Privacy Guide

Hello Lainons! This thread is the ultimate privacy guide of 2024! If you can, and I highly advise it, share information for opsec and infosec. Online Guides, "self-made guides" (your experience on that topic i.e), questions, books and even more! Hardnening guides are also welcome and well seen! For instance: >What Linux Distro should I use and how to harden it? etc.

>>24269 I'll start with the obvious: >Encrypt your disk keeps your data private in case of theft or seizure; i use dm-crypt (luks2) >Take regular backups keeps your data available in case of disk failures or ransomware; i use rsync -> usb sticks >Set up UEFI secure boot makes it harder for rootkits to persist; i use an unified kernel image and sbsign >Set up verified boot makes it harder for malware to persist; i want to use dm-verity, but haven't gotten around to set it up yet >Set up a DNS blacklist mostly to block ads and trackers, but also have some niche cases for mitigating c2; just modify /etc/hosts >Set up a firewall makes it harder for spyware and malware to phone home; i use nftables >Set up an intrustion detection & prevention system pretty self explanatort... detects and prevents intrusions; i use snort and audit >Set up a Mandatory Access Control system makes it harder for software to access parts of the system they shouldn't; i use apparmor on desktops and selinux on servers >Sandbox your apps for the same reason you'd use a MAC; i use bubblewrap w/ seccomp-bpf filters >Replace DNS with DoT+DNSSEC dns is not encrypted or spoof-proof; DoT is DNS over TLS. DNSSEC prevents DNS spoofing; i use dnscrypt-proxy; i use unbound and also block outgoing udp/53 just in case >Replace NTP with NTS ntp suffers from the same problems as DNS... NTS is NTP over TLS; i use chrony and also block outgoing udp/123 just in case >Replace HTTP with HTTPS i use firefox/tor browser; they have built-in https-only mode, but i also block outgoing tcp/80 just in case >Use Tor >Use I2P pretty self explanatory... hides your destination from your government and isp, and hides your ip address from your destination >Use a password manager use strong passwords, and never use the same password twice! i use keepassxc to manage my credentials

>This thread is the ultimate privacy guide of 2024! my threat model is my parents, so screenlocker is all i need, /thread >distro windows 11 >disk encryption bruh. a lot of hassle. it's nice to maybe somehow combine pam and gocryptfs to encrypt your clipboard and some important files, but encrypting the full disk is likely just free headache and wasted time entering the passphrase. swap encryption might be useful though, since it's zero effort. >backup nothing to do with privacy >Set up UEFI secure boot free headache. if your machine has been stolen it is anything but safe to assume the thieves don't know how to work around that. otherwise why care? >Set up a DNS blacklist need to elaborate >Set up a firewall mostly autistic headache >Set up an intrustion detection & prevention system likely free headache, need to elaborate why care >Set up a Mandatory Access Control system free headache, total PITA to configure, doesn't address real security issues, see madaidan security guides >Sandbox your apps free headache, probably only worth it against closed sources applications and for convenience, for example i used firejail to run several claws instances at a time >Replace DNS with DoT+DNSSEC honestly nobody cares. tls handshake will still leak everything they need to know >Replace NTP with NTS nobody cares, doesn't address any issues >Replace HTTP with HTTPS nobody cares. https is only worth it for exchanging secret info. see tohno chan /navi/ board for a discussion on this topic. >Tor I2P only useful in rare cases, unless you break laws >Use a password manager and accidentally loose the database. all this hassle around passwords is nonsense. people still use their birthday dates as pin codes and literally nobody cares to hack them

I've found the best route to privacy is to minimize computer use. I have an older laptop I use for work that has never been connected to the internet. Everything comes in and out via USB. Anything that doesn't need to be done on the computer is done the the old fashioned way. I have a small shredder and incinerator for my trash and I only buy books from used stores with cash. I have a second machine I use to access the internet at public cafes or libraries only connect via Whonix. I have a third machine which runs Windows and I spend an hour on there everyday doing normal person activities like upvoting random Reddit posts, clicking on the top trending YouTube and PornHub videos, listening to trendy soykaf on Soundcloud etc. then I leave the thing on my desk as a paperweight. For real world stuff (emails) I just use the library computers. The other two machines go under the floorboards in a sealed bag. I probably need a better hiding spot/camouflage for them. I'm thinking of buying one of these thick law books that will fit a 12 inch laptop and cut a space inside it. I have no idea how to secure the machine I use for internet access. I guess I need to throw Linux on there and encrypt the drive but beyond using Tor I have zero knowledge of security.

>>24274 >threat model: parents >windows 11 you're probably too young to be here, and from the rest of your post, too stupid too

>>24269 Lainon, this is a very fun question. Choosing a Linux distro to make it secure is like chosing a car to convert it to an apaocalypse vehicle. Most vehicles should require relatively the same effort, while some others might be worse. I'd recommend that you either pickup [ParrotOS Home Edition] or [Qubes OS] Linux distros respectively. This should not be your permanent solution, but rather, I encourage you to interact, configure, and explore these distros to understand what makes them secure. From there, with the knowledge you would have gathered, you should then grab a standard base distro that you prefer like [Debian] or [Arch] and configure its security to your liking. That is obviously my personal opinion, and I would recommend you take into account anyone else's input as well. Regarding hardening your host machine, depending on your operating system, you should look into network monitoring tools like [PortMaster] or [Little Snitch]. This would allow you to configure a zero-trust network on your device to increase network security. Furthermore, look into OSINT terminal tools such as [vt-cli] so that you are checking any of the file hashes present on your system (and confidently ensuring they are not malware). Hardening your physical network will cost more and require more enterprise appliance knowledge. Obviously if you can afford a [firewall] or if you can look into a [router] and [firewall] combo appliance that would help greatly in configuring a zero-trust configuration for all devices in your home office. Make sure you also are configuring DNS over TLS to encrypt all of your DNS traffic from your router. I believe this is just as important as having a VPN tunnel established from your device or home office as it will make it harder for outside actors to review / monitor your DNS activity. There are a lot more suggestions that I could provide, but I believe the suggestions from other Lainons will be just as beneficial, if not, necessary. Best of luck! - mrb466y3y35

>>24374 I second what this guy said about trying to move to a distro like debian or arch to some extent. Most linux distros are basically just debain or arch with a specific desktop environment and a whole lot of soykaf you probably wont use which just leads to an increased attack surface. Keeping things light and limited to only what you actually use is incredibly important. More packages = more potential vulnerabilities. Furthermore moving away from systemd is a good idea, and possibly linux as a whole depending on what you need and prefer. I highly recommend looking into openbsd, whether or not you actually plan to use it. The devs are autisticly focused on security and many of the things they implement into openbsd can copied on your own system.

If Linux became unusable I'd go straight to OpenBSD, no hesitation. Theo can be an asshole, but he's a very, very smart and competent asshole.

Kernel self compilation seems to be pretty important, given the sheer size of generic kernels. Self compiling also allows you to compile with clang and use hardened flags. You can use modprobed-db to determine what modules you need. I'm interested in learning how to further debloat the kernel, other than simply not compiling unnecessary modules. Any tips?

>>24609 You could look at some very, very old kernels like in early Slackware. But don't expect to get much (if any) functionality on modern hardware. I remember carrying around two 3.5" floppies with a minimal but bootable Vector Linux on them. One had the boot stuff and the kernel, which loaded into RAM, The other had cli diagnostics and probing utilities and whatnot. Those were the days.

>>24269 who else came here looking for tips about smartphones or service "agreements"

>>24629 inspiring list >linux cgroups, namespaces, lxc, oci, virtualization? >bsd jails?

As a security and privacy paranoiac, here's my setup: >Before anything else, it's probably a good idea to get a tamper-evident laptop (or make your current one tamper-evident) - it won't *prevent* physical attacks, but it'll help discover them when they happen. Take pictures of the patterns on your screws and whatnot, compare those once in a while. >Install Artix Linux (Gentoo is fine as an alternative) with full disc encryption. I use OpenRC as my init system. I won't mention this any more, but all passphrases (incl. storage encryption, password manager, etc.) should be 60+ characters long and not stored anywhere else. If you want, you can use FSF-approved distributions, but I don't care much for them. >Make encrypted backups every week or so. If you *really* want to go all in on this, store the drive in a tamper-evident container - a box of coloured marbles will work. Take images of the box after every backup to know when it's been tampered with. >Use minimal software when possible (e.g. dwm, st, nsxiv, etc.) - I can read the source code of most of my installed programs in a few hours. >(Never use proprietary/closed-source software - ought to be obvious given the other steps.) >Use hardened Firefox (Arkenfox user.js + uBlock Origin) or Tor Browser. I use the former as a backup for when the latter breaks, which actually happens sometimes. >Set up a firewall. >Route all system traffic through Tor. Use bridges. >Randomise your MAC address for every connection. >If possible, never use proprietary services - I personally don't have any such accounts. If you ever need to access YouTube, Reddit, etc., use alternative frontends. >Download Kiwix along with archives for the websites that you use most often. Allows you to search things offline in a lot of cases. I personally use it for several wiki websites. >Use SearXNG for online search. >Use Disroot, RiseUp, or cock.li for e-mail. >Use a password manager for all accounts - I recommend KeepassXC and pass. When possible, use randomly generated 64+ character passwords consisting of alphanumeric characters and symbols. Obviously enough, only generate them offline. >Use I2P or a decent VPN (e.g. Mullvad) for torrenting. >Use virtual machines when necessary. Additional notes: >Always use E2EE encryption for communication. For e-mail messages, use PGP. Quantum-resistant encryption is preferable. >Remember that your data is only truly safe when it's offline. >Use common sense. You could complete all of these steps and still voluntarily run a random script from a stranger afterwards. That's what I could think of on the spot. Pretty hardcore, but I can still use my system very comfortably while following all of these.

Here's my contribution: using Feather Wallet in an offline qube in QubesOS. Monero wallet guide: https://karapara.kyun.li/wiki/feather-wallet/feather_wallet_isolated_qubes_whonix_setup_en/ tor: http://karaparawplotu233ux7adtiaqswdthdk6kiqqovgy4ldp2dseijwnad.onion/wiki/feather-wallet/feather_wallet_isolated_qubes_whonix_setup_en/

I have in mind writing my own script or code snippet to generate automatically strong and encrypted passwords rather than using existing software like KeePassXC. Mainly I want something that generates decently encrypted and random passphrases, and using some external device to allow and unlock the passwords, maybe something like a PGP smartcard connected to a external e-card reader. What do you guys think about it? Worth it or a waste of time? Excessively schizo with no practical benefits? Suggestions and personal fixes? Of course if it works properly I mind sharing that tool on git repositories.

>>24649 You can reduce your attack surface even more by simply limiting yourself to the TTY. dvtm as multiplexer, instead of dwm abduco for session management links/lynx as browser, instead of Firefox/TBB vi(m) for coding/editing IRC for communications (SSL when possible, SASL authentication with NickServ, no DCC)

Use TailsOS and dont forget to donate as they need all the help they can get

I recommend not generating passphrases on any electronic device whatsoever. Instead: Buy a paperback dictionary. Open it randomly and blindly stick your finger on the page. Write down the word under your finger on a piece of toilet paper. Repeat about 6 or 7 times. Use those words combined as your passphrase. Keep the piece of toilet paper folded up in your pocket. If a battering ram comes through the front door, flush it down the toilet. If there's no toilet, eat it. Anything you store like this, completely off of any elevtronic device, and not accessible via the internet, has a massive, complex attack vector completely removed. You still need to use good opsec to keep it safe, though. Alternativly, keep it on an encrypted usbstick on your keychain, It's still off your computer. If you get mugged or shot, your stored passphrase is still safe. But it's harder to flush down the toilet, and you have to plug it into your (probably) internet connected computer to use it. ALso oreferable if your girlfriend likes to go through your peckets.

>>25286 Kys. But expanding the idea of true randomness, you can drive far away from cities and use radio antenna. On an entirely clear day note all signals you receive and filter them out to get your signal as close to zero as possible. You want to use active filters for this, so you don't just filter out frequencies, but specific waveforms coming from those ranges. Then wait for a thunderstorm and records oscillogram. Use it as a seed for RNG. Profit. It's not gonna be simple though. Also, any random natural phenomenon can be used, theoretically.

>>25288 Are you serious or just really, really stupid? You'd have to be a complete moron to go through all of that laughable idiocy when you could just get a geiger counter and a geiger counter test card. The clicks from radioactive decay are completely unpredictable and can be used to generate truly random numbers. Asshole.

>>25289 Radiation is controlled by CIA. It's noise patterns can be predicted and cracked. But nobody to my knowledge can control weather. Not yet, at least. You simply don't know your enemy

Oh, I see. You're trying to troll, but you can't even do that right. Sad.

>>25284 Weird the 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2 address is not listed when javascript is enabled but when you disable javascript (safest) it is listed on:https://tails.net/donate/index.en.html This is really strange why are they hiding that address?

>>25291 Using lightning for RNG is an applicable approach though.

>>25293 Why not use HAM radio frequencies for RNG

>>25294 Uncool. Not true RNG either. Remember, everything glows. Everything. No exception.

>>25297 What about tails os does it glow I never here any lainanons here say they use it

>>25292 might be some subtle fingerprinting on JS vs Non JS users