Anonymity Guide

on

Let me first offer a brief apology. I agreed to share a basic anonymity guide without really considering my current workload; I own a full-blown startup company and am working 14-plus hours a day, all week long. I should have thought about that before offering to create the guide. Haha.

Anyway, as promised... the guide. It’s not as comprehensive as I’d have liked, but I am still available to answer questions or point you in the right direction.

I don’t think I need to say this, but this is for educational and/or research purposes only. What you do with this guide, or how far you take the information or tips in the guide are entirely on you. I’m offering this as a way to combat the invasions of privacy we all deal with daily.

Please, keep in mind I am developing a legitimate company with the aim of helping provide parity to blockchain security and development in a tangible way. I am a privacy advocate, but I am also a human with a business and a passion. Keep that in mind… please. I’m only trying to help; don’t make this into anything that it isn’t.

Finally, I am not endorsed or sponsored by any of these companies or tools. If I’ve mentioned it here it’s because I’ve either used it myself, audited it myself, or both.

Privacy today requires a certain amount of nuance, and unfortunately, it's required at every corner; professionals will appreciate this. For beginners, just be patient and understand what it is that you’re doing so that you may improve or perfect your OPSEC. Do not ever attempt to learn something while trying to complete a mission. Practice.

Be safe. DMs are open for legit questions, but don’t be fucking lazy.

--

**Introduction**

I'm not a great teacher. It's easiest for me to use my own set-up as a starting point for teaching. Having said that, I want to make something clear right away.

I use four different machines weekly:

A) My normie machine - MBP. I still encrypt everything. I still use my VPNs and exclusive networks. I still use a password manager and monitor my systems... but it's a daily-use machine. I'm a full-stack developer, and this is my daily working tool. All 2FA. All unique passwords. Security is as high as it gets. Drives are encrypted. I completely control this machine as if it were an extension of me.

B) My ML/Compute - 2x Mac Studios. Loaded. Stripped to the bare metal, basically... as much as possible, anyway. These machines are like Fort Knox because my proprietary code and datasets exist here. It's hardwired to my router; ported; and connects to less than 20 different servers. These are domain-specific machines that no one in their right mind needs. In fact, if you're in ML/AI... don't build a machine. Lease bigger, faster tools in the cloud for a year privately for the same money. Learning lesson.

B) My secondary machine - an XPS running Kali; TailsOS. I use this for everything else. The same rules apply here, but doubly so. This is pretty locked down. It also takes me about 60 seconds from boot to totally secure. I can brick this machine with keystrokes in the event I need to. It's not super secure, but it's a modified "sudo dd" command that will do it 99.5% of the time.

C) My dark machine. This aLmost NEVER connEcts to the internet; the webcam and microphone have been removed. It's wiped after use - every single time. It's also nEver more than 12 months old. Use your imaginaTion.

For the majority of this guide, you can think of the guide in reference to either my daily driver or secondary machines. These are the categories 99% of the people interested in the guide will fall into.

**Hardware**

Use dedicated machines. It’s as simple as that. It doesn’t need to be illegal; it’s simply a machine you make sure keeps you anonymous. Period. It’s not as difficult as it seems to secure anonymous hardware. The tin-foil crowd will say that global supply chains can’t be trusted, and you know what… maybe they’re right. The thing is, 99.5% of us don’t have the capacity to solve that… so we do the best we can in the real world with real tools. I can say with some confidence that TAO has lost the Intel access they’ve held for over a decade; I don’t know if that makes the tin-foil crowd’s point more or less valid. You be the judge of all that. You can have a single machine and STILL remain anonymous; the rules just apply to that machine. You don't need a ton of money or anything else to accomplish this.

  1. Tor w/ BTC for third-party electronics. They’re everywhere… You can use Torch, THW, or whatever search engine you use most often on the DW to find what you need.
  2. P2P w/ Cash is a solid option. This is self-explanatory.
  3. Clearnet w/ Different Info is the last option, and it’s one we should all be VERY careful using. Using information that isn’t your own is a crime, and using information with permission isn’t exactly secure in most cases. There is a middle ground between those two options. Stay safe.

** Any hardware purchased via the dark web or P2P needs to be wiped as soon as you receive it. In the past, I’ve installed a new SSD/HD and a new OS before I used it for anything at all.

**Software**

Use safe OSs like Tails, Qubes, or Whonix. Use TOR, and use the TOR Project itself to download the browser. If you’re ultra concerned about the age-old rumor of being “flagged” by your ISP on the download of TOR… be creative. Use public Wi-Fi to download the package; install it via portable drive. Here is a link to accomplish this: https://tb-manual.torproject.org/make-tor-portable/. I am not a huge fan of VMs, but they ARE another tool that can be used to remain anonymous if you're competent. I don't use them except in situations where I haven't a choice, but they should at least be mentioned. Many people use them to great effect.

I want you to remember that the weak link is always the human using the machine or tools. If you make sloppy, rushed mistakes… the best tools or software in the world are useless. Be patient, and do it properly the first time. It will make moving from one machine or operating system to the next much easier.

  1. Qubes: http://www.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/
  2. Whonix: http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/
  3. TailsOS:
    https://tails.net/install/download/
  4. Kali Linux: I’ll leave this to the user. Kali is not, by definition, a “privacy” OS, but it is still an amazing one. The user is responsible for security with Kali. Keep this in mind. I do not recommend it as a pure privacy OS for anyone who isn’t a professional; more like a base OS.
  5. TOR Project: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/
  6. Njalla VPN: Yes, there are other options. This is just one I really believe in.
  7. WannaRDP: IMO, the best in their class. My only advice would be to come prepared. They don’t play around with single instances or whatever. You’ll be speaking to a professional, and they’re going to expect the same in return.
  8. MAC Switcher: There are a bunch of good options, and I'll leave it to the user's preference. Most of the best are freeware tools. If you're on a Mac box and can't figure it out; you can DM me.

**Connections**

This is a REALLY brief overview of connections. It's a set of simple, hard, and fast rules that everyone should follow. Automate as much of this as possible. Most tools (NordVPN, for example) allow you to configure the automatic connection. Keep in mind, most Clearnet VPN providers DO STORE LOGS and they WILL COOPERATE WITH LE. That doesn’t mean they’re useless. People can still use them to remain anonymous… but they’re not bulletproof.

  1. Use a virtual private network (VPN) to encrypt your internet traffic and hide your IP address.
  2. Use secure Wi-Fi networks. I could write a literal book about this, but I just don’t have time time to do so. So, I’ll try to make it super simple.
    1. Learn how to own WiFi. Just do it. If you’re a member of this community it should be the most obvious thing to know how to do. Learn nmap, wireshark, etc. Figure out how to inject, monitor, etc. This is the SINGLE most effective way to ensure good access. Keep a list of connections and use it wisely. This will ALWAYS outdo SOCKS proxies or paid residential proxies. Slowly build your own list of networks. I travel a LOT… so I have a huge list of access points across the globe. It’s turned into a bit of a sport for me every time I land in a new city.
    2. One more tip… don’t be intimidated by building your own proxies for whatever. I’ve done it, and it’s come in handy. Use Raspberry Pis, Squid, and a trusted friend. It allows you access to a secure connection wherever that Raspberry is located.

**Browsing**

Use privacy-focused web browsers like Brave or Firefox. Do not bring me the Brave story from three years ago about boosting paid ads to crypto users. It’s not relevant, at all. Brave is the best publicly updated and used browser, IMO. This is based on a ton of research and actual use. Of course, it’s literally only as strong as your settings. Take the time to do it right. Enable private browsing mode and regularly clear your browsing history, cookies, and cache. Consider using browser extensions like uBlock Origin and HTTPS Everywhere for additional privacy… if you’re using Firefox, that is. Brave eliminates the need to trust any third-party extensions.

  1. It’s wise to link your mobile device, at least the daily use mobile, to Brave, too. This allows you to be certain your settings are transported between devices and always. Fingerprinting, advertising, and popups all disappear entirely. They’ve already beaten the YouTube shit, too.

**Email/Comms**

Use encrypted email services like ProtonMail or Tutanota. Enable 2FA for your email accounts and use strong, unique passwords. Use encryption tools like GNU and learn to use them from the clipboard to avoid making the mistake of leaving un/encrypted files stored on your machine. The commands are simple to run and memorize.

  1. ProtonMail: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/
  2. GNUPG: I recommend setting keys via the Terminal, and learning to use the Keyring effectively.
  3. SystemLi - http://7sk2kov2xwx6cbc32phynrifegg6pklmzs7luwcggtzrnlsolxxuyfyd.onion/en/service/

These are basics, but you should all already know how to use TG/Signal. Do not trust them implicitly. Everything is cool until it isn’t and some random government starts forcing backdoor encryption access that isn’t made public until it’s WAY too late. Be smart. Don’t just assume blind trust - ever.

**Crypto**

This is another section where I could write a literal book, but I just do not have the resources or time to do so. Having said that, I'll try to keep it as brief and to the point as possible.

  1. You can kind of obfuscate and hide your fingerprints if you’re a professional crypto user… but for most, that’s simply not possible or realistic. So, I’ll say this… learn to use custom RPCs (I’m a fan of several, but legally don’t feel great recommending anything for personal connections… I can say that LlamaNode has worked well for my public stuff, but there are SO many options. Be smart, and DYOR in regards to logs they keep.
  2. Choose your coins wisely when using them for anonymity. XMR is really the only way to go, IMO. If you're going to use BTC or ETH-based tokens... make sure you're certain you know what you're doing. Don't reuse addresses or store keys. Throwaway wallets are necessary for that to that end.
  3. Cold wallets or “gapped” wallets aren’t a luxury - they’re a necessity. Anyone using crypto needs to get themselves at least a singular cold wallet - hardware or software - and never connect it to anything at all. Period. I used to swear Ledger was the best on the market, but some disclosures have shaken that belief. I don't feel great recommending any hardware wallets right now, but you can do this with any wallet. Simply do not connect it to anything - Ever.
  4. BTC 📼 - http://y22arit74fqnnc2pbieq3wqqvkfub6gnlegx3cl6thclos4f7ya7rvad.onion/
  5. Bisq Network for decentralized P2P - https://bisq.network/
  6. No JS Version of Local Monero - http://nehdddktmhvqklsnkjqcbpmb63htee2iznpcbs5tgzctipxykpj6yrid.onion/nojs/
    1. If you’re unsure of how to turn Javascript on/off… this link will likely cover the browser you’re using - https://www.impressivewebs.com/how-to-disable-javascript-in-almost-any-browser/
  7. Railgun - I don't have time to explain what it is with adequate detail, however... It's a desktop/mobile wallet every single crypto user SHOULD be using. If you're thoughtful about usage it's as good as it gets with respect to privacy - https://www.railgun.org/
    1. I have independently audited, at a granular level, the Railgun protocol contracts without any compensation or even knowledge of the development team. It's a sound project and will act as the vanguard in their arena.
    2. A warning... the Poseidon hash precompile is difficult AF to accomplish. This just means that using the "Shielding" process via Railgun can be kind of expensive. It's not unusual for a shield to cost $50-100 on Ethereum Mainnet. Feel free to use Polygon for normal txn fees until crypto solves the Poseidon issues.

​

The everyday stuff still matters. Privacy is about building strong chains of security across the exposure you have to the Internet. This means that your very normal, very natural usage needs to be protected, as well. These are a few places to begin.

**Social Media**

Review and adjust your privacy settings on social media platforms to limit the amount of personal information that is publicly visible. Be cautious about sharing personal information and avoid accepting friend requests from unknown individuals. Contrary to popular belief… it is possible to use social media while remaining relatively private. Use second phone numbers via Burner apps, Google Voice, or whatever tool you normally use. Ensure that you're following the above rules. Most importantly...

  1. Use Fawkes before loading any images to social media, though. This is a MUST DO for anyone looking to NOT be stored in facial recognition databases. Fawkes uses GANs to defeat most facial recognition systems operating in the digital image world. I use Fawkes in the command-line and batch entire directories. This allows you to share photos without worrying about being stored in some facial recog database.
    1. https://sandlab.cs.uchicago.edu/fawkes/

**Everything Else**

  1. Online Accounts: Use strong, unique passwords for each online account. Enable 2FA whenever possible. Regularly review and update your privacy settings for online accounts. If you set up a strong password tool the right way the first time, and make sure you’re configuring the browser correctly the first time... this entire process becomes simple. Most people just don’t take the time to properly configure these tools, and they wind up making a mistake.
  2. Data Protection: Encrypt your sensitive files and folders using tools like VeraCrypt. Regularly backup your data and store it securely. You can do this 100 different ways, but I can say that trusting any big tech company’s cloud service or storage service is a massive mistake. They CAN NOT be trusted.
    1. A brief aside for Machine Learning developers, AI developers, blockchain engineers, biotech engineers, or ANYONE manipulating original or unique data... if you store your data in those databases those companies ARE going to use it to build their own tools. They will steal from you and you'll have no knowledge of it even happening. They will build out teams to manufacture the product you're building at half the cost, twice the speed, and with a marketing budget only a billion-dollar company can compete with. Do NOT make this mistake. Store sensitive, proprietary information in a way that big tech isn't involved. The genuine exception to the rule, ironically, is Apple. Apple's privacy viewpoint is clear. I do NOT think iCloud users are at risk, but AWS, GCP, Google Drive, Dropbox, Notion, etc. are all suspect, IMO. This is conjecture but founded in legitimate reason. Take it as you will.
  3. Online Payments: Use secure payment methods like virtual credit cards or digital wallets. Be cautious when sharing financial information online and only use trusted and reputable websites for online transactions. If you’re just a normal person looking to live on their own terms without being tracked… use disposable virtual cards. These can be connected to your actual accounts via a company like Revolut, or through third-party options.
  4. Miscellaneous:
    1. Learn the commands to wipe your machine. Mac is a slower process via CMD + R for Recovery Mode. Linux "dd" will overwrite the boot drive. Windows allows you to systemreset via CMD + X. Just learn the process.
    2. Learn to sandbox links or extensions; files or whatever else. You can find sandboxes through the browser nowadays. I used to have a Raspberry Pi just for this, but I started working across platforms and it got annoying. I use browser-based or VMs now. Phishing is still in the top three as far as being owned goes.
    3. Learn the industry tools. Learn what they are, what they do, and how they could or couldn't affect you and why. I'm talking hardware and software: PineAp, Flipper0, Hak5, and OM.G kits, etc. This will allow you to work backwards, and teach you to actually utilize the tools.
    4. Subscribe to and/or read the latest research from engineers or developers. Hackers are everywhere. People think we all wear black hoodies and have our assholes pierced.. but we're normal people. We write blogs and research papers; we are active on forums. Read them. Learn. A few weeks ago a couple of guys showed everyone how acoustics from an iPhone mic and speaker were able to capture keystrokes, feed it through AI for 3 seconds, and then behave as a relatively accurate keylogger THROUGH THE PHONE. These are the places to hang out. Reddit is a great starting point.
    5. Don't use the DW for just weird shit. Go hang out on Libre or Dread. Go on a few wild goose chases. Learn to quickly and effectively log in/out, all while remaining anon. Learn where the mistakes are made.
    6. Finally, DO NOT EVER SHARE YOUR LOCATION, BROWSING HISTORY, OR ANY DATA VOLUNTARILY. Turn. That. Shit. Off. It's not more convenient; it's less. You watch anime on Tuesday and Thursday you're ads are all Manga. It's such an obvious thing but so many people leave these features active. Turn location off on your phone for everything; set permissions to "While Using App" or the Android equivalent. Just be smart.

That's all for now, fam. I'm sorry if I've missed obvious stuff, or I've made errors. I will check in to correct mistakes or clarify as the comments or requests come in. Let's try to keep as much of the Q&A inside this thread so that everyone can access it... If it's a really tricky question, the DM option works... but remember that I'm super busy.

This guide is nothing more than a place to gain some knowledge and ideas. How you implement or use it, what tools or access you choose to set, etc. is really up to you. A helpful tip to beginners... everyone here with an answer for you has earned these answers through reading, practicing, studying, and usually fucking failing. No one wants to just hand over their hard work for you to skip the paces. Read. Practice. Google. Learn. THEN come ask questions.

I've gotta run. Feel free to pick it apart! Let's get it cleaned up via crowd-sourcing / Q&A so that everyone can use it. Talk soon.

I'm here for every single one of us until I'm not. Talk soon, mates.

Cheers.

submitted by /u/LoadingALIAS
[link] [comments]

from hacking: security in practice https://ift.tt/a3gqJUH

Comments

Post a Comment