Hello im begginer in opsec and wondering whats my best alternative for a private phone instead of graphene since google pixel draws attention to some places. Ty in advance i have read the rules.

I need to print some literature to distribute but I don't want it to be traced back to me. What is the best way to print without leaving a trace for the gov or angry people? I haven't yet bought a printer. I don't need an entirely secure system, just to where it would be quite hard to track me down.

(i have read the rules)

Hi 👋

On Tails OS, I connected tor and in the tor browser I wanted to check wether I am connected or not , I searched check.torproject.org in the search bar and it is showing that sorry. You are not using tor although I searched what is my ip? It shows different countries and locations, so please guide me if it is safe or not to use. Thanks

I have read the rules

I’m an activist and I need to read a lot of confidential documents I understand how to encrypt it my only issue is reading 100+ pages in 5 days using Microsoft edge tts to go over this js not exactly private and end to end encrypted well I do not believe it is as it’s not stated.

my question would be is there any known private tts that I can use or run locally I have a good gpu if that helps I have read the rules.

I have read the rules

From what attacks does it protect from that wifi isn't? Cuz dns spoof works,arp spoof works.. they both have packets encrypted with WPA2/3.

Thanks!

Hi everyone.

Firstly, I have read the rules and excuse me for my English, I am not native.

I am a Bug Bounty researcher and I am testing a Chinese web application, I need to register with a phone number to this application.

I have tried almost all of the free tools and these are the issues I faced:

• The phone number is invalid (I believe they can identify virtual phone numbers )
• The phone number are already registered
• Or even if it passed the two above walls, I will wait forever not receiving the anticipated OTP message.

I don't see paying for such service is worth it for one verification message, since most of the paid once have a minimum charge value. Given the assumption that paid services would work 100%.

Hey

A messenger app called CREO is currently being developed (this will probably only mean something to the Germans in this sub). I wanted to ask what you think of the messenger, since the CEO promises a lot

I have read the rules

So with the spread of AI, scraping of photos by the government and private companies your face does not belong to you anymore. Let's face it (hehe), you can't hide anymore and your privacy is gone. The only way you can sorta hide is by blending in.
I was thinking, is there a way to create an "avatar" of your face that a human can look at and recognize it as you? Like maybe taking a photo of yourself and distorting it to a point where facial recognition is unable to identify you, but a human goes, "yeah I think this is the same girl".
Anybody can give me an advise on how to do that and test it against facial recognition to prove the theory? Thanks!

I have read the rules, thanks

as in a trustworthy vpn i have read the rules

i run vms some for untrustworthy things

threats: malware from vms, isp, wap (wap is google), other machines on the network (my mom has a virus on her laptop and doesnt let me mess with her stuff), doxxers, data brokers

idk if someone already asked i cant sreach good bc my english is bad i have read the rules

threat moodel: surveillance captialism/policing doxxers, home and public network, isp,

i hate fingerprinting the most

i love not having my ids connect to each other

the police arent after me but laws change

i want to

• download videos/music/books/games (mostly pirated) (AND PLAY THEM)
• moreno
• chat/scroll normal websites (the ones aervage people use)
• use javascript (every site wants it)
• email encrypted

tor browser is too slow is mullvad and vpn ok?

(my account is too new for r/privacy)

plz dont downvote bc of my bad spelling

Hiya I'm a total noobie, frankly I've just started digging deeper into OPSEC a few days ago and I want to protect my privacy and prevent selling my personal data by corporations.

I would like everyhthing to be as convenient as possible. I have read the rules and hope that my post is fine also I'm not a native speaker I really hope I wrote most of the things right.

I'M REALLY REALLY OVERWHELMED BELIVE ME :(

I didn't really know much about selling data and privacy when I was really young creating accounts on untrustworthy providers but it's better late than never I guess, for now I feel a bit overwhelmed so I would appreciate if You would be lenient with me if I wrote some spoof. + I don't have resources to pay for any chargeable services.

1. I unfortunately have to use Windows for personal reasons but I really want to switch to Linux and Zorin. How would that work? From what I saw easiest option was VirtualBox but it's made(?) by Oracle so I don't trust it. I also game so it would be nice if You could inform me about pros and cons that come with that. (I don't think any of the games I play now have kernel level anticheat).
2. My second question is when I use Windows, Meta or any big-corp apps what are my best ways to protect my privacy? I would love to just delete them but sadly again for personal reasons I can't.
3. VPN?????
4. I've switched my mail to Proton and I have a filter from the Duck but it was only recently. What do I do with my old G-Mail accounts that I used for a WHILE WHILE? I have them linked to an abundence of accounts (and I really mean a lot lot of accounts). For example I use YouTube is there any alternative to that or do I have to stick with it and just do my best for Google to get off me.
5. Now passwords. What's the best password saver and is the one from Duck Duck Go reliable? Or is it better to literally just write them down on paper.
6. I use an iOS based system on my phone. What could I do to ensure my safety. I've heard that Apple doesn't sell user data but it's a big corporation so my trust again is limited.
7. Next I have no clue about compartmentalization, scrubbing my metadata and noise generation like literally null, no idea it just makes me feel dumb. If You could explain it to me and how to do it in the simplest way I would be thankfull.
8. Finally more alternatives to "regular" common used apps (e.g. YouTube, Messenger, G-mail, Google etc.).

Well I think that's it. I would be thankfull for more info and suggestions.
Thank you!

i have read the rules

I’m working on a small non-commercial OPSEC and privacy documentation project.

The intended threat model covers commercial tracking, phishing, account takeover, data brokers, device loss, and local network observation. It does not claim to protect against every state-level or global adversary.

I’m looking for criticism from people familiar with OPSEC:

- Are any explanations misleading?

- Are tools explained in relation to a threat model?

- What topics are missing?

- Where might the project give overly broad or unsafe advice?

I’m not asking for personal OPSEC advice. I’m asking whether the educational structure and threat-model explanations are useful and accurate.

Would feedback on this kind of project be appropriate here?

hey, just made a simple UI wrappet for the MAT2 metadata removal protocol that includes canarytokens and fauxx metadata planting, and all the known and reputable classic mat2 features, just leaving it out there if someone needs it: https://github.com/ParamoStudio/metadata-nt/

i have read the rules
not a promo (open source)

leave it up to the mods to decide, good day

I'm trying to build a long-term private digital workspace, and right now this is the #1 priority in my threat model. I've been around privacy and OPSEC topics for a while, so I'm familiar with things like Qubes, Tails, Whonix, Tor, full-disk encryption, compartmentalization, firmware security, and offline systems, but I don't have a huge amount of hands-on experience actually building a complete setup.

The goal is to create one digital base for basically my entire private digital life: journals, notes, plans, research, PDFs, documents, programming projects, a cybersecurity learning environment, passwords and keys, important records, private communications, and a long-term knowledge base. I don't want to keep rebuilding everything every time my threat model gets stronger. I want to establish a good foundation now and gradually harden it over the next few years.

My threat model can potentially go pretty high. I'm especially concerned about confidentiality if someone gets physical possession of the device, including the possibility of examination by people with professional forensic expertise and specialized tools. That could mean a highly capable private attacker, a forensic specialist, or law enforcement. If a device is properly shut down and encrypted, I want it to reveal as little useful information as realistically possible. I'm interested in strong encryption, protecting credentials and keys, reducing unnecessary plaintext and metadata exposure, compartmentalization, offline storage, and making sure backups are protected just as well as the main system.

I'm not looking for evidence-destruction techniques or ways to interfere with an investigation. I'm trying to understand how far legitimate data confidentiality and resistance to sophisticated physical examination can realistically be pushed, and where the practical limits are.

I also want the setup to eventually cover network privacy and ISP visibility, Tor or Whonix where appropriate, browser fingerprinting, account and identity separation, private communications, secure backups and recovery, firmware and boot security, metadata minimization, and general OPSEC. Basically, I'm not looking for an answer like "install distro X." I'm trying to understand how the whole architecture should fit together and where the important trust boundaries should be.

I'm currently starting from scratch with about a $300 budget. My previous laptop is no longer usable, so I don't have an existing system that I need to preserve or work around. I know $300 won't buy some ultimate high-assurance machine, and I'm not expecting it to. What I want is the strongest sensible starting point that won't force me to completely redesign everything later when I can afford better hardware.

I've considered a used Qubes-compatible laptop, a conventional Linux machine with full-disk encryption, Tails with Persistent Storage, a dedicated offline computer, separate online and offline systems, Whonix, or some combination of these. Qubes interests me because I could separate an offline vault, personal archive, research, development, untrusted files, cybersecurity labs, and anonymous activity instead of putting everything inside one operating system. At the same time, I wonder whether a simpler encrypted offline system would give me most of the security benefit without as much complexity.

The part I keep getting stuck on is where to draw the trust boundary. You can keep going deeper from applications to the OS, hypervisor, boot chain, firmware, TPM, Intel ME or AMD PSP, hardware, manufacturer, and eventually the supply chain. At some point you have to trust something. I'm trying to figure out where people with real experience draw that line and which layers are actually worth prioritizing first.

So if you were starting with no usable computer, had around $300, considered this your highest privacy/security priority, and wanted the setup to eventually handle a fairly serious threat model, what would you build first? Would you go with Qubes, Linux with full-disk encryption, a dedicated offline machine, separate online and offline systems, Tails, or some kind of hybrid? What would your upgrade path look like over the next few years, and what would you deliberately not worry about yet?

I'm not expecting something "unhackable" or "untraceable." I want a practical system where I understand what I'm trusting, what the setup actually protects against, what it doesn't protect against, and how I can progressively move toward higher assurance without having to start over.

i have read the rules

Is there a tool to obfuscate my text to make it seem different from my usual typing style? Only thing I've thought of is just using chatgpt on a burner but that seems extremely risky

I have read the rules​

Hi I’ve marked this as “vulnerabilities” but not entirely sure that’s correct, so apologies. Also, I have read the rules to make sure my post is allowed and I feel it is.

I’m trying to understand why, after having just spent 2 weeks in Italy (where I was mostly connected to a safe, family members WiFi) I’ve came home to find my junk mail is now filling up with junk that’s all in Italian. I didn’t sign up for anything when I was away or anything, nor did I put my email address into any Italian site.

I’m struggling to see how this has happened, cause it simply can’t be coincidence.

I operate in a environment that requires no wireless connections in any form such as Bluetooth, WIFI, radio or satellite signals. This is to prevent tracking to protect location data. The risk of having the location(s) leaked is high.

What speakers are completely air gapped (no wireless capabilities) speakers that are portable and battery operated, that can prevent me from being tracked or information being passed to or from the device?

I have read the rules

Guys, unfortunately, the EU wants to vote tomorrow on a law for social media similar to the UK's, and I'm worried about how they'll verify this (surely by forcing people to upload documents online); what can we do to get around it?

 i have read the rules

The CPU is an intel i3-3110M and ChatGPT told me that this is not supported by coreboot or libreboot. Are there any other alternatives? I have read the rules

I built The Nile, an open-source (GPL-3.0) Android app for hiding sensitive data with real plausible deniability not just an "app locker," but a two-key deniable-encryption vault with a full set of automatic panic/hide triggers.

What it does:

- Two-key hidden volume (dm-crypt): a decoy container plus a hidden region in the tail that's indistinguishable from free space — reveal the decoy key under pressure, the real data stays deniable.

- Multi-state vault (Locked / Unlocked / Decoy) with a decoy PIN that opens believable, anodyne content.

- Hide apps, files, and directories — data-swap or full uninstall/reinstall modes.

- Stealth entry: dialer codes (*#*#code#*#*), a calculator-decoy disguise, a fake crash screen, hidden launcher icon, Quick Settings tile.

Automatic hide triggers (all per-vault, opt-in):

- Dead man's switch (auto-hide if not opened in X time)

- Wrong-PIN lockdown (too many wrong device-unlock attempts)

- USB-plugged, scheduled (daily window), screen-off timeout

- Device-tamper (airplane mode / SIM swap)

- Geofence (auto-hide when you leave a safe zone)

Hardening:

- AES-256-GCM encrypted backups (Rust native crypto)

- Keystore-encrypted settings, encrypted config, FLAG_SECURE screenshot blocking, opt-in encrypted audit log, trace cleaning.

Requirements: Root (Magisk / KernelSU / APatch). Two editions — a root-only build (no module needed) and an LSPosed-module build that adds system-level app cloaking. Android 7.0+.

Source: https://github.com/binkemet/thenile

It's meant for privacy, protection against coerced disclosure, and security research. It won't defeat lawful device-unlock compulsion, and it's not for hiding things from a partner. Feedback, threat-model critique, and testing on different setups (KernelSU, ARM, other ROMs) very welcome.

i have read the rules

Hi all,

I am someone new to online privacy. I am currently on iPhone but will be setting up a Pixel 10a with GrapheneOS. Part of that setup is considering whether I should transfer to a different cellular provider. Here is some context and my threat model, along with what I am looking for:

\- I have been using Cricket for many years (10-15 if I had to guess) and have been happy with the coverage and service. I can count on one hand the amount of dropped calls I’ve had. Currently paying $55/month.
\- I tried Mint briefly for the cost savings, but it not working when I went to visit friends on the west coast of Canada was a dealbreaker for me. Switched back to Cricket my first day there.

\- For my threat model, my ‘what’ I’m trying to protect would include my emails, payment methods, and phone number from data breaches.
\- I’d also like to limit the amount of targeted advertising I get. This includes emails, physical mail, and ads inside of apps and websites.

I am currently researching Cape and Phreeli and wanted to get input from others that have tried the services. Cape’s feature of including those extra 2 numbers even for texting only seem helpful for 2FA codes, but the lack of calling for them (like if I used one strictly for doctor’s offices) is a bummer. I’m on the fence of how much the Palantir ties bother me. Still researching Phreeli but not sure what benefits I’d really get out of it.

Does anyone have any tips to cut down on the physical mail and spam emails they receive?

I realize this is a long post and is somewhat general, but any input and patience is greatly appreciated. Feel free to explain things to me like I’m 5.

I have read the rules

Thank you!

I have read the rules.

I'm in Russia. Most circumvention advice is outdated garbage. Tor? Banned. Shadowsocks? Blocked. OpenVPN/WireGuard? Fingerprinted instantly. Mass commercial VPNs? Dead. If you're going to suggest any of that, save it.

The only things that actually work right now are vless+reality over TCP or xhttp, Hysteria with masquerade, and Amnezia WG. These blend in enough to survive DPI for now. But I'm not here to ask what to use — I already know that. I'm here to ask how to use them without painting a target on myself.

The bigger problem: the state controls DNS at ISP level (NSDI), can push rogue root CAs into my system via local apps (Yandex, government services, some banks), and has DPI that's getting smarter. The CA issue is the worst: if I install any local app that auto-adds a state cert, they can MITM my TLS, including the outer TLS of these protocols. So maybe I need a clean device that never touches local software. But is that realistic? How do you maintain a separate phone/laptop for circumvention in a country where buying a SIM requires a passport and every device is tied to your identity? What about payments for servers? Crypto is also surveilled. How do you get a VPS without leaving a trail?

I need practical OPSEC around the working protocols. Specifically:

1. Device hygiene: separate device for circumvention only? What OS? GrapheneOS? Tails? How to avoid cross-contamination with daily-use devices? If I use a second phone with no local SIM, only Wi-Fi from a cafe, does that stand out more than using a local SIM with roaming?
   
2. Server procurement: which VPS providers still accept crypto without KYC? Any that don't log? How to avoid the server IP being linked to me through payment, email, or access patterns? Should I use multiple hops or just one? Does it matter if the VPS is in a country that cooperates with Russia?
   
3. Configuration OPSEC: using vless+reality, what metadata still leaks? SNI? TLS fingerprint? Traffic volume patterns? How to tune it to look like normal HTTPS to a popular domain? For Hysteria with masquerade, how to make the UDP traffic look less suspicious? For Amnezia WG, what's the current best way to hide the handshake?
   
4. Identity separation: should I use these protocols for sensitive browsing while still using local services on the same device? Probably not, but then how do you handle daily life? Is it better to use a normal Russian SIM for daily stuff and a separate clean device for anything that matters, accepting that daily activities are fully monitored?
   
5. Future whitelisting: if they move to SNI/IP whitelisting, these protocols might die overnight. What then? Are we just fucked, or are there fallback options that don't require being a targeted individual with special resources?

I'm not doing anything illegal. I just don't want to be a data point in a surveillance state. I need realistic OPSEC, not fantasy. What are people actually doing right now? Not what worked three years ago, not what some blogger wrote from outside. What works here, today, without getting yourself flagged?

EFF publishes a practical anti-doxxing guide focused on reducing your OSINT footprint

Confirmed — Electronic Frontier Foundation, late August.

EFF has published new guidance on preventing and responding to doxxing, including reviewing breach databases, public records, username reuse, social-media discoverability, data brokers and reverse-image-search exposure.

It specifically explains how attackers can combine small pieces of publicly accessible information into a larger profile using OSINT techniques.

EFF also published a companion incident-response installment on August 31 covering what to do once a doxxing incident is underway.

I have read the rules.

https://www.eff.org/deeplinks/2026/08/doxxing-safety-pt-i-prevention-and-footprint-management

https://www.eff.org/deeplinks/2026/08/doxxing-safety-part-ii-incident-response

Hi everyone,

Without going into identifying details, I live in a highly repressive, surveillance-heavy, and a highly Islamic country.

Many years ago, I experienced digital violence: intimate data was hacked and released publicly, which led to significant public backlash. I still experience some of the social consequences today. I suspect state actors may have been involved, partly because I was perceived to be LGBT. I still occasionally face confrontations and verbal abuse in my local community and on the street.

This experience eventually led me to work on human rights issues affecting people who are similarly marginalized, particularly privacy and digital rights.

Now, here’s my situation:

1. I want to pursue justice for my own case. Given the nature of the incident, I would want the case to remain anonymous to the general public. It could be known to people who absolutely need to know—such as courts, investigators, lawyers, defendants or relevant UN bodies—but ideally my identity would not be publicly connected to the case, somewhat like an anonymous or pseudonymous legal case. If people can identify me it would lead to more harm.
2. I want to continue my human rights work. My concern is that if I focus publicly on digital violence and related issues, people might eventually connect the dots and figure out that I am the person involved in the original incident. For my UN work, I need to use my full legal name and email address, and these are all public. On LinkedIn, I also need to use my legal name and headshot because otherwise NGOs and people working in the field won't connect with me professionally.
3. I also have many other interests and ambitions. I write plays, poetry, and short stories, and I’m interested in acting, directing, and voice acting. I would like to do some Instagram modeling and TikTok content, and if I ever get the opportunity, I’d like to act in films. I may even start a YouTube channel. Basically, I want to live a normal life, pursue my creative interests, and make the most of my life.
4. Ideally, I would also prefer not to be recognizable on the street. This is because I have previously experienced harassment and violence after being recognized. If it is realistically possible, I would like to maintain some separation between my public identities. But if pursuing my creative interests inevitably means giving up some degree of anonymity, I may have to accept that.

I don't want what happened to me to prevent me from pursuing my passions or living my life.

So, given all of this, how would you design a privacy-conscious life in my situation?

For example, would it make sense to:

• Use my legal name and headshot for human rights work;
• Have a separate pen name and different visual identity for writing;
• Have another stage name for acting, directing, modeling, etc.?

Or would it be better to use my legal name for both human rights work and writing, while using a stage name for acting, directing, and modeling?

Or are there other approaches that would provide better separation while still allowing me to build legitimate professional identities?

I’m not looking to disappear from the internet entirely—I’m trying to figure out how to have a meaningful public life while minimizing the chances of different parts of my life being unnecessarily connected.

PS: I have read the rules.

U.S. military disables advertising trackers over location-surveillance concerns

I have read the rules

Reuters, September 4.

The U.S. military has begun disabling advertising trackers across a range of phones and computers after reports that commercially available location data was being used to identify or target military personnel. Officials are also weighing tighter limits on personal-device use in sensitive locations.

This is a strong OPSEC and privacy teaching example. Ordinary advertising identifiers and location telemetry can become intelligence when combined with other datasets. For beginners, the takeaway is that privacy risk does not require malware or a hacked phone, legitimate apps and ad-tech can reveal movement patterns.

https://www.reuters.com/business/media-telecom/us-military-turns-off-ad-trackers-devices-amid-middle-east-targeting-reports-2026-09-04/ Sorry, we were unable to generate a preview for this web page, because the following oEmbed / OpenGraph tags could not be found: image, title

No pay wall 👇

https://techcrunch.com/2026/09/04/us-military-disabled-ad-tracking-on-troops-devices-following-reports-of-targeted-attacks/