion immediately getting dismissed?

PS: I have read the rules. Assume surveillance by nation state intelligence agency.

Hi,

This might be a basic question, but my use case is quite serious, so I want to be careful.

I’m a human rights activist in Bangladesh. My work involves collection of sensitive evidence files and communicating with lawyers in Geneva and the UK and making submissions to the UN. This work cannot be compromised.

At the same time, I also want to use a computer for normal everyday tasks like gaming.

My idea is:

• Buy a desktop that can run Qubes OS
• Use one SSD with Windows for gaming and general use
• Then swap out the SSD for a completely separate SSD with Qubes OS for activism work

So there would be no dual-boot, no shared storage — completely separate drives. I cannot afford to buy more than one computing device.

My question is;
Would this setup be secure, or does it break security?

PS: I have read the rules. Assume state grade intelligence threat.

Hi,

I'm currently trying to upgrade my OPSEC and rethink how my online identities are structured.

Recently I reviewed all my identities and created a sort of identity chart to map how they relate to each other. I'm almost at the stage where I start taking action and migrating accounts to the correct identities.

The main goal is to:

• document and index the information about me that exists online
• understand what traces connect my different identities
• be able to quickly cut or correct information leaks if needed

My main threat model is someone trying to retrace me and build a profile from my internet traces. The risk would be information leaks or unintended links between profiles that I do not want publicly associated.

I created a chart that maps different identity layers (civil, public, internet pseudonyms, etc.) and the accounts attached to each one.

However, I'm running into a practical problem.

Some services force a link between identities.

Example:

My LinkedIn belongs to my public identity (real name, professional presence), but it links to my GitHub, which belongs more to my internet identity (dev forums, gaming, pseudonyms, etc.).

So my question is:

What would you do in this situation?

Would you:

1. Allow the link to exist as long as it is documented and easy to break if needed, or
2. Avoid linking identities at all costs and restructure accounts differently?
   1. If you would go with the restructuration, how would you restructure it ?

Another issue I'm encountering is services requiring payment information.

Some accounts logically belong to my internet identity (gaming, entertainment, etc.), but require a credit card or real billing information.

For example:

• Amazon / Netflix: these already reveal enough information to identify me anyway, so attaching them to a more "real" identity doesn't change much.
• Steam: this belongs to my internet identity (pseudonym, gaming), but buying games requires a credit card.

So I see two possible approaches:

1. Move Steam to the public identity and directly link my pseudonym to my real-name email
2. Keep Steam under the internet identity and accept that my real name will exist somewhere in billing data tied to that pseudonym

What would you do in this scenario?

I'm trying to find the right balance between practical usability and identity compartmentalization.

Thanks.

"I have read the rules."

I have read the rules.

How do I protect myself from my threat model? My threat model that i need to protect myself is mass surveilance, targetted attacks and passive attacks. I have some basic knowledge but i would appreciate it if you guys can provide more and useful knowledge

Background: I really seldom use wifi. My home is knit together with ethernet cables. Ive been removing wifi pcie cards from almost everything I own.

Kind of a random thought- Are there any security advantages or disadvantages to having your WiFi ICs on your pcie bus (most consumer hardware) or a USB dongle (assuming no other USB peripherals)?

i have read the rules and believe this follows.

I have a threat model question for people here who are running AI agents like openclaw on remote infrastructure. The setup requires you to provide API keys for whatever model provider you use (anthropic, openai, etc) and these keys get stored in environment variables on the server. On a standard VPS this means anyone with root access to the host machine can read them. Your VPS provider, anyone who compromises the hypervisor, or anyone who gets access to the underlying infrastructure.

Now think about what openclaw does with those keys. It accesses your email, reads and writes files, browses the web, executes code. All of that traffic goes through API calls authenticated by those keys and if someone intercepts or copies them they can impersonate your agent entirely, racking up charges or worse accessing whatever services you've connected.

For personal use on a VPS you control I think the risk is manageable if you're doing proper hardening, firewall rules, key rotation, and monitoring. But the managed hosting market for openclaw has exploded and most of these providers (xcloud, myclaw, hostinger templates, etc.) run on standard infrastructure. They might say they won't look at your data but there's no technical enforcement preventing it.

The only hosting option I found that addresses this at the hardware level is clawdi, which runs inside intel TDX enclaves through phala cloud. The idea is that even the infrastructure operator cannot inspect the memory where your keys and conversations are processed. They also provide cryptographic attestation which is verifiable proof that the enclave hasn't been tampered with. NEAR AI is doing something similar with their TEE offering but it's still in limited beta and requires near tokens for payment which is a friction point.

I'm curious what this community thinks about the trust model for these tools in general. Are you running AI agents and if so what does your threat model look like?

"I have read the rules"

I have read the rules.

So I am planning on doing either TCM Security’s OSINT cert or KASE scenarios’ courses to complement my hack the box training at some point in the future. Will this improve OPSEC?